Bug 1360209

Summary: dleyna-renderer: Crashes when trying to access invalid GHashTables (dlr_upnp_t->server_udn_map, dlr_upnp_t->server_uc_map)
Product: [Fedora] Fedora Reporter: Maël Lavault <mael.lavault>
Component: dleyna-rendererAssignee: Debarshi Ray <debarshir>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 24CC: arnost.dudek, code, debarshir, madstitz, martincigorraga, philip
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/fd2a814d2983f5c59cd89bba61cd44edd8cf3b7e
Whiteboard: abrt_hash:7a61ed58add666aabc4d7507176d272e39d9dbfd;VARIANT_ID=workstation;
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-09-26 00:20:40 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: limits
none
File: maps
none
File: mountinfo
none
File: namespaces
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages none

Description Maël Lavault 2016-07-26 08:57:10 UTC
Version-Release number of selected component:
dleyna-renderer-0.5.0-4.fc24

Additional info:
reporter:       libreport-2.7.2
backtrace_rating: 4
cmdline:        /usr/libexec/dleyna-renderer-service
crash_function: g_hash_table_lookup_node
executable:     /usr/libexec/dleyna-renderer-service
global_pid:     19171
kernel:         4.6.4-301.fc24.x86_64
pkg_fingerprint: 73BD E983 81B4 6521
pkg_vendor:     Fedora Project
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #4 g_hash_table_lookup_node at ghash.c:373
 #5 g_hash_table_insert_internal at ghash.c:1227
 #6 prv_device_chain_end at upnp.c:85
 #7 prv_free_cb at libdleyna/core/task-processor.c:103
 #8 g_hash_table_remove_all_nodes at ghash.c:548
 #10 g_hash_table_unref at ghash.c:1097
 #11 dleyna_task_processor_free at libdleyna/core/task-processor.c:136
 #12 prv_context_free at libdleyna/core/main-loop.c:108
 #13 dleyna_main_loop_start at libdleyna/core/main-loop.c:167
 #15 _start

Potential duplicate: bug 1220876

Comment 1 Maël Lavault 2016-07-26 08:57:15 UTC
Created attachment 1184105 [details]
File: backtrace

Comment 2 Maël Lavault 2016-07-26 08:57:16 UTC
Created attachment 1184106 [details]
File: cgroup

Comment 3 Maël Lavault 2016-07-26 08:57:17 UTC
Created attachment 1184107 [details]
File: core_backtrace

Comment 4 Maël Lavault 2016-07-26 08:57:18 UTC
Created attachment 1184108 [details]
File: dso_list

Comment 5 Maël Lavault 2016-07-26 08:57:20 UTC
Created attachment 1184109 [details]
File: environ

Comment 6 Maël Lavault 2016-07-26 08:57:21 UTC
Created attachment 1184110 [details]
File: limits

Comment 7 Maël Lavault 2016-07-26 08:57:23 UTC
Created attachment 1184112 [details]
File: maps

Comment 8 Maël Lavault 2016-07-26 08:57:24 UTC
Created attachment 1184113 [details]
File: mountinfo

Comment 9 Maël Lavault 2016-07-26 08:57:25 UTC
Created attachment 1184114 [details]
File: namespaces

Comment 10 Maël Lavault 2016-07-26 08:57:27 UTC
Created attachment 1184115 [details]
File: open_fds

Comment 11 Maël Lavault 2016-07-26 08:57:28 UTC
Created attachment 1184117 [details]
File: proc_pid_status

Comment 12 Maël Lavault 2016-07-26 08:57:30 UTC
Created attachment 1184118 [details]
File: var_log_messages

Comment 13 Debarshi Ray 2016-09-15 08:28:56 UTC
*** Bug 1220876 has been marked as a duplicate of this bug. ***

Comment 14 Debarshi Ray 2016-09-15 08:29:04 UTC
*** Bug 1319000 has been marked as a duplicate of this bug. ***

Comment 15 Debarshi Ray 2016-09-15 08:36:16 UTC
In frame #2, we are hitting this assertion:
hash_table->ref_count > 0

Thread 1 (Thread 0x7ff4a581c880 (LWP 19171)):
#0  0x00007ff4a32f56f5 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
        resultvar = 0
        pid = 19171
        selftid = 19171
#1  0x00007ff4a32f72fa in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 94, 94689405002016, 95, 140688698862752, 140688696272048, 140735615381008, 94689411297920, 140688686850732, 94689405002016, 140688690240256, 95, 140688698862752, 140688696272048, 94689405002016, 95}}, sa_flags = -1544852320, sa_restorer = 0x7ff4a3c3e4b0 <__func__.10228>}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007ff4a3c17f05 in g_assertion_message (domain=domain@entry=0x7ff4a3c3988e "GLib", file=file@entry=0x7ff4a3c3e212 "ghash.c", line=line@entry=373, func=func@entry=0x7ff4a3c3e4b0 <__func__.10228> "g_hash_table_lookup_node", message=message@entry=0x561e98bec300 "assertion failed: (hash_table->ref_count > 0)") at gtestutils.c:2429
        lstr = "373\000\377\177\000\000\000I,\215\317\347mvPAU\230\036V\000\000\370\341\303\243\364\177\000"
        s = 0x561e98596120 ""
#3  0x00007ff4a3c17f9a in g_assertion_message_expr (domain=domain@entry=0x7ff4a3c3988e "GLib", file=file@entry=0x7ff4a3c3e212 "ghash.c", line=line@entry=373, func=func@entry=0x7ff4a3c3e4b0 <__func__.10228> "g_hash_table_lookup_node", expr=expr@entry=0x7ff4a3c3e1f8 "hash_table->ref_count > 0") at gtestutils.c:2452
        s = 0x561e98bec300 "assertion failed: (hash_table->ref_count > 0)"
#4  0x00007ff4a3be0f36 in g_hash_table_lookup_node (hash_return=<synthetic pointer>, key=0x561e98ca21c0, hash_table=0x561e985899e0) at ghash.c:373
        hash_table = 0x561e985899e0
        key = 0x561e98ca21c0
        hash_return = <synthetic pointer>
        node_hash = <optimized out>
        hash_value = <optimized out>
        have_tombstone = 0
        step = 0
        node_index = <optimized out>
        first_tombstone = 0
#5  g_hash_table_insert_internal (hash_table=0x561e985899e0, key=0x561e98ca21c0, value=0x561e98a581f0, keep_new_key=0) at ghash.c:1227
        key_hash = <optimized out>
#6  0x00007ff4a541f4fb in prv_device_chain_end (cancelled=<optimized out>, data=0x561e98e3acb0) at upnp.c:85
        device = 0x561e98a581f0
        priv_t = 0x561e98e3acb0
#7  0x00007ff4a520c690 in prv_free_cb (data=0x561e98b97280) at libdleyna/core/task-processor.c:103
        task_queue = 0x561e98b97280

Comment 16 Debarshi Ray 2016-09-15 08:37:18 UTC
*** Bug 1258636 has been marked as a duplicate of this bug. ***

Comment 17 Debarshi Ray 2016-09-15 08:52:01 UTC
*** Bug 1331404 has been marked as a duplicate of this bug. ***

Comment 18 Debarshi Ray 2016-09-15 08:52:03 UTC
*** Bug 1215332 has been marked as a duplicate of this bug. ***

Comment 19 Debarshi Ray 2016-09-15 08:53:40 UTC
*** Bug 1359750 has been marked as a duplicate of this bug. ***

Comment 20 Debarshi Ray 2016-09-15 15:37:03 UTC
*** Bug 1287072 has been marked as a duplicate of this bug. ***

Comment 21 Debarshi Ray 2016-09-16 07:14:04 UTC
This is caused by dleyna_task_processor_t->on_quit_cb being run while there are still queues present in the processor. Filed as https://github.com/01org/dleyna-core/pull/49

Comment 22 Debarshi Ray 2016-09-16 15:24:54 UTC
Similar dleyna-server bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1205574

Comment 23 Fedora Update System 2016-09-22 09:55:42 UTC
dleyna-core-0.5.0-4.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-8b47d28f07

Comment 24 Fedora Update System 2016-09-23 06:54:20 UTC
dleyna-core-0.5.0-3.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-d3927e6a71

Comment 25 Fedora Update System 2016-09-23 08:01:37 UTC
dleyna-core-0.5.0-4.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-603b9f4445

Comment 26 Fedora Update System 2016-09-26 00:20:40 UTC
dleyna-core-0.5.0-4.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 27 Fedora Update System 2016-09-27 00:34:30 UTC
dleyna-core-0.5.0-4.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.

Comment 28 Fedora Update System 2016-10-03 20:19:58 UTC
dleyna-core-0.5.0-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 29 Debarshi Ray 2020-12-02 00:48:37 UTC
*** Bug 1215332 has been marked as a duplicate of this bug. ***