https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=219153

--- Comment #9 from Mark Millard <mar...@dsl-only.net> ---
(In reply to John Baldwin from comment #5)

As for ps -M /var/crash/vmcore.7 listing no
processes:

main uses kvm_getprocs, which in turn eventually
does:

                        if (KREAD(kd, nl[0].n_value, &nprocs)) {
                                _kvm_err(kd, kd->program, "can't read nprocs");
                                return (0);
                        }

but that ends up with:

(gdb) print nprocs
$2 = 12873340

(I checked the code and "info reg" and the value
matched.)

So things are already well messed up here.

That in turn ends up used in:

                        size = nprocs * sizeof(struct kinfo_proc);
                        kd->procbase = (struct kinfo_proc *)_kvm_malloc(kd,
size);
                        if (kd->procbase == NULL)
                                return (0);

which succeeds but later there is:

                        nprocs = kvm_deadprocs(kd, op, arg, nl[1].n_value,
                                              nl[2].n_value, nprocs);
                        if (nprocs <= 0) {
                                _kvm_freeprocs(kd);
                                nprocs = 0;
                        }

which in kvm_deadprocs gets to:

                if (KREAD(kd, a_allproc, &p)) {
                        _kvm_err(kd, kd->program, "cannot read allproc");
                        return (-1);
                }
                acnt = kvm_proclist(kd, what, arg, p, bp, maxcnt);
                if (acnt < 0)
                        return (acnt);

where:

        static int
        kvm_proclist(kvm_t *kd, int what, int arg, struct proc *p,
            struct kinfo_proc *bp, int maxcnt)
        {
                int cnt = 0;
. . .

is used via:

kvm_proclist (kd=0x41e14000, what=5, arg=0, p=0x0, bp=0x42000000,
maxcnt=12873340)

and the internal kvm_proclist loop no-ops because of p:

                for (; cnt < maxcnt && p != NULL; p = LIST_NEXT(&proc, p_list))
{

So no process is listed. After the loop is:

                return (cnt);
        }

And that means:

                        nprocs = kvm_deadprocs(kd, op, arg, nl[1].n_value,
                                              nl[2].n_value, nprocs);
                        if (nprocs <= 0) {
                                _kvm_freeprocs(kd);
                                nprocs = 0;
                        }

ends up with nprocs==0 and kd is freed, hopefully including
kd->procbase being freed (I did not look).

But overall: at least one KREAD gets back a junk figure.

And with that I think I will stop for this note.

-- 
You are receiving this mail because:
You are the assignee for the bug.
_______________________________________________
freebsd-toolchain@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-toolchain
To unsubscribe, send any mail to "freebsd-toolchain-unsubscr...@freebsd.org"

Reply via email to