Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Posting-Version: version B 2.10.1 (Tek) 9/26/83; site daemon.UUCP
Path: utzoo!watmath!clyde!burl!ulysses!mhuxl!houxm!houxz!vax135!cornell!uw-beaver!tektronix!daemon!damonp
From: damonp@daemon.UUCP (Damon Permezel)
Newsgroups: net.bugs.4bsd
Subject: Crash with panic pagein mfind.
Message-ID: <339@daemon.UUCP>
Date: Mon, 27-Aug-84 00:49:18 EDT
Article-I.D.: daemon.339
Posted: Mon Aug 27 00:49:18 1984
Date-Received: Wed, 22-Aug-84 01:19:58 EDT
Organization: Tektronix, Beaverton OR
Lines: 92

Index:  /sys/h/text.h 4.2BSD

Description:
    If more than 127 instances of the same text image are in the
    system, the 128th entry causes the x_count field in the text
    table to become negative, resulting in addition of a duplicate
    entry to the text table.
    Because a duplicate entry exists in the text table, a critical
    section exists in pagein() that causes the cmap[] to become
    munged, resulting in panic().

Repeat-By:

	fix up execl path and run as root:

    /*
     * try to generate pagein mfind panic
     */
    #include 
    #include 

    int kiddies = 0;
    int reaper();

    main(c, v)
    char **v; {
        int i;

        if (c != 2)
            exit(fprintf(stderr, "ni\n"));

        switch (*v[1]) {
            case 'm':
                master();
                break;

            case 's':
                slave();
        }
    }

    master() {

        signal(SIGCHLD, reaper);

        for (;;) {
            while (kiddies < 129) {
                switch (fork()) {
                    case -1:
                        continue;
                    
                    case 0:
                        execl("/s3g/damonp/tmp/crash", "crash", "s", 0);
                        exit();
                    
                    default:
                        ++kiddies;
                }
            }
            sigblock(1 << SIGCHLD);
            if (kiddies)
                sigpause(0);
            sigblock(0);
        }
    }

    slave() {
        sleep(40);
        exit(0);
    }

    reaper() {
        int pid;

        wait(&pid);
        --kiddies;
    }

Fix:
    Change type of x_count and x_ccount in text.h from char to short.
    This allows for (2^15)-1 references to a text table entry to exist
    before the problem recurrs, and I shudder to think of the system with
    that many process slots.

    Pstat (and maybe others) will have to be recompiled.

UUCPnet:  {decvax,allegra}!tektronix!damonp
CSnet  :  damonp@tek
ARPAnet:  damonp.tek@csnet-relay
US mail:  Damon Permezel,  Tektronix, Inc.,  Small Systems Support Group
       :  PO Box 500  Del.Sta. 19-333, Beaverton, OR  97077
MaBell :  (503) 627-5037