| On November 1, 2007 I reported a bug to Apple using Apple's Bug Reporter that Oracle 10.1.0.5 would cause a kernel panic In Leopard 10.5.1 if Oracle's processes parameter was set larger than about 75. I also used Darwin and the kernel debug kit to determine where the bug was and found and reported not only the bug, but also the reason, and the solution. I also built a kernel with the bug fixed and sucessfully ran Oracle 10.1.0.5 with Oracle processes set to 300. Bug report # 5736091.
Since this was a bug that causes a kernel panic (serious) I fully expected the bug to be fixed in 10.5.2. Today I upgraded to 10.5.2 and Oracle Server 10.1.0.5 still causes a kernel panic if Oracle's processes parameter is set larger than about 75. In other words, the bug was not fixed in 10.5.2. This really is inexcusable since the bug and the solution should have been very easy for any software engineer that knows what he/she is doing to understand from the bug report.
So maybe someone with some influence who reads this list can hopefully get this bug fixed for the next release, although there is no reason that it should not have been fixed for 10.5.2, having been reported back in November along with an explanation and a solution.
The bug is in bsd/kern/sysv_sem.c and is related to MAX_SOPS.
There was new code added in Leopard surrounded by #if CONFIG_MACF ... #endif. Inside this code there is a line in a for loop,
j != (sops[i].sem_op == 0) ? SEM_R : SEM_A;
and the variable i is exceeding MAX_SOPS because Oracle is passing a valid parameter for nsops but one which exceeds MAX_SOPS.
The problem is that the code between #if CONFIG_MACF ... #endif is in the wrong place. Immediately following #if CONFIG_MACF ... #endif is code which checks the validity of "nsops" which is what was passed by Oracle. This returns an error if nsops exceeds MAX_SOPS.
if (nsops < 0 || nsops > MAX_SOPS) {
eval = E2BIG;
goto semopout;
}
The new code #if CONFIG_MACF ... #endif should be moved from being in front of the error checking code to after the error checking code, e.g., now,
#if CONFIG_MACF .... #endif if (nsops < 0 || nsops > MAX_SOPS) { eval - E2BIG; goto semopout; }
and instead should be
if (nsops < 0 || nsops > MAX_SOPS) { eval - E2BIG; goto semopout; } #if CONFIG_MACF .... #endif
That way the code between #if CONFIG_MACF ... #endif will not exceed MAX_SOPS and cause the kernel panic if the semaphone call parameter is passed with a value which exceeds MAX_SOPS. I know that Apple Engineers read this list. Please can one of you get this fixed for the next release.
The 10.5.2 bug ID is 5736091.
Thanks
Rand
|