Public issue detail

Runaway CPU investigation for redis-check-rdb: busy poll at __snprintf_chk@plt

redis-check-rdb is stuck in a likely busy poll loop: 5.11% of sampled CPU passed through __snprintf_chk@plt, with repeated thread backtraces show 1 thread(s) around 0x00007fbc72ca5ffe in ?? () and 1 thread(s) around 0x00007fbc72ca5ffe in ?? ().

highpackage: redis-toolssource: redisscore: 106reports: 2patch attempt readyrelated upstream: review

Last seen: 2026-05-13 02:32 UTC. Public JSON: /v1/issues/019df672-9134-74c0-a830-9c987d0858ad

Patch related to upstream review

This diff is preserved for inspection, but a related source-family upstream review is the current handoff. Use the retained patch as evidence only; do not open a duplicate review from this artifact.

best patchcreated: 2026-05-13 01:48 UTCvalidation: readyrelated upstream: review

redis-check-rdb likely remains stuck in a busy-poll loop. A diagnosis report and patch proposal were created locally.

Suggested subject

zmalloc: reuse proc stat fd for Linux RSS sampling

Commit message.

Redis samples resident set size (RSS, the process memory resident in RAM) from `serverCron()` every 100 ms. On Linux that goes through `get_proc_stat_ll()`, which reopened `/proc/self/stat` for every sample.

Keep a cached `/proc/self/stat` descriptor and read it with `pread()`. Track the pid that opened the descriptor so forked children reopen it for their own `/proc/self/stat`. This keeps the existing sampling cadence and parsing logic, but avoids repeated open/close work in the idle cron path.

Problem. redis-check-rdb is stuck in a likely busy poll loop: 5.11% of sampled CPU passed through __snprintf_chk@plt, with repeated thread backtraces show 1 thread(s) around 0x00007fbc72ca5ffe in ?? () and 1 thread(s) around 0x00007fbc72ca5ffe in ?? ().

How this patch connects to the issue.

Fixer observed a Redis process with repeated `epoll_wait`, `openat`, and `read` activity, where the proc evidence showed periodic reads of `/proc/self/stat`. This was observed by Fixer and not independently reproduced locally because ptrace-based tracing is blocked in this sandbox.

The cautious code-level cause is Redis’ Linux RSS sampling path: `serverCron()` calls `cronUpdateMemoryStats()` under the existing `run_with_period(100)` convention, and `zmalloc_get_rss()` reads field 24 through `get_proc_stat_ll()`. Before this patch, every sample opened, read, and closed `/proc/self/stat`.

The change keeps the existing helper and return contract, uses Redis’ existing direct Linux procfs style with `O_CLOEXEC`, and adds a short comment for the fork invariant: the cached descriptor must be reopened if `getpid()` changes. No relevant local procfs file-IO wrapper was found; `anetCloexec()` exists for networking fds, but this block already uses direct libc procfs APIs.

The expected effect is to reduce repeated procfs open/close churn during idle memory sampling while preserving the same RSS value parsing and cron frequency.

Files touched

  • src/zmalloc.c

Validation

  • Fixer marked this proposal `ready` on 2026-05-13 01:48 UTC.
  • The underlying issue cluster has 2 report(s) and was last seen 2026-05-13 02:32 UTC.
  • The published diff touches src/zmalloc.c.
  • `make` from the workspace root: passed. It rebuilt Redis, including `src/zmalloc.o`, `redis-server`, `redis-cli`, `redis-benchmark`, `redis-check-rdb`, `redis-check-aof`, and test modules. `make check` from the workspace root: failed before tests ran because the test harness could not allocate ports: `Can't find a non busy port in the 21079-21110 range.` `git diff --check`: passed. Independent reproduction attempt: `timeout 4s strace -f -e trace=openat,pread64,read,close,epoll_wait ...` was blocked by sandbox ptrace restrictions: `PTRACE_TRACEME: Operation not permitted` and `ptrace(PTRACE_SEIZE, 5): Operation not permitted`. A Unix-socket Redis smoke attempt was also blocked by the sandbox with `setsockopt SO_REUSEADDR: Operation not permitted`, so the collected trace signal was not independently reproduced.

Related upstream review

This retained diff belongs to an issue family already tracked upstream as https://github.com/redis/redis/pull/15271 (review; 3 related rows).

Original harvest blockers

These blockers remain on the preserved local diff, but the related upstream review above is the current handoff.

  • blocked validation
diff --git a/src/zmalloc.c b/src/zmalloc.c
index 7d9fe6e..fddb7c6 100644
--- a/src/zmalloc.c
+++ b/src/zmalloc.c
@@ -642,15 +642,35 @@ void zmadvise_dontneed(void *ptr) {
 int get_proc_stat_ll(int i, long long *res) {
 #if defined(HAVE_PROC_STAT)
     char buf[4096];
-    int fd, l;
+    static int proc_stat_fd = -1;
+    static pid_t proc_stat_pid = -1;
+    ssize_t l = -1;
+    pid_t pid = getpid();
     char *p, *x;
 
-    if ((fd = open("/proc/self/stat",O_RDONLY)) == -1) return 0;
-    if ((l = read(fd,buf,sizeof(buf)-1)) <= 0) {
-        close(fd);
-        return 0;
+    /* The cached fd belongs to the process that opened it. After fork(),
+     * reopen it so /proc/self/stat keeps referring to the current process. */
+    if (proc_stat_fd != -1 && proc_stat_pid != pid) {
+        close(proc_stat_fd);
+        proc_stat_fd = -1;
+        proc_stat_pid = -1;
     }
-    close(fd);
+
+    for (int attempts = 0; attempts < 2; attempts++) {
+        if (proc_stat_fd == -1) {
+            proc_stat_fd = open("/proc/self/stat",O_RDONLY|O_CLOEXEC);
+            if (proc_stat_fd == -1) return 0;
+            proc_stat_pid = pid;
+        }
+
+        l = pread(proc_stat_fd,buf,sizeof(buf)-1,0);
+        if (l > 0) break;
+
+        close(proc_stat_fd);
+        proc_stat_fd = -1;
+        proc_stat_pid = -1;
+    }
+    if (l <= 0) return 0;
     buf[l] = '\0';
     if (buf[l-1] == '\n') buf[l-1] = '\0';
 

Technical snapshot

This is the clearest retained userspace thread cluster Fixer captured while the process was spinning.

Representative thread backtrace

  • Command: /usr/bin/redis-server 127.0.0.1:6379
  • Why Fixer classified it this way: The trace repeatedly returns to a poll-family syscall without meaningful blocking, which suggests a busy event-loop wakeup.
  • Thread summary: thread backtraces show 1 thread(s) around 0x00007fbc72ca5ffe in ?? () and 1 thread(s) around 0x00007fbc72ca5ffe in ?? ()
  • Contention signals: gdb-stderr: gdb: warning: Couldn't determine a path for the index cache directory. warning: "target:<path>": could not open as an executable file: Input<path> error. warning: `target:<path>': can't open to read symbols: Input<path> error. warning: Could not load vsyscall page because no executable was specified
  • Repeated loop: epoll_wait -> openat -> read
  • Top syscalls: epoll_wait x51, close x50, openat x50, read x50
  • Package: redis-tools 5:8.0.6-1
  • Kernel: 6.17.10+deb14-amd64
  • Distribution: debian
0x00007fbc72ca5ffe in ?? ()
0x00007fbc72c9a7a4 in ?? ()
0x00007fbc73ef75c8 in ?? ()
0x0000000000000000 in ?? ()

Possible duplicates

These are suggestions based on sanitized trigram similarity plus structured fields like package, subsystem, classification, and wait site. They are not auto-merged.

postgres is stuck in a likely busy poll loop: 25.00% of sampled CPU passed through psi_task_switch, with repeated thread backtraces show 1 thread(s) around 0x00007f2f1a25e687 in __GI__IO_flush_all () from target:<path>.

highsource: linuxscore: 106reports: 1similarity: 69%

Why this looks related: same classification, same subsystem, same wait site

Last seen: 2026-10-16 06:35 UTC. Public page: /issues/01a1383d-aefb-7940-ab82-04e5a3259603. Public JSON: /v1/issues/01a1383d-aefb-7940-ab82-04e5a3259603

postgres is stuck in a likely busy poll loop: 7.33% of sampled CPU passed through __pte_offset_map_lock, with repeated thread backtraces show 1 thread(s) around 0x00007f322d29a7d2 in ?? () from target:<path>.

highpackage: postgresql-18source: postgresql-18score: 106reports: 2successful triagesimilarity: 66%

Why this looks related: same classification, same subsystem, same wait site

Last seen: 2026-10-22 21:43 UTC. Public page: /issues/019e50c1-4b02-72f3-8479-d67944473579. Public JSON: /v1/issues/019e50c1-4b02-72f3-8479-d67944473579

postgres is stuck in a likely busy poll loop: 100.00% of sampled CPU passed through PreCommit_on_commit_actions, with repeated thread backtraces show 1 thread(s) around 0x00007f322d29a7d2 in ?? () from target:<path>.

highpackage: postgresql-18source: postgresql-18score: 106reports: 2similarity: 65%

Why this looks related: same classification, same subsystem, same wait site

Last seen: 2026-10-22 21:43 UTC. Public page: /issues/019e5105-5337-7b80-ade1-c7185ee1c6f2. Public JSON: /v1/issues/019e5105-5337-7b80-ade1-c7185ee1c6f2

postgres is stuck in a likely file not found retry loop: 1.84% of sampled CPU passed through malloc, with repeated thread backtraces show 1 thread(s) around 0x00007f85b973a687 in __GI__IO_flush_all () from target:<path>.

highscore: 106reports: 1similarity: 50%

Why this looks related: same subsystem, same wait site

Last seen: 2026-10-13 06:02 UTC. Public page: /issues/01a133a7-70dc-73b3-b590-4cd62ec20ac9. Public JSON: /v1/issues/01a133a7-70dc-73b3-b590-4cd62ec20ac9

postgres is stuck in a likely socket churn loop: 1.90% of sampled CPU passed through unresolved offset, with repeated thread backtraces show 1 thread(s) around 0x00007f1303299687 in __GI__IO_flush_all () from target:<path>.

highscore: 106reports: 1similarity: 49%

Why this looks related: same subsystem, same wait site

Last seen: 2026-10-19 03:26 UTC. Public page: /issues/019f7962-c828-7c50-8189-f439a8864601. Public JSON: /v1/issues/019f7962-c828-7c50-8189-f439a8864601

postgres is stuck in a likely timer churn loop: 100.00% of sampled CPU passed through start_dl_timer, with repeated thread backtraces show 1 thread(s) around 0x00007f322d29a7d2 in ?? () from target:<path>.

highpackage: postgresql-18source: postgresql-18score: 106reports: 2similarity: 49%

Why this looks related: same subsystem, same wait site

Last seen: 2026-10-22 21:43 UTC. Public page: /issues/019e5d7e-79c8-70a3-bcbd-6d4643b9285a. Public JSON: /v1/issues/019e5d7e-79c8-70a3-bcbd-6d4643b9285a

Worker outcome summary

This issue has 2 recorded worker attempts. Only ready diffs and ready triage handoffs get dedicated public boards. Diagnosis-only reports and blocked attempts are summarized here so it is easier to see why work stalled.

2 ready patch attempts

No ready triage handoffs, diagnosis-only reports, failed patch attempts, explained impossible attempts, or other attempt states.

Published attempts

ready patch attempt

patch

redis-check-rdb likely remains stuck in a busy-poll loop. A diagnosis report and patch proposal were created locally.

state: readycreated: 2026-05-13 01:48 UTCvalidation: ready
Published session

Prompt

## Plan Pass

You are planning a fixer patch before any edits happen.

Read the evidence bundle at `./evidence.json`. The prepared workspace is `./workspace` and it was acquired via `debian-source`. The original pre-edit snapshot is available at `./source` if you need to inspect it. For interpreter processes, plan from the script/application entrypoint evidence first and include the runtime only as a second investigation target unless the evidence proves a runtime bug.

Validation expectation: try the project-level build/test entrypoint from the workspace root before reporting only a focused leaf compile. Detected candidate(s): `make` and, if available, `make check`. If the project-level command fails because dependencies or generated files are missing, include the exact command and failure reason in `## Validation`, then run the narrowest relevant compile/test that is still reproducible from a clean checkout.

Upstream-style expectation: before planning or editing, check for contribution/style docs (`CONTRIBUTING`, `HACKING`, `README-hacking`, `README.md`, `docs/`, `dev-docs/`) and scan the touched subsystem for local helpers. If the project has wrappers for file IO, path-relative IO, process spawning, memory allocation, logging, locking, or platform compatibility, prefer those wrappers over generic libc/std APIs. Do not invent a reproducer or user-visible failure that is not in the evidence bundle; if the evidence is profiler-only or indirect, describe it as a targeted mitigation or stop with a diagnosis instead of presenting a speculative patch as a confirmed bug fix. In the plan and final validation, name any such helper, convention, or evidence limit you found, or say that no relevant local helper was found. Treat this as a `redis` upstream patch, not just a Debian-local workaround. Inspect the relevant code, nearby callers, project contribution docs, and local helper/compat APIs, but do not edit files in this pass.

Return a short markdown plan with these exact sections:

## Problem
## Evidence Confidence
## Proposed Subject
## Patch Plan
## Risks
## Validation

Classify `## Evidence Confidence` as exactly one of `reproduced`, `observed`, or `inferred`. Use `inferred` only for a no-patch diagnosis/report plan unless you can name the extra evidence you will collect before editing; inferred source patches are blocked by Fixer because they are not pull-request-ready. For `observed` source-patch plans, plan to say in the final `## Issue Connection` that the failure was observed by Fixer and not independently reproduced. The plan must explain how the proposed code change addresses the observed issue evidence, call out any prior Fixer patch that should be improved or replaced, reject awkward control flow such as avoidable `goto` if there is a cleaner bounded alternative, name any local helper APIs or maintainer conventions the patch should follow, and keep the intended maintainer-facing explanation clear enough that someone unfamiliar with the local complaint wording can still follow the fix. In `## Validation`, name the reproducible configure/build/test entrypoint you will try from the workspace root before any focused leaf compile or smoke check, and include one bounded independent reproduction attempt for the collected failure signal when it is safe and cheap. Do not plan to claim `reproduced` unless that reproduction command or test can actually show the failure.

## Patch Pass

You are working on a bounded fixer proposal.

Read the evidence bundle at `./evidence.json`. The prepared workspace is `./workspace` and it was acquired via `debian-source`. Produce the smallest reasonable patch for the target repository, keep the change upstreamable, prefer the clearest control flow available, and do not keep avoidable `goto` when a simpler structure would read better. Before introducing new file, process, allocation, locking, networking, or platform APIs, inspect nearby code and project contribution docs for existing helpers or compatibility wrappers and use those local patterns unless you can explain why they do not fit. Validate from a reproducible workspace-root entrypoint before falling back to focused leaf commands; if a build or test cannot run, report the exact command, the exact blocker, and any narrower check you ran instead. During validation, also try one bounded independent reproduction of the collected failure signal when it is safe and cheap, such as a failing test, smoke command, perf/strace comparison, or before/after runtime check. Only use `reproduced` if that command or test actually reproduced the failure; otherwise keep `observed` and report the reproduction blocker. The final explanation must connect the observed issue evidence to the actual code change, not just paraphrase the diff. Write like a maintainer is going to read the patch mail cold: explain the bug in plain language, define subsystem-specific jargon the first time you need it, and make the causal story obvious. Explicitly classify evidence confidence as `reproduced`, `observed`, or `inferred`: `reproduced` means you reproduced the failure locally; `observed` means Fixer has direct crash/log/trace evidence but you did not independently reproduce it; `inferred` means the source patch is not pull-request-ready, so do not leave a source diff unless you first gather stronger observed/reproduced evidence; otherwise return a no-patch diagnosis/report. For any source-changing `observed` patch, say explicitly in `## Issue Connection` that the failure was observed by Fixer and not independently reproduced. If you introduce non-obvious state translation, index remapping, or backend split logic, add a short source comment that explains the invariant being preserved.

Start by explaining the likely root cause from the collected perf, strace, and /proc evidence. If you cannot land a safe patch, leave a diagnosis that is strong enough for an upstream bug report.

Validation expectation: try the project-level build/test entrypoint from the workspace root before reporting only a focused leaf compile. Detected candidate(s): `make` and, if available, `make check`. If the project-level command fails because dependencies or generated files are missing, include the exact command and failure reason in `## Validation`, then run the narrowest relevant compile/test that is still reproducible from a clean checkout.

Upstream-style expectation: before planning or editing, check for contribution/style docs (`CONTRIBUTING`, `HACKING`, `README-hacking`, `README.md`, `docs/`, `dev-docs/`) and scan the touched subsystem for local helpers. If the project has wrappers for file IO, path-relative IO, process spawning, memory allocation, logging, locking, or platform compatibility, prefer those wrappers over generic libc/std APIs. Do not invent a reproducer or user-visible failure that is not in the evidence bundle; if the evidence is profiler-only or indirect, describe it as a targeted mitigation or stop with a diagnosis instead of presenting a speculative patch as a confirmed bug fix. In the plan and final validation, name any such helper, convention, or evidence limit you found, or say that no relevant local helper was found. Treat this as a `redis` upstream patch, not just a Debian-local workaround. 

Keep the change narrowly scoped and summarize validation clearly.

In every authoring pass, your final response must start with `Subject: <single-line git commit subject>` and then include these markdown sections exactly:

## Commit Message
A short upstream-friendly explanation of what changed and why. Write it in plain language that a maintainer can follow without local complaint context. If you use subsystem jargon, define it immediately.

## Evidence Confidence
Exactly one word: `reproduced`, `observed`, or `inferred`. Use `reproduced` only when you reproduced the failure locally with a command or test, and include that command/test in `## Validation`. Use `observed` when Fixer has direct crash/log/trace evidence but you did not independently reproduce it. If `## Git Add Paths` lists source files for an `observed` patch, `## Issue Connection` must explicitly say the failure was observed by Fixer and not independently reproduced. Use `inferred` for profiler/strace/indirect evidence; inferred responses may be no-patch diagnoses or reports, but inferred source patches are not pull-request-ready until stronger evidence is gathered.

## Issue Connection
Write this as maintainer-facing patch mail, not as local Fixer notes. Cover four things explicitly in readable sentences: the user-visible symptom or the exact collected signal, the code-level cause or the cautious inference from evidence, the specific change you made, and the expected effect. Do not invent a reproducer, command line, crash, or user-visible failure that is not present in the evidence bundle. If the evidence is direct-but-not-reproduced, say it was observed by Fixer and not independently reproduced. If the evidence is indirect and you did not gather stronger evidence, do not leave a source diff; write a no-patch diagnosis/report instead. Include an explicit effect sentence such as `The expected effect is ...`, `This should reduce ...`, or `This prevents ...` for source patches. If the logic is non-obvious in code, mention that you added a short explanatory comment.

## Git Add Paths
List the repo-relative paths that belong in the final patch, one per line. Use `None` only when you intentionally made no source changes. Include intentionally new files, and do not list generated build artifacts.

## Validation
List the checks you ran, or say clearly that you could not run them. Include the independent reproduction command/test and result when `## Evidence Confidence` is `reproduced`; if reproduction was attempted but blocked, name the exact blocker and keep confidence at `observed` or `inferred`.

Before editing, read the plan at `./plan-output.txt` and follow it unless the code proves part of it wrong. If you change course, say so explicitly in the final write-up instead of silently drifting from the plan.

## Review Pass 1

You are reviewing a freshly generated fixer patch.

Read the evidence bundle at `./evidence.json`. The prepared workspace is `./workspace` and it was acquired via `debian-source`. Review the first patch pass. The original pre-edit snapshot is available at `./source` for diffing. The workspace currently changes these repo-relative paths: src/zmalloc.c. Verify that `## Git Add Paths` matches this exact set and that `## Issue Connection` explains every shipped functional file.

Upstream-style expectation: before planning or editing, check for contribution/style docs (`CONTRIBUTING`, `HACKING`, `README-hacking`, `README.md`, `docs/`, `dev-docs/`) and scan the touched subsystem for local helpers. If the project has wrappers for file IO, path-relative IO, process spawning, memory allocation, logging, locking, or platform compatibility, prefer those wrappers over generic libc/std APIs. Do not invent a reproducer or user-visible failure that is not in the evidence bundle; if the evidence is profiler-only or indirect, describe it as a targeted mitigation or stop with a diagnosis instead of presenting a speculative patch as a confirmed bug fix. In the plan and final validation, name any such helper, convention, or evidence limit you found, or say that no relevant local helper was found. Treat this as a `redis` upstream patch, not just a Debian-local workaround.

Validation expectation: try the project-level build/test entrypoint from the workspace root before reporting only a focused leaf compile. Detected candidate(s): `make` and, if available, `make check`. If the project-level command fails because dependencies or generated files are missing, include the exact command and failure reason in `## Validation`, then run the narrowest relevant compile/test that is still reproducible from a clean checkout. The latest author response is at `./patch-output.txt`. Inspect the current code and changed paths like a strict code reviewer. Focus on correctness, regressions, maintainability, awkward control flow such as avoidable `goto`, missing validation, weak or non-gittable commit message text, and explanations that fail to connect the observed issue evidence to the code change. Also review the maintainer experience: the patch mail should be easy to accept upstream, the user-visible bug should be explained in plain language, subsystem-specific jargon should be defined when first used, and any non-obvious state translation or index remapping in code should have a short explanatory comment. Reject patches that omit `## Evidence Confidence`, use anything other than `reproduced`, `observed`, or `inferred`, or sound more certain than that evidence level allows. Reject patches that claim `reproduced` unless `## Validation` names the concrete reproduction command or test and its result. Reject patches that invent a reproducer, command line, crash, or user-visible failure not present in the evidence bundle; indirect profiler or strace evidence may justify a cautious mitigation, but the author must say it is indirect instead of presenting it as a confirmed upstream bug. Reject patches that introduce generic libc/std APIs when nearby code or project docs provide a local compat/helper API for the same job, unless the author explicitly justifies the exception. Reject validation that only reports a leaf object/syntax build when a project-level configure/build/test entrypoint exists and was not attempted; if a full build cannot run, the author must show the exact failed command and blocker.

Do not apply code changes in this pass.

Return a short markdown review report. The first non-empty line must be exactly one of:

RESULT: ok
RESULT: fix-needed

If you choose `RESULT: fix-needed`, add a `## Findings` section with concrete, actionable items.

Response

## Plan Pass

## Problem
Fixer observed an idle Redis process repeatedly waking from `epoll_wait` and reading `/proc/self/stat` about every 100 ms via `zmalloc_get_rss()` from `serverCron()`/`cronUpdateMemoryStats()`. The evidence is profiler/strace-based, not a user-visible crash. The code already documents `zmalloc_get_rss()` as relatively slow, so the patch should reduce the observed procfs syscall churn without changing Redis’ stats cadence.

## Evidence Confidence
observed

## Proposed Subject
`zmalloc: reuse proc stat fd for Linux RSS sampling`

## Patch Plan
Patch `src/zmalloc.c` only. Improve the existing Linux `get_proc_stat_ll()` helper to keep a cached `/proc/self/stat` fd and read it with `pread(..., 0)` instead of opening and closing the proc file on every 100 ms RSS sample.

Follow local conventions found in the subsystem: keep the logic inside `get_proc_stat_ll()`, preserve its `0/1` return contract, use existing libc-style procfs code already present there, and avoid changing `serverCron()`’s `run_with_period(100)` behavior. Use `O_CLOEXEC` as other Redis code does for persistent fds. No relevant Redis wrapper exists specifically for procfs reads; `anetCloexec()` exists for portability, but this Linux-only block already uses direct `open/read/close`.

Handle fork safety by tracking `getpid()` alongside the cached fd. If the pid changes, close and reopen so a child process does not accidentally read the parent’s proc stat fd. Avoid awkward `goto`; use a small bounded retry path for reopen/read failure.

There is no prior Fixer patch in the workspace (`git diff` is empty), so this should be a fresh upstream-style patch rather than replacing earlier edits.

## Risks
Caching procfs fds can be wrong after fork unless pid changes are handled. `pread()` support on `/proc/self/stat` must be verified; if it fails, the helper should fall back cleanly or reopen once. The evidence names `redis-check-rdb` as the artifact path but the sampled command/thread names are `redis-server`, so the maintainer explanation should describe the procfs RSS sampling path rather than claim a redis-check-rdb-specific bug.

## Validation
From the workspace root, first try the project entrypoints: `make`, then `make check` if build succeeds. If either fails because of missing deps/generated files, report the exact command and failure reason, then run the narrowest reproducible check such as `make -C src zmalloc.o` or `make -C src redis-server`.

Bounded independent signal check: run a locally built idle server under `strace` for a few seconds, e.g. `timeout 3s strace -ff -e trace=openat,read,close,epoll_wait src/redis-server --save "" --appendonly no --port 0`, and compare `/proc/self/stat` `openat` frequency before/after. The expected result after the patch is that repeated RSS samples no longer reopen `/proc/self/stat` every cycle while Redis still starts and reports memory info normally.

## Patch Pass

Subject: zmalloc: reuse proc stat fd for Linux RSS sampling

## Commit Message
Redis samples resident set size (RSS, the process memory resident in RAM) from `serverCron()` every 100 ms. On Linux that goes through `get_proc_stat_ll()`, which reopened `/proc/self/stat` for every sample.

Keep a cached `/proc/self/stat` descriptor and read it with `pread()`. Track the pid that opened the descriptor so forked children reopen it for their own `/proc/self/stat`. This keeps the existing sampling cadence and parsing logic, but avoids repeated open/close work in the idle cron path.

## Evidence Confidence
observed

## Issue Connection
Fixer observed a Redis process with repeated `epoll_wait`, `openat`, and `read` activity, where the proc evidence showed periodic reads of `/proc/self/stat`. This was observed by Fixer and not independently reproduced locally because ptrace-based tracing is blocked in this sandbox.

The cautious code-level cause is Redis’ Linux RSS sampling path: `serverCron()` calls `cronUpdateMemoryStats()` under the existing `run_with_period(100)` convention, and `zmalloc_get_rss()` reads field 24 through `get_proc_stat_ll()`. Before this patch, every sample opened, read, and closed `/proc/self/stat`.

The change keeps the existing helper and return contract, uses Redis’ existing direct Linux procfs style with `O_CLOEXEC`, and adds a short comment for the fork invariant: the cached descriptor must be reopened if `getpid()` changes. No relevant local procfs file-IO wrapper was found; `anetCloexec()` exists for networking fds, but this block already uses direct libc procfs APIs.

The expected effect is to reduce repeated procfs open/close churn during idle memory sampling while preserving the same RSS value parsing and cron frequency.

## Git Add Paths
src/zmalloc.c

## Validation
`make` from the workspace root: passed. It rebuilt Redis, including `src/zmalloc.o`, `redis-server`, `redis-cli`, `redis-benchmark`, `redis-check-rdb`, `redis-check-aof`, and test modules.

`make check` from the workspace root: failed before tests ran because the test harness could not allocate ports: `Can't find a non busy port in the 21079-21110 range.`

`git diff --check`: passed.

Independent reproduction attempt: `timeout 4s strace -f -e trace=openat,pread64,read,close,epoll_wait ...` was blocked by sandbox ptrace restrictions: `PTRACE_TRACEME: Operation not permitted` and `ptrace(PTRACE_SEIZE, 5): Operation not permitted`. A Unix-socket Redis smoke attempt was also blocked by the sandbox with `setsockopt SO_REUSEADDR: Operation not permitted`, so the collected trace signal was not independently reproduced.

## Review Pass 1

RESULT: ok

The patch is narrowly scoped to `src/zmalloc.c`, and `## Git Add Paths` matches the current changed path exactly. The issue connection explains the shipped file’s functional change and stays appropriately cautious for `observed` evidence.

Validation is acceptable for this pass: root `make` passed, root `make check` was attempted and failed with the exact port-range blocker, and the independent trace reproduction was attempted but blocked by ptrace restrictions. The code follows the existing direct Linux procfs style in `zmalloc.c`; no relevant local procfs wrapper was found.

Diff

diff --git a/src/zmalloc.c b/src/zmalloc.c
index 7d9fe6e..fddb7c6 100644
--- a/src/zmalloc.c
+++ b/src/zmalloc.c
@@ -642,15 +642,35 @@ void zmadvise_dontneed(void *ptr) {
 int get_proc_stat_ll(int i, long long *res) {
 #if defined(HAVE_PROC_STAT)
     char buf[4096];
-    int fd, l;
+    static int proc_stat_fd = -1;
+    static pid_t proc_stat_pid = -1;
+    ssize_t l = -1;
+    pid_t pid = getpid();
     char *p, *x;
 
-    if ((fd = open("/proc/self/stat",O_RDONLY)) == -1) return 0;
-    if ((l = read(fd,buf,sizeof(buf)-1)) <= 0) {
-        close(fd);
-        return 0;
+    /* The cached fd belongs to the process that opened it. After fork(),
+     * reopen it so /proc/self/stat keeps referring to the current process. */
+    if (proc_stat_fd != -1 && proc_stat_pid != pid) {
+        close(proc_stat_fd);
+        proc_stat_fd = -1;
+        proc_stat_pid = -1;
     }
-    close(fd);
+
+    for (int attempts = 0; attempts < 2; attempts++) {
+        if (proc_stat_fd == -1) {
+            proc_stat_fd = open("/proc/self/stat",O_RDONLY|O_CLOEXEC);
+            if (proc_stat_fd == -1) return 0;
+            proc_stat_pid = pid;
+        }
+
+        l = pread(proc_stat_fd,buf,sizeof(buf)-1,0);
+        if (l > 0) break;
+
+        close(proc_stat_fd);
+        proc_stat_fd = -1;
+        proc_stat_pid = -1;
+    }
+    if (l <= 0) return 0;
     buf[l] = '\0';
     if (buf[l-1] == '\n') buf[l-1] = '\0';
 

ready patch attempt

patch

redis-check-rdb likely remains stuck in a busy-poll loop. A diagnosis report and patch proposal were created locally.

state: readycreated: 2026-05-13 01:48 UTCvalidation: ready
Published session

Prompt

## Plan Pass

You are planning a fixer patch before any edits happen.

Read the evidence bundle at `./evidence.json`. The prepared workspace is `./workspace` and it was acquired via `debian-source`. The original pre-edit snapshot is available at `./source` if you need to inspect it. For interpreter processes, plan from the script/application entrypoint evidence first and include the runtime only as a second investigation target unless the evidence proves a runtime bug.

Validation expectation: try the project-level build/test entrypoint from the workspace root before reporting only a focused leaf compile. Detected candidate(s): `make` and, if available, `make check`. If the project-level command fails because dependencies or generated files are missing, include the exact command and failure reason in `## Validation`, then run the narrowest relevant compile/test that is still reproducible from a clean checkout.

Upstream-style expectation: before planning or editing, check for contribution/style docs (`CONTRIBUTING`, `HACKING`, `README-hacking`, `README.md`, `docs/`, `dev-docs/`) and scan the touched subsystem for local helpers. If the project has wrappers for file IO, path-relative IO, process spawning, memory allocation, logging, locking, or platform compatibility, prefer those wrappers over generic libc/std APIs. Do not invent a reproducer or user-visible failure that is not in the evidence bundle; if the evidence is profiler-only or indirect, describe it as a targeted mitigation or stop with a diagnosis instead of presenting a speculative patch as a confirmed bug fix. In the plan and final validation, name any such helper, convention, or evidence limit you found, or say that no relevant local helper was found. Treat this as a `redis` upstream patch, not just a Debian-local workaround. Inspect the relevant code, nearby callers, project contribution docs, and local helper/compat APIs, but do not edit files in this pass.

Return a short markdown plan with these exact sections:

## Problem
## Evidence Confidence
## Proposed Subject
## Patch Plan
## Risks
## Validation

Classify `## Evidence Confidence` as exactly one of `reproduced`, `observed`, or `inferred`. Use `inferred` only for a no-patch diagnosis/report plan unless you can name the extra evidence you will collect before editing; inferred source patches are blocked by Fixer because they are not pull-request-ready. For `observed` source-patch plans, plan to say in the final `## Issue Connection` that the failure was observed by Fixer and not independently reproduced. The plan must explain how the proposed code change addresses the observed issue evidence, call out any prior Fixer patch that should be improved or replaced, reject awkward control flow such as avoidable `goto` if there is a cleaner bounded alternative, name any local helper APIs or maintainer conventions the patch should follow, and keep the intended maintainer-facing explanation clear enough that someone unfamiliar with the local complaint wording can still follow the fix. In `## Validation`, name the reproducible configure/build/test entrypoint you will try from the workspace root before any focused leaf compile or smoke check, and include one bounded independent reproduction attempt for the collected failure signal when it is safe and cheap. Do not plan to claim `reproduced` unless that reproduction command or test can actually show the failure.

## Patch Pass

You are working on a bounded fixer proposal.

Read the evidence bundle at `./evidence.json`. The prepared workspace is `./workspace` and it was acquired via `debian-source`. Produce the smallest reasonable patch for the target repository, keep the change upstreamable, prefer the clearest control flow available, and do not keep avoidable `goto` when a simpler structure would read better. Before introducing new file, process, allocation, locking, networking, or platform APIs, inspect nearby code and project contribution docs for existing helpers or compatibility wrappers and use those local patterns unless you can explain why they do not fit. Validate from a reproducible workspace-root entrypoint before falling back to focused leaf commands; if a build or test cannot run, report the exact command, the exact blocker, and any narrower check you ran instead. During validation, also try one bounded independent reproduction of the collected failure signal when it is safe and cheap, such as a failing test, smoke command, perf/strace comparison, or before/after runtime check. Only use `reproduced` if that command or test actually reproduced the failure; otherwise keep `observed` and report the reproduction blocker. The final explanation must connect the observed issue evidence to the actual code change, not just paraphrase the diff. Write like a maintainer is going to read the patch mail cold: explain the bug in plain language, define subsystem-specific jargon the first time you need it, and make the causal story obvious. Explicitly classify evidence confidence as `reproduced`, `observed`, or `inferred`: `reproduced` means you reproduced the failure locally; `observed` means Fixer has direct crash/log/trace evidence but you did not independently reproduce it; `inferred` means the source patch is not pull-request-ready, so do not leave a source diff unless you first gather stronger observed/reproduced evidence; otherwise return a no-patch diagnosis/report. For any source-changing `observed` patch, say explicitly in `## Issue Connection` that the failure was observed by Fixer and not independently reproduced. If you introduce non-obvious state translation, index remapping, or backend split logic, add a short source comment that explains the invariant being preserved.

Start by explaining the likely root cause from the collected perf, strace, and /proc evidence. If you cannot land a safe patch, leave a diagnosis that is strong enough for an upstream bug report.

Validation expectation: try the project-level build/test entrypoint from the workspace root before reporting only a focused leaf compile. Detected candidate(s): `make` and, if available, `make check`. If the project-level command fails because dependencies or generated files are missing, include the exact command and failure reason in `## Validation`, then run the narrowest relevant compile/test that is still reproducible from a clean checkout.

Upstream-style expectation: before planning or editing, check for contribution/style docs (`CONTRIBUTING`, `HACKING`, `README-hacking`, `README.md`, `docs/`, `dev-docs/`) and scan the touched subsystem for local helpers. If the project has wrappers for file IO, path-relative IO, process spawning, memory allocation, logging, locking, or platform compatibility, prefer those wrappers over generic libc/std APIs. Do not invent a reproducer or user-visible failure that is not in the evidence bundle; if the evidence is profiler-only or indirect, describe it as a targeted mitigation or stop with a diagnosis instead of presenting a speculative patch as a confirmed bug fix. In the plan and final validation, name any such helper, convention, or evidence limit you found, or say that no relevant local helper was found. Treat this as a `redis` upstream patch, not just a Debian-local workaround. 

Keep the change narrowly scoped and summarize validation clearly.

In every authoring pass, your final response must start with `Subject: <single-line git commit subject>` and then include these markdown sections exactly:

## Commit Message
A short upstream-friendly explanation of what changed and why. Write it in plain language that a maintainer can follow without local complaint context. If you use subsystem jargon, define it immediately.

## Evidence Confidence
Exactly one word: `reproduced`, `observed`, or `inferred`. Use `reproduced` only when you reproduced the failure locally with a command or test, and include that command/test in `## Validation`. Use `observed` when Fixer has direct crash/log/trace evidence but you did not independently reproduce it. If `## Git Add Paths` lists source files for an `observed` patch, `## Issue Connection` must explicitly say the failure was observed by Fixer and not independently reproduced. Use `inferred` for profiler/strace/indirect evidence; inferred responses may be no-patch diagnoses or reports, but inferred source patches are not pull-request-ready until stronger evidence is gathered.

## Issue Connection
Write this as maintainer-facing patch mail, not as local Fixer notes. Cover four things explicitly in readable sentences: the user-visible symptom or the exact collected signal, the code-level cause or the cautious inference from evidence, the specific change you made, and the expected effect. Do not invent a reproducer, command line, crash, or user-visible failure that is not present in the evidence bundle. If the evidence is direct-but-not-reproduced, say it was observed by Fixer and not independently reproduced. If the evidence is indirect and you did not gather stronger evidence, do not leave a source diff; write a no-patch diagnosis/report instead. Include an explicit effect sentence such as `The expected effect is ...`, `This should reduce ...`, or `This prevents ...` for source patches. If the logic is non-obvious in code, mention that you added a short explanatory comment.

## Git Add Paths
List the repo-relative paths that belong in the final patch, one per line. Use `None` only when you intentionally made no source changes. Include intentionally new files, and do not list generated build artifacts.

## Validation
List the checks you ran, or say clearly that you could not run them. Include the independent reproduction command/test and result when `## Evidence Confidence` is `reproduced`; if reproduction was attempted but blocked, name the exact blocker and keep confidence at `observed` or `inferred`.

Before editing, read the plan at `./plan-output.txt` and follow it unless the code proves part of it wrong. If you change course, say so explicitly in the final write-up instead of silently drifting from the plan.

## Review Pass 1

You are reviewing a freshly generated fixer patch.

Read the evidence bundle at `./evidence.json`. The prepared workspace is `./workspace` and it was acquired via `debian-source`. Review the first patch pass. The original pre-edit snapshot is available at `./source` for diffing. The workspace currently changes these repo-relative paths: src/zmalloc.c. Verify that `## Git Add Paths` matches this exact set and that `## Issue Connection` explains every shipped functional file.

Upstream-style expectation: before planning or editing, check for contribution/style docs (`CONTRIBUTING`, `HACKING`, `README-hacking`, `README.md`, `docs/`, `dev-docs/`) and scan the touched subsystem for local helpers. If the project has wrappers for file IO, path-relative IO, process spawning, memory allocation, logging, locking, or platform compatibility, prefer those wrappers over generic libc/std APIs. Do not invent a reproducer or user-visible failure that is not in the evidence bundle; if the evidence is profiler-only or indirect, describe it as a targeted mitigation or stop with a diagnosis instead of presenting a speculative patch as a confirmed bug fix. In the plan and final validation, name any such helper, convention, or evidence limit you found, or say that no relevant local helper was found. Treat this as a `redis` upstream patch, not just a Debian-local workaround.

Validation expectation: try the project-level build/test entrypoint from the workspace root before reporting only a focused leaf compile. Detected candidate(s): `make` and, if available, `make check`. If the project-level command fails because dependencies or generated files are missing, include the exact command and failure reason in `## Validation`, then run the narrowest relevant compile/test that is still reproducible from a clean checkout. The latest author response is at `./patch-output.txt`. Inspect the current code and changed paths like a strict code reviewer. Focus on correctness, regressions, maintainability, awkward control flow such as avoidable `goto`, missing validation, weak or non-gittable commit message text, and explanations that fail to connect the observed issue evidence to the code change. Also review the maintainer experience: the patch mail should be easy to accept upstream, the user-visible bug should be explained in plain language, subsystem-specific jargon should be defined when first used, and any non-obvious state translation or index remapping in code should have a short explanatory comment. Reject patches that omit `## Evidence Confidence`, use anything other than `reproduced`, `observed`, or `inferred`, or sound more certain than that evidence level allows. Reject patches that claim `reproduced` unless `## Validation` names the concrete reproduction command or test and its result. Reject patches that invent a reproducer, command line, crash, or user-visible failure not present in the evidence bundle; indirect profiler or strace evidence may justify a cautious mitigation, but the author must say it is indirect instead of presenting it as a confirmed upstream bug. Reject patches that introduce generic libc/std APIs when nearby code or project docs provide a local compat/helper API for the same job, unless the author explicitly justifies the exception. Reject validation that only reports a leaf object/syntax build when a project-level configure/build/test entrypoint exists and was not attempted; if a full build cannot run, the author must show the exact failed command and blocker.

Do not apply code changes in this pass.

Return a short markdown review report. The first non-empty line must be exactly one of:

RESULT: ok
RESULT: fix-needed

If you choose `RESULT: fix-needed`, add a `## Findings` section with concrete, actionable items.

Response

## Plan Pass

## Problem
Fixer observed an idle Redis process repeatedly waking from `epoll_wait` and reading `/proc/self/stat` about every 100 ms via `zmalloc_get_rss()` from `serverCron()`/`cronUpdateMemoryStats()`. The evidence is profiler/strace-based, not a user-visible crash. The code already documents `zmalloc_get_rss()` as relatively slow, so the patch should reduce the observed procfs syscall churn without changing Redis’ stats cadence.

## Evidence Confidence
observed

## Proposed Subject
`zmalloc: reuse proc stat fd for Linux RSS sampling`

## Patch Plan
Patch `src/zmalloc.c` only. Improve the existing Linux `get_proc_stat_ll()` helper to keep a cached `/proc/self/stat` fd and read it with `pread(..., 0)` instead of opening and closing the proc file on every 100 ms RSS sample.

Follow local conventions found in the subsystem: keep the logic inside `get_proc_stat_ll()`, preserve its `0/1` return contract, use existing libc-style procfs code already present there, and avoid changing `serverCron()`’s `run_with_period(100)` behavior. Use `O_CLOEXEC` as other Redis code does for persistent fds. No relevant Redis wrapper exists specifically for procfs reads; `anetCloexec()` exists for portability, but this Linux-only block already uses direct `open/read/close`.

Handle fork safety by tracking `getpid()` alongside the cached fd. If the pid changes, close and reopen so a child process does not accidentally read the parent’s proc stat fd. Avoid awkward `goto`; use a small bounded retry path for reopen/read failure.

There is no prior Fixer patch in the workspace (`git diff` is empty), so this should be a fresh upstream-style patch rather than replacing earlier edits.

## Risks
Caching procfs fds can be wrong after fork unless pid changes are handled. `pread()` support on `/proc/self/stat` must be verified; if it fails, the helper should fall back cleanly or reopen once. The evidence names `redis-check-rdb` as the artifact path but the sampled command/thread names are `redis-server`, so the maintainer explanation should describe the procfs RSS sampling path rather than claim a redis-check-rdb-specific bug.

## Validation
From the workspace root, first try the project entrypoints: `make`, then `make check` if build succeeds. If either fails because of missing deps/generated files, report the exact command and failure reason, then run the narrowest reproducible check such as `make -C src zmalloc.o` or `make -C src redis-server`.

Bounded independent signal check: run a locally built idle server under `strace` for a few seconds, e.g. `timeout 3s strace -ff -e trace=openat,read,close,epoll_wait src/redis-server --save "" --appendonly no --port 0`, and compare `/proc/self/stat` `openat` frequency before/after. The expected result after the patch is that repeated RSS samples no longer reopen `/proc/self/stat` every cycle while Redis still starts and reports memory info normally.

## Patch Pass

Subject: zmalloc: reuse proc stat fd for Linux RSS sampling

## Commit Message
Redis samples resident set size (RSS, the process memory resident in RAM) from `serverCron()` every 100 ms. On Linux that goes through `get_proc_stat_ll()`, which reopened `/proc/self/stat` for every sample.

Keep a cached `/proc/self/stat` descriptor and read it with `pread()`. Track the pid that opened the descriptor so forked children reopen it for their own `/proc/self/stat`. This keeps the existing sampling cadence and parsing logic, but avoids repeated open/close work in the idle cron path.

## Evidence Confidence
observed

## Issue Connection
Fixer observed a Redis process with repeated `epoll_wait`, `openat`, and `read` activity, where the proc evidence showed periodic reads of `/proc/self/stat`. This was observed by Fixer and not independently reproduced locally because ptrace-based tracing is blocked in this sandbox.

The cautious code-level cause is Redis’ Linux RSS sampling path: `serverCron()` calls `cronUpdateMemoryStats()` under the existing `run_with_period(100)` convention, and `zmalloc_get_rss()` reads field 24 through `get_proc_stat_ll()`. Before this patch, every sample opened, read, and closed `/proc/self/stat`.

The change keeps the existing helper and return contract, uses Redis’ existing direct Linux procfs style with `O_CLOEXEC`, and adds a short comment for the fork invariant: the cached descriptor must be reopened if `getpid()` changes. No relevant local procfs file-IO wrapper was found; `anetCloexec()` exists for networking fds, but this block already uses direct libc procfs APIs.

The expected effect is to reduce repeated procfs open/close churn during idle memory sampling while preserving the same RSS value parsing and cron frequency.

## Git Add Paths
src/zmalloc.c

## Validation
`make` from the workspace root: passed. It rebuilt Redis, including `src/zmalloc.o`, `redis-server`, `redis-cli`, `redis-benchmark`, `redis-check-rdb`, `redis-check-aof`, and test modules.

`make check` from the workspace root: failed before tests ran because the test harness could not allocate ports: `Can't find a non busy port in the 21079-21110 range.`

`git diff --check`: passed.

Independent reproduction attempt: `timeout 4s strace -f -e trace=openat,pread64,read,close,epoll_wait ...` was blocked by sandbox ptrace restrictions: `PTRACE_TRACEME: Operation not permitted` and `ptrace(PTRACE_SEIZE, 5): Operation not permitted`. A Unix-socket Redis smoke attempt was also blocked by the sandbox with `setsockopt SO_REUSEADDR: Operation not permitted`, so the collected trace signal was not independently reproduced.

## Review Pass 1

RESULT: ok

The patch is narrowly scoped to `src/zmalloc.c`, and `## Git Add Paths` matches the current changed path exactly. The issue connection explains the shipped file’s functional change and stays appropriately cautious for `observed` evidence.

Validation is acceptable for this pass: root `make` passed, root `make check` was attempted and failed with the exact port-range blocker, and the independent trace reproduction was attempted but blocked by ptrace restrictions. The code follows the existing direct Linux procfs style in `zmalloc.c`; no relevant local procfs wrapper was found.

Diff

diff --git a/src/zmalloc.c b/src/zmalloc.c
index 7d9fe6e..fddb7c6 100644
--- a/src/zmalloc.c
+++ b/src/zmalloc.c
@@ -642,15 +642,35 @@ void zmadvise_dontneed(void *ptr) {
 int get_proc_stat_ll(int i, long long *res) {
 #if defined(HAVE_PROC_STAT)
     char buf[4096];
-    int fd, l;
+    static int proc_stat_fd = -1;
+    static pid_t proc_stat_pid = -1;
+    ssize_t l = -1;
+    pid_t pid = getpid();
     char *p, *x;
 
-    if ((fd = open("/proc/self/stat",O_RDONLY)) == -1) return 0;
-    if ((l = read(fd,buf,sizeof(buf)-1)) <= 0) {
-        close(fd);
-        return 0;
+    /* The cached fd belongs to the process that opened it. After fork(),
+     * reopen it so /proc/self/stat keeps referring to the current process. */
+    if (proc_stat_fd != -1 && proc_stat_pid != pid) {
+        close(proc_stat_fd);
+        proc_stat_fd = -1;
+        proc_stat_pid = -1;
     }
-    close(fd);
+
+    for (int attempts = 0; attempts < 2; attempts++) {
+        if (proc_stat_fd == -1) {
+            proc_stat_fd = open("/proc/self/stat",O_RDONLY|O_CLOEXEC);
+            if (proc_stat_fd == -1) return 0;
+            proc_stat_pid = pid;
+        }
+
+        l = pread(proc_stat_fd,buf,sizeof(buf)-1,0);
+        if (l > 0) break;
+
+        close(proc_stat_fd);
+        proc_stat_fd = -1;
+        proc_stat_pid = -1;
+    }
+    if (l <= 0) return 0;
     buf[l] = '\0';
     if (buf[l-1] == '\n') buf[l-1] = '\0';