fdopen() leaks badly when multithreaded

[Gurusamy Sarathy]

This short program demonstrates a fairly serious problem with
fdopen() when used in a multi-threaded application.  The real
application from which I condensed this actually segfaults, but
this variant only seems to leak.  I've attached the output when
running it under the glibc 2.2.4 that's in RedHat 7.2, and
for comparison, the output of the same program producing the
right output when running under Solaris 2.6.

    /*
     * thrun.c - Demonstrate a memory leak (or worse) in glibc 2.2.4.
     * To build on Linux:
     *  gcc -o thrun thrun.c -D_REENTRANT -lpthread
     * On Solaris:
     *  gcc -o thrun thrun.c -DPOSIX_PTHREAD_SEMANTICS -D_REENTRANT -lposix4 
-lpthread
     */

    #include <stdio.h>
    #include <pthread.h>
    #include <unistd.h>
    #include <sys/types.h>
    #include <errno.h>

    #define NUM_THREADS 5
    #define REPORT_INTERVAL 10000

    void *
    threadfunc (void *args)
    {
        int i = 0, succ = 0, fail = 0;

        while (1) {
            FILE *f1, *f2;
            ++i;
            f1 = fopen("/etc/passwd", "r");
            if (f1) {
                succ++;
                f2 = fdopen(fileno(f1), "r");
                if (f2) {
                    succ++;
                    fclose(f2);
                }
                else {
                    fail++;
                }
                /* putting this fclose() before the other one makes
                 * it leak slower, but it still leaks */
                fclose(f1);
            }
            else {
                fail++;
            }

            if (!(i % REPORT_INTERVAL)) {
                fprintf(stderr, "%d: %d iterations [fail=%d,succ=%d]\n",
                        (int)pthread_self(), i, fail, succ);
            }
        }
        /* NOT REACHED */
        return 0;
    }

    int
    main(int ac, char **av, char **env)
    {
        int i;
        char ps[256];

        sprintf(ps, "ps -o 'pid,vsz,args' -p %d", (int)getpid());
        for (i = 0; i < NUM_THREADS; ++i) {
            pthread_t t;
            if (pthread_create(&t, NULL, threadfunc, NULL)) {
                fprintf(stderr, "pthread_create() failed!");
                exit(1);
            }
            else {
                pthread_detach(t);
            }
        }
        while (1) {
            system(ps);
            sleep(3);
        }
        /* NOT REACHED */
        return 0;
    }

Additional details available on request.

Hope this helps,


Sarathy
address@hidden
-----------------------------------8<-----------------------------------
Results on Linux (RedHat 7.2 with stock glibc 2.2.4):
  PID   VSZ COMMAND
28470 44548 ./thrun3
4101: 10000 iterations [fail=1053,succ=18947]
5126: 10000 iterations [fail=1083,succ=18917]
3076: 10000 iterations [fail=1088,succ=18912]
2051: 10000 iterations [fail=1143,succ=18857]
1026: 10000 iterations [fail=1232,succ=18768]
5126: 20000 iterations [fail=2358,succ=37642]
3076: 20000 iterations [fail=2437,succ=37563]
  PID   VSZ COMMAND
28470 90552 ./thrun3
2051: 20000 iterations [fail=2429,succ=37571]
4101: 20000 iterations [fail=2438,succ=37562]
1026: 20000 iterations [fail=2438,succ=37562]
3076: 30000 iterations [fail=3635,succ=56365]
5126: 30000 iterations [fail=3823,succ=56177]
2051: 30000 iterations [fail=3774,succ=56226]
1026: 30000 iterations [fail=3788,succ=56212]
4101: 30000 iterations [fail=3864,succ=56136]
3076: 40000 iterations [fail=4909,succ=75091]
  PID   VSZ COMMAND
28470 139184 ./thrun3
5126: 40000 iterations [fail=5165,succ=74835]
2051: 40000 iterations [fail=5210,succ=74790]
1026: 40000 iterations [fail=5179,succ=74821]
4101: 40000 iterations [fail=5329,succ=74671]
3076: 50000 iterations [fail=6077,succ=93923]
5126: 50000 iterations [fail=6482,succ=93518]
1026: 50000 iterations [fail=6432,succ=93568]
2051: 50000 iterations [fail=6668,succ=93332]
4101: 50000 iterations [fail=6723,succ=93277]
3076: 60000 iterations [fail=7393,succ=112607]
  PID   VSZ COMMAND
28470 186484 ./thrun3
1026: 60000 iterations [fail=7683,succ=112317]
5126: 60000 iterations [fail=7933,succ=112067]
4101: 60000 iterations [fail=7936,succ=112064]
2051: 60000 iterations [fail=7984,succ=112016]
3076: 70000 iterations [fail=8928,succ=131072]
1026: 70000 iterations [fail=8967,succ=131033]
5126: 70000 iterations [fail=9271,succ=130729]
4101: 70000 iterations [fail=9343,succ=130657]
2051: 70000 iterations [fail=9351,succ=130649]
  PID   VSZ COMMAND
28470 233480 ./thrun3
3076: 80000 iterations [fail=10132,succ=149868]
1026: 80000 iterations [fail=10200,succ=149800]
5126: 80000 iterations [fail=10699,succ=149301]
4101: 80000 iterations [fail=10409,succ=149591]
2051: 80000 iterations [fail=10603,succ=149397]
3076: 90000 iterations [fail=11373,succ=168627]
1026: 90000 iterations [fail=11504,succ=168496]
4101: 90000 iterations [fail=11506,succ=168494]
5126: 90000 iterations [fail=12043,succ=167957]
2051: 90000 iterations [fail=11902,succ=168098]
  PID   VSZ COMMAND
28470 278952 ./thrun3
3076: 100000 iterations [fail=12774,succ=187226]
1026: 100000 iterations [fail=12845,succ=187155]
4101: 100000 iterations [fail=12899,succ=187101]
5126: 100000 iterations [fail=13387,succ=186613]
2051: 100000 iterations [fail=13486,succ=186514]
3076: 110000 iterations [fail=14081,succ=205919]
1026: 110000 iterations [fail=14205,succ=205795]
4101: 110000 iterations [fail=14351,succ=205649]
5126: 110000 iterations [fail=14785,succ=205215]
2051: 110000 iterations [fail=14788,succ=205212]
  PID   VSZ COMMAND
28470 328936 ./thrun3
3076: 120000 iterations [fail=15579,succ=224421]
1026: 120000 iterations [fail=15558,succ=224442]
4101: 120000 iterations [fail=15642,succ=224358]
5126: 120000 iterations [fail=16417,succ=223583]
2051: 120000 iterations [fail=16318,succ=223682]
3076: 130000 iterations [fail=16976,succ=243024]
1026: 130000 iterations [fail=17075,succ=242925]
4101: 130000 iterations [fail=17111,succ=242889]
5126: 130000 iterations [fail=17653,succ=242347]
  PID   VSZ COMMAND
28470 379848 ./thrun3
2051: 130000 iterations [fail=17696,succ=242304]
3076: 140000 iterations [fail=18373,succ=261627]
4101: 140000 iterations [fail=18297,succ=261703]
1026: 140000 iterations [fail=18650,succ=261350]
5126: 140000 iterations [fail=19126,succ=260874]
2051: 140000 iterations [fail=19296,succ=260704]
3076: 150000 iterations [fail=19812,succ=280188]
4101: 150000 iterations [fail=19761,succ=280239]
1026: 150000 iterations [fail=20102,succ=279898]
  PID   VSZ COMMAND
28470 429480 ./thrun3
5126: 150000 iterations [fail=20454,succ=279546]
2051: 150000 iterations [fail=20421,succ=279579]
3076: 160000 iterations [fail=21028,succ=298972]
4101: 160000 iterations [fail=21089,succ=298911]
1026: 160000 iterations [fail=21620,succ=298380]
5126: 160000 iterations [fail=21752,succ=298248]
2051: 160000 iterations [fail=21677,succ=298323]
3076: 170000 iterations [fail=22486,succ=317514]
4101: 170000 iterations [fail=22399,succ=317601]
  PID   VSZ COMMAND
28470 478464 ./thrun3
1026: 170000 iterations [fail=23081,succ=316919]
2051: 170000 iterations [fail=23090,succ=316910]
3076: 180000 iterations [fail=23859,succ=336141]
5126: 170000 iterations [fail=23285,succ=316715]
4101: 180000 iterations [fail=23447,succ=336553]
1026: 180000 iterations [fail=24221,succ=335779]
2051: 180000 iterations [fail=24510,succ=335490]
5126: 180000 iterations [fail=24585,succ=335415]
3076: 190000 iterations [fail=25261,succ=354739]
4101: 190000 iterations [fail=24945,succ=355055]
  PID   VSZ COMMAND
28470 526068 ./thrun3
1026: 190000 iterations [fail=25683,succ=354317]
2051: 190000 iterations [fail=25750,succ=354250]
5126: 190000 iterations [fail=26077,succ=353923]
3076: 200000 iterations [fail=26846,succ=373154]
4101: 200000 iterations [fail=26520,succ=373480]
1026: 200000 iterations [fail=27107,succ=372893]
2051: 200000 iterations [fail=27055,succ=372945]
5126: 200000 iterations [fail=27250,succ=372750]
3076: 210000 iterations [fail=27945,succ=392055]
4101: 210000 iterations [fail=27800,succ=392200]
^C
-----------------------------------8<-----------------------------------
Results on Solaris 2.6:
  PID  VSZ COMMAND
18786 1232 ./thrun3
7: 10000 iterations [fail=0,succ=20000]
5: 10000 iterations [fail=0,succ=20000]
  PID  VSZ COMMAND
18786 1272 ./thrun3
6: 10000 iterations [fail=0,succ=20000]
8: 10000 iterations [fail=0,succ=20000]
4: 10000 iterations [fail=0,succ=20000]
7: 20000 iterations [fail=0,succ=40000]
  PID  VSZ COMMAND
18786 1272 ./thrun3
5: 20000 iterations [fail=0,succ=40000]
6: 20000 iterations [fail=0,succ=40000]
4: 20000 iterations [fail=0,succ=40000]
8: 20000 iterations [fail=0,succ=40000]
7: 30000 iterations [fail=0,succ=60000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
6: 30000 iterations [fail=0,succ=60000]
8: 30000 iterations [fail=0,succ=60000]
5: 30000 iterations [fail=0,succ=60000]
4: 30000 iterations [fail=0,succ=60000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
7: 40000 iterations [fail=0,succ=80000]
8: 40000 iterations [fail=0,succ=80000]
6: 40000 iterations [fail=0,succ=80000]
4: 40000 iterations [fail=0,succ=80000]
5: 40000 iterations [fail=0,succ=80000]
7: 50000 iterations [fail=0,succ=100000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
6: 50000 iterations [fail=0,succ=100000]
8: 50000 iterations [fail=0,succ=100000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
4: 50000 iterations [fail=0,succ=100000]
5: 50000 iterations [fail=0,succ=100000]
7: 60000 iterations [fail=0,succ=120000]
6: 60000 iterations [fail=0,succ=120000]
8: 60000 iterations [fail=0,succ=120000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
4: 60000 iterations [fail=0,succ=120000]
6: 70000 iterations [fail=0,succ=140000]
7: 70000 iterations [fail=0,succ=140000]
5: 60000 iterations [fail=0,succ=120000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
8: 70000 iterations [fail=0,succ=140000]
4: 70000 iterations [fail=0,succ=140000]
6: 80000 iterations [fail=0,succ=160000]
7: 80000 iterations [fail=0,succ=160000]
5: 70000 iterations [fail=0,succ=140000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
8: 80000 iterations [fail=0,succ=160000]
4: 80000 iterations [fail=0,succ=160000]
7: 90000 iterations [fail=0,succ=180000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
5: 80000 iterations [fail=0,succ=160000]
8: 90000 iterations [fail=0,succ=180000]
6: 90000 iterations [fail=0,succ=180000]
4: 90000 iterations [fail=0,succ=180000]
7: 100000 iterations [fail=0,succ=200000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
5: 90000 iterations [fail=0,succ=180000]
8: 100000 iterations [fail=0,succ=200000]
6: 100000 iterations [fail=0,succ=200000]
4: 100000 iterations [fail=0,succ=200000]
7: 110000 iterations [fail=0,succ=220000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
8: 110000 iterations [fail=0,succ=220000]
5: 100000 iterations [fail=0,succ=200000]
6: 110000 iterations [fail=0,succ=220000]
7: 120000 iterations [fail=0,succ=240000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
4: 110000 iterations [fail=0,succ=220000]
8: 120000 iterations [fail=0,succ=240000]
5: 110000 iterations [fail=0,succ=220000]
7: 130000 iterations [fail=0,succ=260000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
6: 120000 iterations [fail=0,succ=240000]
8: 130000 iterations [fail=0,succ=260000]
4: 120000 iterations [fail=0,succ=240000]
5: 120000 iterations [fail=0,succ=240000]
6: 130000 iterations [fail=0,succ=260000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
7: 140000 iterations [fail=0,succ=280000]
4: 130000 iterations [fail=0,succ=260000]
8: 140000 iterations [fail=0,succ=280000]
5: 130000 iterations [fail=0,succ=260000]
6: 140000 iterations [fail=0,succ=280000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
7: 150000 iterations [fail=0,succ=300000]
8: 150000 iterations [fail=0,succ=300000]
4: 140000 iterations [fail=0,succ=280000]
5: 140000 iterations [fail=0,succ=280000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
8: 160000 iterations [fail=0,succ=320000]
4: 150000 iterations [fail=0,succ=300000]
6: 150000 iterations [fail=0,succ=300000]
7: 160000 iterations [fail=0,succ=320000]
5: 150000 iterations [fail=0,succ=300000]
8: 170000 iterations [fail=0,succ=340000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
4: 160000 iterations [fail=0,succ=320000]
7: 170000 iterations [fail=0,succ=340000]
6: 160000 iterations [fail=0,succ=320000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
8: 180000 iterations [fail=0,succ=360000]
5: 160000 iterations [fail=0,succ=320000]
4: 170000 iterations [fail=0,succ=340000]
7: 180000 iterations [fail=0,succ=360000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
6: 170000 iterations [fail=0,succ=340000]
8: 190000 iterations [fail=0,succ=380000]
5: 170000 iterations [fail=0,succ=340000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
7: 190000 iterations [fail=0,succ=380000]
4: 180000 iterations [fail=0,succ=360000]
6: 180000 iterations [fail=0,succ=360000]
8: 200000 iterations [fail=0,succ=400000]
  PID  VSZ COMMAND
18786 1280 ./thrun3
5: 180000 iterations [fail=0,succ=360000]
7: 200000 iterations [fail=0,succ=400000]
4: 190000 iterations [fail=0,succ=380000]
^C