Re: mmapped memory lost after fork

[Corinna Vinschen]

On Jul 14 12:47, Tenedor Roquefort wrote:
> I'm using Cygwin 1.5.10-3 and have found what seems to
> be a fork/mmap bug. I have two examples where a forked
> child cannot access memory that was mmapped by the
> parent. The problem seems to arise when the parent
> munmaps some pages (different from the ones the child
> will try to access) before forking.
> 
> In the example below, the parent mmaps 2 pages,
> munmaps the first page, writes to the second page and
> forks. Then both parent and child try to access the
> second page, the parent succeeds but the child dies
> trying. The examples work on Linux without the child
> dying. Has this problem been documented before and is
> there a known fix?
> 
> Thanks.

Thanks for the test case!  It was very helpful.  It turned out to be
an off-by-one error in the child routine which generates the same
memory protection layout as in the parent process.

I've applied a fix and created a new developer snapshot.  Please give
it a try, see http://cygwin.com/snapshots/


Corinna

-- 
Corinna Vinschen  Please, send mails regarding Cygwin to
Cygwin Co-Project Leader  mailto:[EMAIL PROTECTED]
Red Hat, Inc.

--
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple
Problem reports:   http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ:   http://cygwin.com/faq/

mmapped memory lost after fork

[Tenedor Roquefort]

I'm using Cygwin 1.5.10-3 and have found what seems to
be a fork/mmap bug. I have two examples where a forked
child cannot access memory that was mmapped by the
parent. The problem seems to arise when the parent
munmaps some pages (different from the ones the child
will try to access) before forking.

In the example below, the parent mmaps 2 pages,
munmaps the first page, writes to the second page and
forks. Then both parent and child try to access the
second page, the parent succeeds but the child dies
trying. The examples work on Linux without the child
dying. Has this problem been documented before and is
there a known fix?

Thanks.



#include 
#include 
#include 

int main ()
{
char *p;
int sz = 0x2000;
int keep = 0x1000;
int offset;
int magic = 0x33;
int pid;
int rv;

p = (char *) mmap (0, sz, PROT_READ|PROT_WRITE,
   MAP_PRIVATE|MAP_ANONYMOUS, -1, 0);
printf ("mmap() = %p\n", p);

/* keep upper chunk -> segv */
rv = munmap (p, keep);
offset = keep + 0x42;
printf ("munmap() = %d\n",rv);

p[offset] = magic;

pid = fork ();

switch (pid)
{
case (-1):
printf ("fork() failed\n");
break;
case (0):
printf ("child touching %p\n", &(p[offset]));
printf ("child M[%p] = 0x%x\n",
&(p[offset]), p[offset]);
break;
default:
printf ("parent touching %p\n", &(p[offset]));
printf ("parent M[%p] = 0x%x\n",
&(p[offset]), p[offset]);
break;
}

return 0;
}




__
Do you Yahoo!?
Yahoo! Mail - 50x more storage than other providers!
http://promotions.yahoo.com/new_mail

mmap1.c
Description: mmap1.c


mmap2.c
Description: mmap2.c
--
Unsubscribe info:  http://cygwin.com/ml/#unsubscribe-simple
Problem reports:   http://cygwin.com/problems.html
Documentation: http://cygwin.com/docs.html
FAQ:   http://cygwin.com/faq/