Bug 1325462
Summary: | [abrt] systemd: strv_clear(): networkctl killed by SIGABRT | ||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Alan Ernhart <alan.ernhart> | ||||||||||||||||||||||||||
Component: | systemd | Assignee: | systemd-maint | ||||||||||||||||||||||||||
Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||||||||||||||||||||
Severity: | unspecified | Docs Contact: | |||||||||||||||||||||||||||
Priority: | unspecified | ||||||||||||||||||||||||||||
Version: | 24 | CC: | johannbg, lnykryn, msekleta, muadda, s, systemd-maint, zbyszek | ||||||||||||||||||||||||||
Target Milestone: | --- | ||||||||||||||||||||||||||||
Target Release: | --- | ||||||||||||||||||||||||||||
Hardware: | x86_64 | ||||||||||||||||||||||||||||
OS: | Unspecified | ||||||||||||||||||||||||||||
URL: | https://retrace.fedoraproject.org/faf/reports/bthash/0fe94a3af5784d40607f3713d841ff30c853d6b8 | ||||||||||||||||||||||||||||
Whiteboard: | abrt_hash:c55a260607e335588d52f472f526a37c302a7915;VARIANT_ID=workstation; | ||||||||||||||||||||||||||||
Fixed In Version: | systemd-229-9.fc24 | Doc Type: | Bug Fix | ||||||||||||||||||||||||||
Doc Text: | Story Points: | --- | |||||||||||||||||||||||||||
Clone Of: | Environment: | ||||||||||||||||||||||||||||
Last Closed: | 2016-07-23 18:49:11 UTC | Type: | --- | ||||||||||||||||||||||||||
Regression: | --- | Mount Type: | --- | ||||||||||||||||||||||||||
Documentation: | --- | CRM: | |||||||||||||||||||||||||||
Verified Versions: | Category: | --- | |||||||||||||||||||||||||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||||||||||||||||||
Cloudforms Team: | --- | Target Upstream Version: | |||||||||||||||||||||||||||
Embargoed: | |||||||||||||||||||||||||||||
Attachments: |
|
Description
Alan Ernhart
2016-04-08 21:54:34 UTC
Created attachment 1145282 [details]
File: backtrace
Created attachment 1145283 [details]
File: cgroup
Created attachment 1145284 [details]
File: core_backtrace
Created attachment 1145285 [details]
File: dso_list
Created attachment 1145286 [details]
File: environ
Created attachment 1145287 [details]
File: limits
Created attachment 1145288 [details]
File: maps
Created attachment 1145289 [details]
File: mountinfo
Created attachment 1145290 [details]
File: namespaces
Created attachment 1145291 [details]
File: open_fds
Created attachment 1145292 [details]
File: proc_pid_status
Created attachment 1145293 [details]
File: var_log_messages
Is this repeatable? Any chance you could run it under valgrind and paste the output here ("valgrind networkctl <args>"). Gladly, Thanks, and sorry about the lag here. It's very repeatable (after reboot also, fwiw), and two quick extra datapoints: The following succeed: $ networkctl list $ networkctl lldp Here's valgrind: $ valgrind networkctl status ==4521== Memcheck, a memory error detector ==4521== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==4521== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info ==4521== Command: networkctl status ==4521== ● State: n/a Address: 10.43.104.74 on wlp3s0 192.168.124.1 on virbr0 fe80::e7ca:1de2:db3c:6ff0 on wlp3s0 Gateway: 10.128.128.128 on wlp3s0 ==4521== Conditional jump or move depends on uninitialised value(s) ==4521== at 0x11FE19: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Use of uninitialised value of size 8 ==4521== at 0x11FE1B: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Conditional jump or move depends on uninitialised value(s) ==4521== at 0x11DBD3: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE2C: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Use of uninitialised value of size 8 ==4521== at 0x11DBE3: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE2C: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== Route Domains: help ==4521== Conditional jump or move depends on uninitialised value(s) ==4521== at 0x11DC39: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE2C: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Use of uninitialised value of size 8 ==4521== at 0x11DC00: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE2C: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Conditional jump or move depends on uninitialised value(s) ==4521== at 0x11FE5F: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Conditional jump or move depends on uninitialised value(s) ==4521== at 0x11596C: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE65: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Use of uninitialised value of size 8 ==4521== at 0x11596E: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE65: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Invalid free() / delete / delete[] / realloc() ==4521== at 0x4C2CD5A: free (vg_replace_malloc.c:530) ==4521== by 0x115988: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE65: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== Address 0x122502 is in a r-x mapped file /usr/bin/networkctl segment ==4521== ==4521== Use of uninitialised value of size 8 ==4521== at 0x115989: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE65: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Conditional jump or move depends on uninitialised value(s) ==4521== at 0x4C2CD0D: free (vg_replace_malloc.c:530) ==4521== by 0x115998: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE65: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== ==4521== Invalid free() / delete / delete[] / realloc() ==4521== at 0x4C2CD5A: free (vg_replace_malloc.c:530) ==4521== by 0x115998: ??? (in /usr/bin/networkctl) ==4521== by 0x11FE65: ??? (in /usr/bin/networkctl) ==4521== by 0x10CCB4: ??? (in /usr/bin/networkctl) ==4521== by 0x5493720: (below main) (in /usr/lib64/libc-2.23.so) ==4521== Address 0x1ac7c0 is in a r-- mapped file /usr/bin/networkctl segment ==4521== ==4521== ==4521== HEAP SUMMARY: ==4521== in use at exit: 0 bytes in 0 blocks ==4521== total heap usage: 153 allocs, 155 frees, 60,252 bytes allocated ==4521== ==4521== All heap blocks were freed -- no leaks are possible ==4521== ==4521== For counts of detected and suppressed errors, rerun with: -v ==4521== Use --track-origins=yes to see where uninitialised values come from ==4521== ERROR SUMMARY: 13 errors from 13 contexts (suppressed: 0 from 0) alan@localhost: ~ $ Can you retry with debuginfo packages installed ("sudo dnf debuginfo-install systemd")? The output will be much more useful then. <smiley> Here it is: ==2392== Memcheck, a memory error detector ==2392== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al. ==2392== Using Valgrind-3.11.0 and LibVEX; rerun with -h for copyright info ==2392== Command: networkctl status ==2392== ==2392== Conditional jump or move depends on uninitialised value(s) ==2392== at 0x11FE19: UnknownInlinedFun (strv.h:76) ==2392== by 0x11FE19: UnknownInlinedFun (networkctl.c:491) ==2392== by 0x11FE19: link_status.lto_priv.140 (networkctl.c:699) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Use of uninitialised value of size 8 ==2392== at 0x11FE1B: UnknownInlinedFun (strv.h:76) ==2392== by 0x11FE1B: UnknownInlinedFun (networkctl.c:491) ==2392== by 0x11FE1B: link_status.lto_priv.140 (networkctl.c:699) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Conditional jump or move depends on uninitialised value(s) ==2392== at 0x11DBD3: dump_list.part.5.lto_priv.152 (networkctl.c:494) ==2392== by 0x11FE2C: UnknownInlinedFun (strv.h:76) ==2392== by 0x11FE2C: link_status.lto_priv.140 (networkctl.c:699) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Use of uninitialised value of size 8 ==2392== at 0x11DBE3: dump_list.part.5.lto_priv.152 (networkctl.c:494) ==2392== by 0x11FE2C: UnknownInlinedFun (strv.h:76) ==2392== by 0x11FE2C: link_status.lto_priv.140 (networkctl.c:699) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Conditional jump or move depends on uninitialised value(s) ==2392== at 0x11DC39: dump_list.part.5.lto_priv.152 (networkctl.c:494) ==2392== by 0x11FE2C: UnknownInlinedFun (strv.h:76) ==2392== by 0x11FE2C: link_status.lto_priv.140 (networkctl.c:699) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Use of uninitialised value of size 8 ==2392== at 0x11DC00: dump_list.part.5.lto_priv.152 (networkctl.c:494) ==2392== by 0x11FE2C: UnknownInlinedFun (strv.h:76) ==2392== by 0x11FE2C: link_status.lto_priv.140 (networkctl.c:699) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Conditional jump or move depends on uninitialised value(s) ==2392== at 0x11FE5F: UnknownInlinedFun (strv.h:37) ==2392== by 0x11FE5F: link_status.lto_priv.140 (networkctl.c:679) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Conditional jump or move depends on uninitialised value(s) ==2392== at 0x11596C: UnknownInlinedFun (strv.c:79) ==2392== by 0x11596C: strv_free (strv.c:89) ==2392== by 0x11FE65: UnknownInlinedFun (strv.h:37) ==2392== by 0x11FE65: link_status.lto_priv.140 (networkctl.c:679) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Use of uninitialised value of size 8 ==2392== at 0x11596E: UnknownInlinedFun (strv.c:82) ==2392== by 0x11596E: strv_free (strv.c:89) ==2392== by 0x11FE65: UnknownInlinedFun (strv.h:37) ==2392== by 0x11FE65: link_status.lto_priv.140 (networkctl.c:679) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Invalid free() / delete / delete[] / realloc() ==2392== at 0x4C2CD5A: free (vg_replace_malloc.c:530) ==2392== by 0x115988: UnknownInlinedFun (strv.c:83) ==2392== by 0x115988: strv_free (strv.c:89) ==2392== by 0x11FE65: UnknownInlinedFun (strv.h:37) ==2392== by 0x11FE65: link_status.lto_priv.140 (networkctl.c:679) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== Address 0x122502 is in a r-x mapped file /usr/bin/networkctl segment ==2392== ==2392== Use of uninitialised value of size 8 ==2392== at 0x115989: UnknownInlinedFun (strv.c:82) ==2392== by 0x115989: strv_free (strv.c:89) ==2392== by 0x11FE65: UnknownInlinedFun (strv.h:37) ==2392== by 0x11FE65: link_status.lto_priv.140 (networkctl.c:679) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Conditional jump or move depends on uninitialised value(s) ==2392== at 0x4C2CD0D: free (vg_replace_malloc.c:530) ==2392== by 0x115998: strv_free (strv.c:90) ==2392== by 0x11FE65: UnknownInlinedFun (strv.h:37) ==2392== by 0x11FE65: link_status.lto_priv.140 (networkctl.c:679) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== ==2392== Invalid free() / delete / delete[] / realloc() ==2392== at 0x4C2CD5A: free (vg_replace_malloc.c:530) ==2392== by 0x115998: strv_free (strv.c:90) ==2392== by 0x11FE65: UnknownInlinedFun (strv.h:37) ==2392== by 0x11FE65: link_status.lto_priv.140 (networkctl.c:679) ==2392== by 0x10CCB4: dispatch_verb (verbs.c:92) ==2392== by 0x10CCB4: networkctl_main (networkctl.c:1093) ==2392== by 0x10CCB4: main (networkctl.c:1106) ==2392== Address 0x1ac7c0 is in a r-- mapped file /usr/bin/networkctl segment ==2392== ● State: n/a Address: 192.168.1.117 on wlp3s0 192.168.124.1 on virbr0 fe80::9bbc:92c1:f192:8027 on wlp3s0 Gateway: 192.168.1.1 (D-Link International) on wlp3s0 Route Domains: help ==2392== ==2392== HEAP SUMMARY: ==2392== in use at exit: 4,096 bytes in 1 blocks ==2392== total heap usage: 155 allocs, 156 frees, 66,605 bytes allocated ==2392== ==2392== LEAK SUMMARY: ==2392== definitely lost: 0 bytes in 0 blocks ==2392== indirectly lost: 0 bytes in 0 blocks ==2392== possibly lost: 0 bytes in 0 blocks ==2392== still reachable: 4,096 bytes in 1 blocks ==2392== suppressed: 0 bytes in 0 blocks ==2392== Rerun with --leak-check=full to see details of leaked memory ==2392== ==2392== For counts of detected and suppressed errors, rerun with: -v ==2392== Use --track-origins=yes to see where uninitialised values come from ==2392== ERROR SUMMARY: 13 errors from 13 contexts (suppressed: 0 from 0) Thanks, with this info it's trivial to diagnose. Damn, this bug was already fixed upstream (I noticed it during a review which touched the same code. I had a strange feeling of déjà vu now). Will be fixed in the next version update. https://github.com/systemd/systemd/commit/0070333f26543a319a17aee8b22bdde4071630c4 (The bug is that route_domains is not initialized to NULL like other variables in the same line.) Thanks, Zbigniew. Good outcome. systemd-229-9.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-47bda25e7a systemd-229-9.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-47bda25e7a systemd-229-9.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report. |