-1

I want to share memory between two process.
After mmap(), I get a address mapStart, then I add offset to mapStart and get mapAddr, and make sure mapAddr will not exceed maped PAGE_SIZE.
When I write to mapAddr by

memcpy((void *)mapAddr, data, size);

everything is OK.

But when I read from mapAddr by 

memcpy( &data, (void *)mapAddr, size);`

that will case system crash.
Who know Why? The similar problem is here

Add some Info: @Tony Delroy, @J-16 SDiZ
mmap function is:

mapStart = (void volatile *)mmap(0, PAGE_SIZE, PROT_READ | PROT_WRITE, MAP_SHARED | MAP_LOCKED, memfd, pa_base);

system crash: have no any OS error message, Console print some MCA info

the detail described in here

Community
  • 1
  • 1
Feng Gang
  • 597
  • 1
  • 5
  • 10
  • 2
    Here's a crazy idea - why don't you show the code preparing arguments for `mmap()`? In all probability the protection flag's lacking `PROT_READ`, but how could we tell? – Tony Delroy Jul 02 '12 at 08:30
  • 2
    what kind of "system crash"? sigfault? kernel panic? Give the error message. – J-16 SDiZ Jul 02 '12 at 08:30
  • You mentioned IA64 in other post, is this the same arch? – J-16 SDiZ Jul 02 '12 at 08:33
  • yeah, actually these two problem is one problem, both in IA64 – Feng Gang Jul 02 '12 at 08:38
  • 2
    There are a few MCA related bugs. if you can (1) reproduce this without a kernel module (ie, this is not your bug); (2) reproduce this on other hardware (ie, this is not a hardware problem), go and ask on `linux-ia64@vger.kernel.org`. – J-16 SDiZ Jul 02 '12 at 08:44
  • 1) What is data (how big is it) ? 2) what is size? 3) what is pa_base ? – wildplasser Jul 02 '12 at 08:51
  • @wildplasser, I will read a long; size is 8; pa_base is a physical address aligned PAGE_SIZE, you could check [here](http://stackoverflow.com/questions/10733816/read-and-write-process-memory-through-dev-mem-text-segment-works-but-data-seg) – Feng Gang Jul 02 '12 at 08:56
  • see my answer for a wild guess – J-16 SDiZ Jul 02 '12 at 08:56

2 Answers2

1

Just some idea.

Is your mmap() spanning over memory regions with different attribute? This is illegal. Older kernel (you said 2.6.18) allowed this, but crash when you write to some of it.

See this post for some starting point. If it is possible, try a newer kernel.

J-16 SDiZ
  • 26,473
  • 4
  • 65
  • 84
1

There are at least two possible issues:

After mmap(), I get a address mapStart, then I add offset to mapStart and get mapAddr, and make sure mapAddr will not exceed maped PAGE_SIZE.

Not mapAddr must be made sure not to exceed the mapped size, but mapAddr+size. You are trying to touch size bytes, not just one.

memcpy((void *)mapAddr, data, size);
memcpy( &data, (void *)mapAddr, size);

Assuming data is not a array (which is a plausible assumption since you use it without address operator in the first line), the second line copies not from the location pointed to by data, but starting with data. This is quite possibly some unallocated memory, or some location on the stack, or whatever. If there is not a lot on the stack, it might as well read beyond the end of the stack into the text segment, or... something else.

(If data is indeed an array, it is of course equivalent, but then your code style would be inconsistent.)

Damon
  • 67,688
  • 20
  • 135
  • 185
  • First:I can make sure `mapAddr+size`(program tested) will not exceed the mapped size. Second: data is long type, and size is 8, so I think that will not cause problem. – Feng Gang Jul 02 '12 at 09:51
  • "Second: data is long type" -- in that case, `&data` is the address of data, and the reason for the crash is exactly as I told you. You read "some undefined memory range" starting from the address of data. Remove the address-of operator (`&`), also you want to use a pointer for where a pointer is needed. Using `long` for pointers kind of works in C because C isn't so strict with types, but it's technically wrong. A pointer and an integer (or `long` if you will) are not the same things. – Damon Jul 02 '12 at 10:29
  • Thank you very much, I am sorry that should have no `&`, it's my mistake. but remove '&' still could not resolve problem. And I also tried `printf("%ld", (long)(*(long*)mapAddr));` that caused system crash too, I use `memcpy()` just because it looks a formal read. – Feng Gang Jul 02 '12 at 13:15
  • And, I think If my program access "some undefined memory range", normally, it will cause a segment error, and program will crash and exit. But my situation is system directly Crash without any log message, but only have console output that is MCA info. – Feng Gang Jul 02 '12 at 13:19