freebsd stable - Aug 2003 - bin/55346: /bin/sh eats memory and CPU infinitely

Hi!

It seems /bin/sh in 4.8-STABLE has problem with SIGCHLD processing.
In short, it often fails to process it correctly, zombies float
around, jobs are not marked as finished in jobtab[] that fills memory
and takes much CPU to be processed.

Run this one-liner using /bin/sh and see hundreds of zombies:

#!/bin/sh
while :; do : & done

A kernel will halt this as soon as it reaches limits and write a message:

/kernel: maxproc limit exceeded by uid 0, please see tuning(7) and
login.conf(5).

Eugene Grosbein

On Fri, 15 Aug 2003, Eugene Grosbein wrote:
> Hi!
>
> It seems /bin/sh in 4.8-STABLE has problem with SIGCHLD processing.
> In short, it often fails to process it correctly, zombies float
> around, jobs are not marked as finished in jobtab[] that fills memory
> and takes much CPU to be processed.
>
> Run this one-liner using /bin/sh and see hundreds of zombies:
>
> #!/bin/sh
> while :; do : & done
Considering that with this script you are forkbombing your machine as
root, I think this falls into the "doctor it hurts when I shoot my
foot"
category.

-- 
Doug White                    |  FreeBSD: The Power to Serve
dwhite@gumbysoft.com          |  www.FreeBSD.org

Doug White wrote:
> > It seems /bin/sh in 4.8-STABLE has problem with SIGCHLD processing.
> > In short, it often fails to process it correctly, zombies float
> > around, jobs are not marked as finished in jobtab[] that fills memory
> > and takes much CPU to be processed.
> >
> > Run this one-liner using /bin/sh and see hundreds of zombies:
> >
> > #!/bin/sh
> > while :; do : & done
> 
> Considering that with this script you are forkbombing your machine as
> root, I think this falls into the "doctor it hurts when I shoot my
foot"
> category.
Perhaps. Anyway, debug shows that jobtab[] in /bin/sh grows indefinitely
in some scenarios and the reason should be SIGCHLD processing problem.

Eugene

I think I've found a memory leak in /bin/sh.
There is a case when dowait() and does frees resources of
completed job correctly. Here is a patch:

Index: jobs.c
==================================================================RCS file:
/home/ncvs/src/bin/sh/jobs.c,v
retrieving revision 1.27.2.11
diff -u -r1.27.2.11 jobs.c
--- jobs.c	22 Jul 2003 13:11:26 -0000	1.27.2.11
+++ jobs.c	15 Aug 2003 13:02:23 -0000
@@ -960,10 +960,8 @@
 				if (jp->state != state) {
 					TRACE(("Job %d: changing state from %d to %d\n", jp - jobtab +
1, jp->state, state));
 					jp->state = state;
-#if JOBS
 					if (done)
-						deljob(jp);
-#endif
+					    freejob(jp);
 				}
 			}
 		}
 
Eugene Grosbein

I'm sorry for my terrible English.
> There is a case when dowait() and does frees resources of
> completed job correctly.
Read: There is a case when dowait() does not free resources of
completed job correctly.

Eugene Grosbein