View Issue Details

Jump to NotesJump to History
IDProjectCategoryView StatusDate SubmittedLast Update
0001802GNUnettransport servicepublic2011-09-28 19:532011-10-31 12:00
Reporterviric Assigned ToChristian Grothoff  
PrioritynormalSeveritycrashReproducibilityrandom
Status closedResolutionfixed 
Platformx86_64OSNixOS LinuxOS VersionLinux 2.6.38.8
Summary0001802: Crash on transport, assertion failed, rev 17066
DescriptionCrash
Steps To ReproduceRun the daemon for a while
Additional InformationProgram received signal SIGSEGV, Segmentation fault.
0x00007f552d015157 in GNUNET_SERVER_client_drop (client=0x0) at server.c:1014
1014 GNUNET_assert (client->reference_count > 0);
(gdb) list
1009 * @param client the client to drop
1010 */
1011 void
1012 GNUNET_SERVER_client_drop (struct GNUNET_SERVER_Client *client)
1013 {
1014 GNUNET_assert (client->reference_count > 0);
1015 client->reference_count--;
1016 if ((client->shutdown_now == GNUNET_YES) && (client->reference_count == 0))
1017 GNUNET_SERVER_client_disconnect (client);
1018 }
(gdb) print client->reference_count
Cannot access memory at address 0x58
(gdb) print client
$1 = (struct GNUNET_SERVER_Client *) 0x0
(gdb) up
#1 0x0000000000405dc6 in handle_send_transmit_continuation (cls=0xb79d30, success=-1)
    at gnunet-service-transport_clients.c:460
460 GNUNET_SERVER_client_drop (stcc->client);
(gdb) print stcc
$2 = (struct SendTransmitContinuationContext *) 0xb79d30
(gdb) print *stcc
$5 = {client = 0x0, target = {hashPubKey = {bits = {3625064777, 3321110709, 4241451958,
        629011105, 1554132050, 2399794204, 2928505824, 742275393, 1762906625, 833379153,
        3924024509, 1043661827, 3920283494, 2804200368, 15297581, 4140573106}}}}
(gdb) bt
#0 0x00007f552d015157 in GNUNET_SERVER_client_drop (client=0x0) at server.c:1014
#1 0x0000000000405dc6 in handle_send_transmit_continuation (cls=0xb79d30, success=-1)
    at gnunet-service-transport_clients.c:460
#2 0x0000000000407037 in transmit_send_continuation (cls=0xb791e0, receiver=0xb798b8,
    success=-1) at gnunet-service-transport_neighbours.c:341
#3 0x00000000004070c7 in try_transmission_to_peer (n=0xb79870)
    at gnunet-service-transport_neighbours.c:370
#4 0x00000000004073e0 in transmission_task (cls=0xb79870, tc=0x7fffc1130550)
    at gnunet-service-transport_neighbours.c:421
#5 0x00007f552d012a64 in run_ready (rs=0xb6ae90, ws=0xb6af20) at scheduler.c:682
#6 0x00007f552d012f60 in GNUNET_SCHEDULER_run (task=0x7f552d019d34 <service_task>,
#7 0x00007f552d01acf8 in GNUNET_SERVICE_run (argc=7, argv=0x7fffc1130a38,
    serviceName=0x40b1f7 "transport", opt=GNUNET_SERVICE_OPTION_NONE, task=0x4036b7 <run>,
    task_cls=0x0) at service.c:1591
#8 0x00000000004038dd in main (argc=7, argv=0x7fffc1130a38) at gnunet-service-transport.c:498

TagsNo tags attached.

Activities

Christian Grothoff

2011-09-29 01:05

manager   ~0004643

This looks odd:

  mq = n->messages_head;
  while (NULL != (mq = n->messages_head))
  {
    timeout = GNUNET_TIME_absolute_get_remaining (mq->timeout);
    if (timeout.rel_value > 0)
      break;
    transmit_send_continuation (mq, &n->id, GNUNET_SYSERR); /* timeout */
  }

and then in transmit_send_continuation:


static void
transmit_send_continuation (void *cls,
                            const struct GNUNET_PeerIdentity *receiver,
                            int success)
{
  struct MessageQueue *mq;
  struct NeighbourMapEntry *n;

  mq = cls;
  n = mq->n;
  if (NULL != n)
  {
    GNUNET_assert (n->is_active == mq);
    n->is_active = NULL;
    GNUNET_assert (n->transmission_task == GNUNET_SCHEDULER_NO_TASK);
    n->transmission_task = GNUNET_SCHEDULER_add_now (&transmission_task, n);
  }
  if (NULL != mq->cont)
    mq->cont (mq->cont_cls, success);
  GNUNET_free (mq);
}

Note that I don't see the code EVERY removing mq from the DLL, so this looks like a use-after-free.

Christian Grothoff

2011-09-29 01:07

manager   ~0004644

Yeah, this virtually HAS to be it. Rare bug since it ONLY applies during timeout, and on all other paths mq *is* removed. Fixed in SVN 17097.

Issue History

Date Modified Username Field Change
2011-09-28 19:53 viric New Issue
2011-09-28 19:53 viric Status new => assigned
2011-09-28 19:53 viric Assigned To => Matthias Wachs
2011-09-29 01:05 Christian Grothoff Note Added: 0004643
2011-09-29 01:07 Christian Grothoff Note Added: 0004644
2011-09-29 01:07 Christian Grothoff Status assigned => resolved
2011-09-29 01:07 Christian Grothoff Resolution open => fixed
2011-09-29 01:07 Christian Grothoff Assigned To Matthias Wachs => Christian Grothoff
2011-09-29 01:07 Christian Grothoff Product Version Git master => 0.9.0pre3
2011-09-29 01:07 Christian Grothoff Target Version => 0.9.0pre4
2011-10-31 12:00 Christian Grothoff Status resolved => closed