File fix_shared_memory_cleanup.patch of Package sblim-sfcb.17479
bugzilla#1161745
During exit, the shared memory is marked for deletion and subsequently
deleted. This happens in a different thread started by a signal handler
that shuts down the entire daemon. Unfortunately, the main loop
is not stopped but is waiting on recvmsg which will be EINTR. The other
thread then checks if it should trace the error message or not and
the trace variable is allocated on the now detached shared memory segment
which segfaults.
What we should do instead and simply mark the segment for deletion
while retaining the attached state. The kernel will clean this up
on exit and shmem segment will be deleted while we can avoid invalid
pointer dereference.
See Bugzilla for details.
Index: sblim-sfcb-1.4.8/trace.c
===================================================================
--- sblim-sfcb-1.4.8.orig/trace.c
+++ sblim-sfcb-1.4.8/trace.c
@@ -118,7 +118,6 @@ void
_sfcb_trace_stop()
{
shmctl(shmid, IPC_RMID, 0);
- shmdt(vpDP);
_sfcb_debug = 0;
}