From owner-freebsd-stable@FreeBSD.ORG  Sat Aug 16 20:51:44 2003
Return-Path: <owner-freebsd-stable@FreeBSD.ORG>
Delivered-To: freebsd-stable@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id BA51037B401; Sat, 16 Aug 2003 20:51:44 -0700 (PDT)
Received: from www.svzserv.kemerovo.su (www.svzserv.kemerovo.su
	[213.184.65.80])	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 05E8543F3F; Sat, 16 Aug 2003 20:51:43 -0700 (PDT)
	(envelope-from eugen@kuzbass.ru)
Received: from kuzbass.ru (kost [213.184.65.82])h7H3pcel056786;
	Sun, 17 Aug 2003 11:51:39 +0800 (KRAST)
	(envelope-from eugen@kuzbass.ru)
Message-ID: <3F3EFB9E.B69ADCB9@kuzbass.ru>
Date: Sun, 17 Aug 2003 11:50:54 +0800
From: Eugene Grosbein <eugen@kuzbass.ru>
Organization: SVZServ
X-Mailer: Mozilla 4.8 [en] (Win98; U)
X-Accept-Language: ru,en
MIME-Version: 1.0
To: Doug White <dwhite@gumbysoft.com>
References: <20030815211321.A11482@grosbein.pp.ru>
	<20030815191010.S16351@carver.gumbysoft.com>
	<20030816120012.A24906@carver.gumbysoft.com>
Content-Type: text/plain; charset=koi8-r
Content-Transfer-Encoding: 7bit
cc: stable@freebsd.org
cc: bug-followup@freebsd.org
Subject: Re: bin/55346: /bin/sh eats memory and CPU infinitely
X-BeenThere: freebsd-stable@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Production branch of FreeBSD source code
	<freebsd-stable.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-stable>
List-Post: <mailto:freebsd-stable@freebsd.org>
List-Help: <mailto:freebsd-stable-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-stable>,
	<mailto:freebsd-stable-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 17 Aug 2003 03:51:45 -0000

Doug White wrote:

> Ah, OK, I follow you there. send-pr away.

It seems that patch replaces memory leak with double-free bug:
waitforjob() will call freejob() just after dowait().

This corrected version removes extra freejob() call.

--- jobs.c.orig Mon Aug  4 11:48:00 2003
+++ jobs.c      Sun Aug 17 11:20:55 2003
@@ -889,8 +889,6 @@
 #endif
        else
                st = WTERMSIG(status) + 128;
-       if (! JOBS || jp->state == JOBDONE)
-               freejob(jp);
        if (int_pending()) {
                if (WIFSIGNALED(status) && WTERMSIG(status) == SIGINT)
                        kill(getpid(), SIGINT);
@@ -960,10 +958,8 @@
                                if (jp->state != state) {
                                        TRACE(("Job %d: changing state from %d
to %d\n", jp -
jobtab + 1, jp->state, state));
                                        jp->state = state;
-#if JOBS
                                        if (done)
-                                               deljob(jp);
-#endif
+                                               freejob(jp);
                                }
                        }
                }


Eugene Grosbein