Re: [BUG] Invalid return address of mmap() followed by mbind() inmultithreaded context

From: Vasileios Karakasis
Date: Sun Jun 19 2011 - 19:42:54 EST

I'm sending you a slightly modified version that actually makes clear
how libnuma is affected. If you compile with -DUSE_LIBNUMA, you will get
an EFAULT from mbind() and then crash.

This is the gdb output where the address passed to mbind() is invalid.

(gdb) r
Starting program: a.out
[Thread debugging using libthread_db enabled]
[New Thread 0x7ffff7633700 (LWP 17977)]
a.out: mmap-bug.c:29: thread_func: Assertion `0 && "mbind() failed"' failed.

Program received signal SIGABRT, Aborted.
0x00007ffff7667a75 in *__GI_raise (sig=<value optimized out>)
at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
in ../nptl/sysdeps/unix/sysv/linux/raise.c
(gdb) f 3
#3 0x00000000004007b8 in thread_func (args=0x0) at mmap-bug.c:29
29 assert(0 && "mbind() failed");
(gdb) p addr
$1 = (unsigned char *) 0x7ffff5c27000 <Address 0x7ffff5c27000 out of bounds>

#include <assert.h>
#include <sys/mman.h>
#include <pthread.h>
#include <numa.h>
#include <numaif.h>

#define NR_ITER 10240
#define PAGE_SIZE 4096

void *thread_func(void *args)
unsigned char *addr;
int err, i;
unsigned long node = 0x1;

for (i = 0; i < NR_ITER; i++) {
addr = numa_alloc_onnode(PAGE_SIZE, 0);
if (addr == (void *) -1)
assert(0 && "mmap() failed");

err = mbind(addr, PAGE_SIZE, MPOL_BIND, &node, sizeof(node), 0);
if (err < 0)
assert(0 && "mbind() failed");
*addr = 0;

return (void *) 0;

int main(void)
pthread_t thread;
pthread_create(&thread, NULL, thread_func, NULL);
pthread_join(thread, NULL);
return 0;

On 06/18/2011 09:41 PM, Vasileios Karakasis wrote:
> That's right, but what I want to demonstrate is that the address
> returned by mmap() is invalid and the dereference crashes the program,
> while it shouldn't. I could equally omit this statement, in which case
> mbind() would fail with EFAULT.
> On 06/18/2011 09:12 PM, Andi Kleen wrote:
>> mbind() can be only done before the first touch. you're not actually testing
>> numa policy.
>> -andi


Attachment: signature.asc
Description: OpenPGP digital signature