Unreapable zombie

This is just a rant, not a question.

Suppose you have process A, which forks child B. Suppose process B exits, becoming a zombie. Then, process A exits without reaping child B. Child B is now re-parented to init, but since it is already a zombie, init never receives a SIGCHLD and thus does not reap the zombie.

Result? A zombie that you can't get rid of. I hate it.

Hmm. Well it appears that overnight, init finally decided to reap my zombie. It sure took it a damn long while though. Sounds like a good method for DoS'ing a system -- fork() off a child which sleep()'s for a little while then exits, but before it exits, quit yourself. Eventually the process table would get filled up with zombies, disabling the whole damn system.

Ugh.

This is not supposed to happen.

Quote:

---

Originally Posted by man wait

A child that terminates, but has not been waited for becomes a "zombie". The kernel maintains a minimal set of information about the zombie process (PID, termination status, resource usage information) in order to allow the parent to later perform a wait to obtain information about the child. As long as a zombie is not removed from the system via a wait, it will consume a slot in the kernel process table, and if this table fills, it will not be possible to create further processes. If a parent process terminates, then its "zombie" children (if any) are adopted by init(8), which automatically performs a wait to remove the zombies.

---

Now, you can fill the PID table by just fork()-ing repeatedly, and not returned, known as "Fork bombing"

Quote:

---

Originally Posted by Cactus_Hugger

This is not supposed to happen.


Now, you can fill the PID table by just fork()-ing repeatedly, and not returned, known as "Fork bombing"

---

Yes -- the thing I don't like is how long it takes for init to reap. It does eventually get around to it, but it seems to be on a timer at least several hours long. So if you do this fast enough, init won't keep up with it.

I'm familiar with fork bombing, but zombie bombing is worse, because you can't kill the zombies. If init doesn't reap them for hours, you're screwed for hours.

Hmmm. I've noticed this happen before and I always dump the software which caused it. Interesting.

Code:

---

./zombie;ps -ef | grep zombie

---

Always turns up nothing or the grep process. By the time ps can enumerate the processes, init has reaped the zombie. (./zombie pauses before exiting, so you can verify the zombie.)

Code:

---

#include <stdio.h>
#include <unistd.h>

int main()
{
        int ret;

        ret = fork();
        if(ret < 0)
        {
                perror("zombie");
                return 1;
        }
        else if(ret == 0)
        {
                // Child
                return 0;
        }
        else
        {
                printf("Child forked. (PID = %d)\nType a number followed by enter to quit.\n", ret);
                scanf("%d", &ret);
                return 0;
        }
        return 0;
}

---

My init seems to clean them up fairly quickly. According to Gentoo I have sysvinit 2.86. YMMV?