Date: Fri, 9 Jun 2000 12:02:55 -0600 (MDT) From: Alex Rousskov <rousskov@ircache.net> To: freebsd-net@FreeBSD.ORG Subject: corrupted poll(2) results? Message-ID: <Pine.BSF.4.05.10006091140280.9329-100000@pail.ircache.net> In-Reply-To: <20000305161638.A85421@prism.flugsvamp.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Hi there,
I am looking at a possible bug in poll(2) implementation on
FreeBSD 3.3-RELEASE. It seems that, under heavy network load, poll(2)
sometimes writes garbage into the user-supplied array of pollfd's.
Here is a simple check that I have added deep inside Web
Polygraph benchmark (quoted with simplifications):
// set first fds_count items of hot_fds array...
for (int i = 0; i < fds_count; ++i) // pre-call check
Assert(hot_fds[i].fd >= 0);
const int res = poll(hot_fds, fds_count, timeout);
for (int i = 0; i < fds_count; ++i) // post-call check
Assert(hot_fds[i].fd >= 0);
The second loop sometimes fails indicating a negative file descriptor on
return. Coredump shows that probably all FDs after the failed one are
also corrupted. Not all corrupted entries have negative FDs, it is just
easier to check for negative ones.
Res is 184. Failed "i" is 4608. Fds_count is 4966. Hot_fds array has memory
allocated for 32768 entries.
The bug can be seen on several hosts so it is probably not a faulty memory
problem. I also have seen a coredump with what looks like poll(2) writing
response into memory not pointed by hot_fds. A completely different structure
was corrupted with what looks like a poll(2) response. Note that hot_fds is
allocated only once, so I doubt I am corrupting my own memory (still possible
of course).
Can anybody offer any insight? Is there anything that can make poll fail when
more than 4K FDs are in use?
Thank you,
Alex.
P.S. FreeBSD was patched with http://polygraph.ircache.net/Tips/FreeBSD-3.3/
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?Pine.BSF.4.05.10006091140280.9329-100000>