From mboxrd@z Thu Jan 1 00:00:00 1970 Path: news.gmane.org!not-for-mail From: Fabrice Popineau Newsgroups: gmane.emacs.bugs Subject: bug#22526: 25.0.90; Crash starting gnus Date: Sun, 14 Feb 2016 00:44:01 +0100 Message-ID: References: <56AFD88B.5040904@gmail.com> <87pow9cc0c.fsf@gnus.org> <83h9hkse78.fsf@gnu.org> <864mdk44q6.fsf@gmail.com> <83mvrcqli1.fsf@gnu.org> <86twlg2e69.fsf@gmail.com> <8360xv9ems.fsf@gnu.org> <8637sz7xmh.fsf@gmail.com> <83io1v7xcd.fsf@gnu.org> <83fuwx7vkv.fsf@gnu.org> <86fuwxk1l1.fsf@gmail.com> <837fi96mkq.fsf@gnu.org> <83vb5s6gas.fsf@gnu.org> <83d1s05zov.fsf@gnu.org> <83r3ggz2dt.fsf@gnu.org> NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: multipart/alternative; boundary=001a11c30ba0e0c229052baf5cb0 X-Trace: ger.gmane.org 1455407124 21047 80.91.229.3 (13 Feb 2016 23:45:24 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 13 Feb 2016 23:45:24 +0000 (UTC) Cc: 22526@debbugs.gnu.org, andrewjmoreton@gmail.com To: Eli Zaretskii Original-X-From: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Sun Feb 14 00:45:15 2016 Return-path: Envelope-to: geb-bug-gnu-emacs@m.gmane.org Original-Received: from lists.gnu.org ([208.118.235.17]) by plane.gmane.org with esmtp (Exim 4.69) (envelope-from ) id 1aUjsG-0000G8-9V for geb-bug-gnu-emacs@m.gmane.org; Sun, 14 Feb 2016 00:45:12 +0100 Original-Received: from localhost ([::1]:45759 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aUjsF-0002Sh-43 for geb-bug-gnu-emacs@m.gmane.org; Sat, 13 Feb 2016 18:45:11 -0500 Original-Received: from eggs.gnu.org ([2001:4830:134:3::10]:41587) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aUjsA-0002RC-Uw for bug-gnu-emacs@gnu.org; Sat, 13 Feb 2016 18:45:07 -0500 Original-Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aUjs6-0006RS-Uk for bug-gnu-emacs@gnu.org; Sat, 13 Feb 2016 18:45:06 -0500 Original-Received: from debbugs.gnu.org ([208.118.235.43]:47644) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aUjs6-0006RO-R3 for bug-gnu-emacs@gnu.org; Sat, 13 Feb 2016 18:45:02 -0500 Original-Received: from Debian-debbugs by debbugs.gnu.org with local (Exim 4.84) (envelope-from ) id 1aUjs6-0000Eh-H5 for bug-gnu-emacs@gnu.org; Sat, 13 Feb 2016 18:45:02 -0500 X-Loop: help-debbugs@gnu.org Resent-From: Fabrice Popineau Original-Sender: "Debbugs-submit" Resent-CC: bug-gnu-emacs@gnu.org Resent-Date: Sat, 13 Feb 2016 23:45:02 +0000 Resent-Message-ID: Resent-Sender: help-debbugs@gnu.org X-GNU-PR-Message: followup 22526 X-GNU-PR-Package: emacs X-GNU-PR-Keywords: Original-Received: via spool by 22526-submit@debbugs.gnu.org id=B22526.1455407068822 (code B ref 22526); Sat, 13 Feb 2016 23:45:02 +0000 Original-Received: (at 22526) by debbugs.gnu.org; 13 Feb 2016 23:44:28 +0000 Original-Received: from localhost ([127.0.0.1]:38419 helo=debbugs.gnu.org) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aUjrY-0000DC-FA for submit@debbugs.gnu.org; Sat, 13 Feb 2016 18:44:28 -0500 Original-Received: from mail-ob0-f171.google.com ([209.85.214.171]:34359) by debbugs.gnu.org with esmtp (Exim 4.84) (envelope-from ) id 1aUjrW-0000Cx-Py for 22526@debbugs.gnu.org; Sat, 13 Feb 2016 18:44:27 -0500 Original-Received: by mail-ob0-f171.google.com with SMTP id wb13so169586680obb.1 for <22526@debbugs.gnu.org>; Sat, 13 Feb 2016 15:44:26 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type; bh=1kDrkhNTdvPRd4xfC04OUi1M/YURlEYQ94SQtudVEDc=; b=HEl0ameh5Ll7jTXP5J8MZ7WmKmrbqlJe8qzGNyvFm7HJ238eE2eQu1RjcbF7KWgxvG +1m5jjvJbQCEj5gc726fXOb5JC9DBx0pW5ZAK3APSpwnzwnHZfy+/XB5CaGOhv+Vg+ws Y2BbXSSJyrWn5JVCGNhKWLItEBKoEpTQnqXlV2nGrYItBLKgXj0c+Nv2Cg6RETJOSgYW qbKfV5pnaVEwu9K9L0sL3P9uRPLKitNOfjTPrCvS2C9UywmjTupLPjOpndFRZ6ehMkvK NkK/k84lNmaF5m7xeDTg4bz7vBuHnyoe9LO/n0UiJvwhrDsehWkkHy8aBSt/UH6QgrHb tbdA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:from:date :message-id:subject:to:cc:content-type; bh=1kDrkhNTdvPRd4xfC04OUi1M/YURlEYQ94SQtudVEDc=; b=efxr0O+/KgktX12SySqdoR95EEKL05dg2BRLrWg2JzpkPtudXHR7s5SpVwU/Qamqxx EAYZGDJMSpj/CEsUNTFnakF4OpRmukTOGbqlkTdMabuVq9URBRaSw7fOHVGVFPcemSB+ blxuH1P5OixCI4q3LBdzatFKfUJ+wGKvYz36vQYsL7AM71rpjsLSd0eirE+cQ6XxDWgr oTy0OF+mqgKHcTTNuSxdcJHzS+aDrEuGoIgVcdYaLqlhEzsDPw6TzoU7kf37zClvnOKi QDWPTM9dCbns3zIaGvjrtG17HjkG+EE0uhh4sCTgWsvr90N/uvWOU7+AaAd5RJnVe6tQ 2s8Q== X-Gm-Message-State: AG10YOQOwicNxP01MvJrlz4imGiUQv4sgO+f7okedDmg3e/Yw1MpJOcHuSzo8R2SXCHCDhkyWsrZXB/xQ7vciA== X-Received: by 10.60.67.71 with SMTP id l7mr7210512oet.55.1455407061056; Sat, 13 Feb 2016 15:44:21 -0800 (PST) Original-Received: by 10.202.78.131 with HTTP; Sat, 13 Feb 2016 15:44:01 -0800 (PST) In-Reply-To: <83r3ggz2dt.fsf@gnu.org> X-BeenThere: debbugs-submit@debbugs.gnu.org X-Mailman-Version: 2.1.18 Precedence: list X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 208.118.235.43 X-BeenThere: bug-gnu-emacs@gnu.org List-Id: "Bug reports for GNU Emacs, the Swiss army knife of text editors" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Original-Sender: bug-gnu-emacs-bounces+geb-bug-gnu-emacs=m.gmane.org@gnu.org Xref: news.gmane.org gmane.emacs.bugs:113001 Archived-At: --001a11c30ba0e0c229052baf5cb0 Content-Type: text/plain; charset=UTF-8 2016-02-13 23:11 GMT+01:00 Eli Zaretskii : > I think the patch I propose below will help in that. > > Ok, let's see what Andy will come with. > > Anyway, there may be some other interference : > > > > /* If there is enough room in the current reserved area, then > > commit more pages as needed. */ > > if (m2.State == MEM_RESERVE > > && nbytes <= memInfo.RegionSize + m2.RegionSize) > > { > > > > If the address sent to mmap_realloc() has been messed up by another part > of the code, we won't know it, > > VirtualQuery will return > > a wrong value and we will keep taking wrong decisions. For example, if > m2.State is not MEM_RESERVE, > > what does that mean? > > It means the region after the one we are trying to enlarge was not > reserved by us, and we should call mmap_alloc (which we do). No? > > What I'm worried about is something else: the code is written under > the assumption that *var is the base address of the allocation, which > is why we use *var + memInfo.RegionSize to get to the next region. > But if *var is not the base address, this is wrong, and we should use > memInfo.BaseAddress instead, I think. WDYT? > > Yes, that should probably be more correct. But that would also mean someone has changed b->text->beg for some buffer b. Is there somewhere a good reason to do that ? The mmap_alloc() and mmap_realloc() are called each at one place only in buffer.c . Maybe we should try to assert *var == memInfo.BaseAddress and see if it breaks. > > > The error codes from VirtualAlloc() here are crucial. > > The error is ERROR_INVALID_PARAMETER (87), as Andy just reported. > > Weird. There is a good chance that *var is wrong and you are right. Fabrice --001a11c30ba0e0c229052baf5cb0 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable


2016-02-13 23:11 GMT+01:00 Eli Zaretskii <eliz@gnu.org>:
=
=C2=A0
I think the patch I propose= below will help in that.


Ok, let's = see what Andy will come with.
=C2=A0
> Anyway, there may be some other interference = :
>
> /* If there is enough room in the current reserved area, then
> commit more pages as needed. */
> if (m2.State =3D=3D MEM_RESERVE
> && nbytes <=3D memInfo.RegionSize + m2.RegionSize)
> {
>
> If the address sent to mmap_realloc() has been messed up by another pa= rt of the code, we won't know it,
> VirtualQuery will return
> a wrong value and we will keep taking wrong decisions. For example, if= m2.State is not MEM_RESERVE,
> what does that mean?

It means the region after the one we are trying to enlarge was not reserved by us, and we should call mmap_alloc (which we do).=C2=A0 No?

What I'm worried about is something else: the code is written under
the assumption that *var is the base address of the allocation, which
is why we use *var + memInfo.RegionSize to get to the next region.
But if *var is not the base address, this is wrong, and we should use
memInfo.BaseAddress instead, I think.=C2=A0 WDYT?


Yes, that shou= ld probably be more correct.
But that would also mean someone has= changed b->text->beg for some buffer b.
Is there somewhere= a good reason to do that ?
The mmap_alloc() and mmap_realloc() a= re called each at one place only in buffer.c .
Maybe we should tr= y to assert *var =3D=3D memInfo.BaseAddress and see if it breaks.
=C2=A0

> The error codes from VirtualAlloc() here are crucial.

The error is ERROR_INVALID_PARAMETER (87), as Andy just reported.

Weird. There i= s a good chance that *var is wrong and you are right.

<= div>Fabrice
--001a11c30ba0e0c229052baf5cb0--