View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001564 | GNUnet | transport service | public | 2010-05-31 14:07 | 2010-07-03 20:55 |
| Reporter | Christian Grothoff | Assigned To | Christian Grothoff | ||
| Priority | normal | Severity | crash | Reproducibility | random |
| Status | closed | Resolution | fixed | ||
| Summary | 0001564: double free reported by libc in gnunet-service-transport | ||||
| Description | Core was generated by `/home/grothoff/svn/gnunet/src/transport/.libs/lt-gnunet-service-transport -c /h'. Program terminated with signal 6, Aborted. #0 0x4001d422 in __kernel_vsyscall () (gdb) ba #0 0x4001d422 in __kernel_vsyscall () #1 0x400b7651 in raise () from /lib/tls/i686/cmov/libc.so.6 #2 0x400baa82 in abort () from /lib/tls/i686/cmov/libc.so.6 #3 0x400ee49d in __fsetlocking () from /lib/tls/i686/cmov/libc.so.6 #4 0x400f8591 in malloc_usable_size () from /lib/tls/i686/cmov/libc.so.6 #5 0x400f9de8 in malloc_set_state () from /lib/tls/i686/cmov/libc.so.6 #6 0x400fcecd in free () from /lib/tls/i686/cmov/libc.so.6 #7 0x40037d81 in GNUNET_xfree_ (ptr=0x8e70778, filename=0x80532a3 "gnunet-service-transport.c", linenumber=3780) at common_allocation.c:158 #8 0x08050312 in check_hello_validated (cls=0x8e70778, peer=0x0, h=0x0, trust=1) at gnunet-service-transport.c:3780 #9 0x40021967 in signal_timeout (cls=0x8e70908, tc=0xbf8eb6f8) at peerinfo_api.c:539 #10 0x40055ba1 in run_ready (sched=0xbf8eb75c) at scheduler.c:559 #11 0x4005603d in GNUNET_SCHEDULER_run (task=0x4005b6b7 <service_task>, task_cls=0xbf8eb8e4) at scheduler.c:687 #12 0x4005c610 in GNUNET_SERVICE_run (argc=5, argv=0xbf8eba54, serviceName=0x805471f "transport", opt=GNUNET_SERVICE_OPTION_NONE, task=0x8052ceb <run>, task_cls=0x0) at service.c:1404 #13 0x08053168 in main (argc=5, argv=0xbf8eba54) at gnunet-service-transport.c:5040 | ||||
| Tags | No tags attached. | ||||
|
|
- indeterministic - happens only on fast machines/during fast execution (could not reproduce it during debugging) - Inspected all free-operations on affected memory address: address was not freed by gnunet transport service before (afaik) - Disabling free call check_hello_validated:GNUNET_free(chvc) (line 3780) causing the segfault does not solve the problem: Result: segfault invalid next size |
|
|
Fixed in SVN 11596. If RC 've_count' went to 0 before final call to 'check_hello_validated', object was already freed and would be double-freed. Solution is simple: set RC to 1 earlier and thereby across calls. |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2010-05-31 14:07 | Christian Grothoff | New Issue | |
| 2010-05-31 14:07 | Christian Grothoff | Status | new => assigned |
| 2010-05-31 14:07 | Christian Grothoff | Assigned To | => Matthias Wachs |
| 2010-05-31 14:07 | Christian Grothoff | Assigned To | Matthias Wachs => |
| 2010-05-31 14:07 | Christian Grothoff | Status | assigned => acknowledged |
| 2010-06-01 11:29 | Matthias Wachs | Note Added: 0004027 | |
| 2010-06-01 11:29 | Matthias Wachs | Reproducibility | have not tried => random |
| 2010-06-01 14:39 | Matthias Wachs | Note Edited: 0004027 | |
| 2010-06-01 22:04 | Christian Grothoff | Note Added: 0004028 | |
| 2010-06-01 22:04 | Christian Grothoff | Status | acknowledged => resolved |
| 2010-06-01 22:04 | Christian Grothoff | Resolution | open => fixed |
| 2010-06-01 22:04 | Christian Grothoff | Assigned To | => Christian Grothoff |
| 2010-07-03 20:55 | Christian Grothoff | Status | resolved => closed |
