View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0001714 | GNUnet | transport service | public | 2011-06-17 14:36 | 2011-07-18 11:34 |
| Reporter | mrwiggles | Assigned To | Christian Grothoff | Due Date | |
| Priority | urgent | Severity | crash | Reproducibility | random |
| Status | closed | Resolution | fixed | ||
| Product Version | Git master | ||||
| Summary | 0001714: transport service crash: use after free in plugin_transport_tcp.c:923 | ||||
| Description | Seems associated with rash of disconnect events. ==9465== Invalid read of size 4 ==9465== at 0x4394EA0: do_transmit (plugin_transport_tcp.c:923) ==9465== by 0x4041FA7: destroy_continuation (connection.c:580) ==9465== by 0x405A778: GNUNET_SCHEDULER_run (scheduler.c:648) ==9465== by 0x4060B08: GNUNET_SERVICE_run (service.c:1622) ==9465== by 0x804A024: main (gnunet-service-transport.c:7612) ==9465== Address 0x47BC1FC is 268 bytes inside a block of size 388 free'd ==9465== at 0x402213F: free (vg_replace_malloc.c:233) ==9465== by 0x403D4F0: GNUNET_xfree_ (common_allocation.c:196) ==9465== by 0x4393EC8: disconnect_session (plugin_transport_tcp.c:1150) ==9465== by 0x405AC1C: GNUNET_SERVER_client_disconnect (server.c:1127) ==9465== by 0x405B13F: process_incoming (server.c:820) ==9465== by 0x40408BF: signal_timeout (connection.c:1097) ==9465== by 0x4041A56: receive_ready (connection.c:1155) ==9465== by 0x405A778: GNUNET_SCHEDULER_run (scheduler.c:648) ==9465== by 0x4060B08: GNUNET_SERVICE_run (service.c:1622) ==9465== by 0x804A024: main (gnunet-service-transport.c:7612) | ||||
| Tags | No tags attached. | ||||
| SVN Head. ==32258== Invalid read of size 4 ==32258== at 0x4395184: do_transmit (plugin_transport_tcp.c:957) ==32258== by 0x4042097: destroy_continuation (connection.c:580) ==32258== by 0x405A868: GNUNET_SCHEDULER_run (scheduler.c:648) ==32258== by 0x4060E58: GNUNET_SERVICE_run (service.c:1622) ==32258== by 0x804A024: main (gnunet-service-transport.c:7660) ==32258== Address 0x56F20CC is 324 bytes inside a block of size 388 free'd ==32258== at 0x402213F: free (vg_replace_malloc.c:233) ==32258== by 0x403D4F0: GNUNET_xfree_ (common_allocation.c:196) ==32258== by 0x4393EC8: disconnect_session (plugin_transport_tcp.c:1150) ==32258== by 0x405AD0C: GNUNET_SERVER_client_disconnect (server.c:1127) ==32258== by 0x405B22F: process_incoming (server.c:820) ==32258== by 0x4041C51: receive_ready (connection.c:1192) ==32258== by 0x405A868: GNUNET_SCHEDULER_run (scheduler.c:648) ==32258== by 0x4060E58: GNUNET_SERVICE_run (service.c:1622) ==32258== by 0x804A024: main (gnunet-service-transport.c:7660) ==32258== ==32258== Invalid read of size 4 ==32258== at 0x439518D: do_transmit (plugin_transport_tcp.c:957) ==32258== by 0x4042097: destroy_continuation (connection.c:580) ==32258== by 0x405A868: GNUNET_SCHEDULER_run (scheduler.c:648) ==32258== by 0x4060E58: GNUNET_SERVICE_run (service.c:1622) ==32258== by 0x804A024: main (gnunet-service-transport.c:7660) ==32258== Address 0x56F20D0 is 328 bytes inside a block of size 388 free'd ==32258== at 0x402213F: free (vg_replace_malloc.c:233) ==32258== by 0x403D4F0: GNUNET_xfree_ (common_allocation.c:196) ==32258== by 0x4393EC8: disconnect_session (plugin_transport_tcp.c:1150) ==32258== by 0x405AD0C: GNUNET_SERVER_client_disconnect (server.c:1127) ==32258== by 0x405B22F: process_incoming (server.c:820) ==32258== by 0x4041C51: receive_ready (connection.c:1192) ==32258== by 0x405A868: GNUNET_SCHEDULER_run (scheduler.c:648) ==32258== by 0x4060E58: GNUNET_SERVICE_run (service.c:1622) ==32258== by 0x804A024: main (gnunet-service-transport.c:7660) | |
| Jun 20 14:44:53-776175 transport-9903 ERROR Assertion failed at connection.c:1504. | |
| Jun 20 14:46:23-153885 transport-15397 ERROR Assertion failed at connection.c:1504. Jun 20 14:46:50-230241 transport-15961 ERROR Assertion failed at plugin_transport_tcp.c:1344. | |
| Cannot reproduce... added assertion to find bug Please specify: - exact revision - how to reproduce Add coredump.. | |
| With regards to the valgrind use-after-free in 0004442, here is how I think it happens: The call to 'transmit_cont' in 'disconnect_session' leads to 'transmit_send_continuation' which can call 'try_transmission_to_peer' which in turn can call 'tcp_plugin_send' which can again add the 'transmit_handle' that we just cleaned up a few lines above in 'disconnect_session'. I'm adding an assertion that 'transmit_handle' is NULL just before freeing 'session' in SVN 15821. NOTE: this does not fix the bug, we need to think about how the disconnect sequence is supposed to work some more! Also, I don't know why the 'GNUNET_SERVER_client_drop' was only executed if we did NOT have a 'receive_delay_task' (removing the respective 'else') in 'disconnect_session'. | |
| Fixed in SVN 15824 by (a) only immediately going for 'try_transmission_to_peer' if the previous transmission was successful, and (b) using a separate task to go for the next transmission in case of error -- which will then enable the 'end_session' callback to clean up the session handle first. | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2011-06-17 14:36 | mrwiggles | New Issue | |
| 2011-06-17 14:36 | mrwiggles | Status | new => assigned |
| 2011-06-17 14:36 | mrwiggles | Assigned To | => Matthias Wachs |
| 2011-06-20 14:08 | mrwiggles | Note Added: 0004442 | |
| 2011-06-20 14:49 | mrwiggles | Note Added: 0004445 | |
| 2011-06-20 14:49 | mrwiggles | Note Added: 0004446 | |
| 2011-06-23 10:31 | Christian Grothoff | Priority | normal => urgent |
| 2011-06-23 10:40 | Christian Grothoff | Summary | transport service crash => transport service crash: use after free in plugin_transport_tcp.c:923 |
| 2011-06-28 13:24 | Matthias Wachs | Note Added: 0004470 | |
| 2011-06-28 13:24 | Matthias Wachs | Status | assigned => closed |
| 2011-06-28 13:24 | Matthias Wachs | Resolution | open => unable to reproduce |
| 2011-06-28 13:25 | Matthias Wachs | Status | closed => feedback |
| 2011-06-28 13:25 | Matthias Wachs | Resolution | unable to reproduce => reopened |
| 2011-07-02 17:50 | Christian Grothoff | Note Added: 0004471 | |
| 2011-07-02 18:18 | Christian Grothoff | Assigned To | Matthias Wachs => Christian Grothoff |
| 2011-07-02 18:18 | Christian Grothoff | Status | feedback => assigned |
| 2011-07-02 21:01 | Christian Grothoff | Note Added: 0004472 | |
| 2011-07-02 21:01 | Christian Grothoff | Status | assigned => resolved |
| 2011-07-02 21:01 | Christian Grothoff | Resolution | reopened => fixed |
| 2011-07-18 11:34 | Christian Grothoff | Status | resolved => closed |