Bug 1778854

Summary: crash in exit_librepo when uninstalling packages
Product: [Fedora] Fedora Reporter: Lukas Slebodnik <lslebodn>
Component: librepoAssignee: Lukáš Hrázký <lhrazky>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: high Docs Contact:
Priority: medium    
Version: rawhideCC: amatej, dmach, jhnidek, lhrazky, mblaha, pkratoch, rpm-software-management, tmlcoch
Target Milestone: ---Keywords: Triaged
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: librepo-1.11.1-3.fc32 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-02-06 13:27:03 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Lukas Slebodnik 2019-12-02 16:36:50 UTC
Description of problem:
I could see crashes in my unrelated tests. There was dnf unistall for some packages.  


Version-Release number of selected component (if applicable):
[root@kvm-02-guest07 ~]# rpm -q dnf dnf-utils dnf-plugin-subscription-manager python3-librepo glibc
dnf-4.2.15-2.fc32.noarch
dnf-utils-4.0.11-1.fc32.noarch
dnf-plugin-subscription-manager-1.25.9-4.fc32.x86_64
python3-librepo-1.11.0-1.fc32.x86_64
glibc-2.30.9000-22.fc32.x86_64

How reproducible:
Deterministic

Steps to Reproduce:
1. dnf install -y dnf-plugin-subscription-manager
2. dnf -y remove dnf-plugin-subscription-manager

Actual results:
sh# dnf -y remove dnf-plugin-subscription-manager                                                                                                                     
Updating Subscription Management repositories.                                                                                                                                             
Unable to read consumer identity                                                                                                                                                           
This system is not registered to Red Hat Subscription Management. You can use su                                                                                                           bscription-manager to register.                                                                                                                                                            
Dependencies resolved.                                                                                                                                                  
================================================================================                                                                                                           
 Package                                Arch   Version           Repo      Size                                                                                                            
================================================================================                                                                                                           
Removing:                                                                                                           
 dnf-plugin-subscription-manager        x86_64 1.25.9-4.fc32     @rawhide  90 k                                                                                                            
Removing unused dependencies:                                                                                                                                                              
 dmidecode                              x86_64 1:3.2-4.fc32      @rawhide 229 k                                                                                                            
 python3-dmidecode                      x86_64 3.12.2-18.fc32    @rawhide 280 k                                                                                                            
 python3-ethtool                        x86_64 0.14-5.fc32       @rawhide  94 k                                                                                                            
 python3-iniparse                       noarch 0.4-39.fc32       @rawhide 106 k                                                                                                            
 python3-inotify                        noarch 0.9.6-19.fc32     @rawhide 243 k                                                                                                            
 python3-librepo                        x86_64 1.11.0-1.fc32     @rawhide 176 k                                                                                                            
 python3-libxml2                        x86_64 2.9.10-1.fc32     @rawhide 1.3 M                                                                                                            
 python3-subscription-manager-rhsm      x86_64 1.25.9-4.fc32     @rawhide 378 k                                                                                                            
 python3-syspurpose                     x86_64 1.25.9-4.fc32     @rawhide 123 k                                                                                                            
 subscription-manager                   x86_64 1.25.9-4.fc32     @rawhide 4.2 M                                                                                                            
 subscription-manager-rhsm-certificates x86_64 1.25.9-4.fc32     @rawhide 7.2 k                                                                                                            
 usermode                               x86_64 1.112-5.fc31      @rawhide 838 k                                                                                                            
 virt-what                              x86_64 1.20-1.fc32       @rawhide  54 k                                                                                                            

Transaction Summary                                                                                                                                         
================================================================================                                                                                                           
Remove  14 Packages                                                                                                                                         

Freed space: 8.0 M                                                                                                                                      
Running transaction check                                                                                                                                                           
Transaction check succeeded.                                                                                                                                                               
Running transaction test                                                                                                                                                        
Transaction test succeeded.
Transaction test succeeded.                                                                                                                                                                
Running transaction                                                                                                                                         
  Preparing        :                                                        1/1                                                                                                            
  Running scriptlet: dnf-plugin-subscription-manager-1.25.9-4.fc32.x86_64   1/1                                                                                                            
  Erasing          : dnf-plugin-subscription-manager-1.25.9-4.fc32.x86_    1/14 
  Running scriptlet: subscription-manager-1.25.9-4.fc32.x86_64             2/14 
  Erasing          : subscription-manager-1.25.9-4.fc32.x86_64             2/14 
  Running scriptlet: subscription-manager-1.25.9-4.fc32.x86_64             2/14 
  Erasing          : python3-dmidecode-3.12.2-18.fc32.x86_64               3/14 
  Erasing          : python3-subscription-manager-rhsm-1.25.9-4.fc32.x8    4/14 
  Erasing          : virt-what-1.20-1.fc32.x86_64                          5/14 
  Erasing          : python3-iniparse-0.4-39.fc32.noarch                   6/14 
  Erasing          : subscription-manager-rhsm-certificates-1.25.9-4.fc    7/14 
  Erasing          : python3-inotify-0.9.6-19.fc32.noarch                  8/14 
  Erasing          : python3-syspurpose-1.25.9-4.fc32.x86_64               9/14 
  Erasing          : dmidecode-1:3.2-4.fc32.x86_64                        10/14 
  Erasing          : python3-libxml2-2.9.10-1.fc32.x86_64                 11/14 
  Erasing          : python3-ethtool-0.14-5.fc32.x86_64                   12/14 
  Erasing          : usermode-1.112-5.fc31.x86_64                         13/14 
  Erasing          : python3-librepo-1.11.0-1.fc32.x86_64                 14/14 
  Running scriptlet: python3-librepo-1.11.0-1.fc32.x86_64                 14/14 
  Verifying        : dmidecode-1:3.2-4.fc32.x86_64                         1/14 
  Verifying        : dnf-plugin-subscription-manager-1.25.9-4.fc32.x86_    2/14 
  Verifying        : python3-dmidecode-3.12.2-18.fc32.x86_64               3/14 
  Verifying        : python3-ethtool-0.14-5.fc32.x86_64                    4/14 
  Verifying        : python3-iniparse-0.4-39.fc32.noarch                   5/14 
  Verifying        : python3-inotify-0.9.6-19.fc32.noarch                  6/14 
  Verifying        : python3-librepo-1.11.0-1.fc32.x86_64                  7/14 
  Verifying        : python3-libxml2-2.9.10-1.fc32.x86_64                  8/14 
  Verifying        : python3-subscription-manager-rhsm-1.25.9-4.fc32.x8    9/14 
  Verifying        : python3-syspurpose-1.25.9-4.fc32.x86_64              10/14 
  Verifying        : subscription-manager-1.25.9-4.fc32.x86_64            11/14 
  Verifying        : subscription-manager-rhsm-certificates-1.25.9-4.fc   12/14 
  Verifying        : usermode-1.112-5.fc31.x86_64                         13/14 
  Verifying        : virt-what-1.20-1.fc32.x86_64                         14/14 

Removed:
  dnf-plugin-subscription-manager-1.25.9-4.fc32.x86_64                          
  dmidecode-1:3.2-4.fc32.x86_64                                                 
  python3-dmidecode-3.12.2-18.fc32.x86_64                                       
  python3-ethtool-0.14-5.fc32.x86_64                                            
  python3-iniparse-0.4-39.fc32.noarch                                           
  python3-inotify-0.9.6-19.fc32.noarch                                          
  python3-librepo-1.11.0-1.fc32.x86_64                                          
  python3-libxml2-2.9.10-1.fc32.x86_64                                          
  python3-subscription-manager-rhsm-1.25.9-4.fc32.x86_64
  python3-syspurpose-1.25.9-4.fc32.x86_64                                       
  subscription-manager-1.25.9-4.fc32.x86_64                                     
  subscription-manager-rhsm-certificates-1.25.9-4.fc32.x86_64                   
  usermode-1.112-5.fc31.x86_64                                                  
  virt-what-1.20-1.fc32.x86_64                                                  

Complete!
corrupted double-linked list (not small)
Aborted (core dumped)




Expected results:


package removed witout crash

Additional info:

sh# coredumpctl info
           PID: 27504 (dnf)
           UID: 0 (root)
           GID: 0 (root)
        Signal: 6 (ABRT)
     Timestamp: Mon 2019-12-02 17:34:33 CET (1min 50s ago)
  Command Line: /usr/bin/python3 /usr/bin/dnf -y remove dnf-plugin-subscription-manager
    Executable: /usr/bin/python3.8
 Control Group: /user.slice/user-0.slice/session-2.scope
          Unit: session-2.scope
         Slice: user-0.slice
       Session: 2
     Owner UID: 0 (root)
       Boot ID: cd3065f74d6544b38932f6b0a91f60d8
    Machine ID: 04c464dd10464e69b8139a6d2a8111c2
       Storage: /var/lib/systemd/coredump/core.dnf.0.cd3065f74d6544b38932f6b0a91f60d8.27504.1575304473000000000000.lz4
       Message: Process 27504 (dnf) of user 0 dumped core.
                
                Stack trace of thread 27504:
                #0  0x00007f08d0a565e5 raise (libc.so.6 + 0x3c5e5)
                #1  0x00007f08d0a3f899 abort (libc.so.6 + 0x25899)
                #2  0x00007f08d0a9a41f __libc_message (libc.so.6 + 0x8041f)
                #3  0x00007f08d0aa190c malloc_printerr (libc.so.6 + 0x8790c)
                #4  0x00007f08d0aa21b2 unlink_chunk.isra.0 (libc.so.6 + 0x881b2)
                #5  0x00007f08d0aa367b _int_free (libc.so.6 + 0x8967b)
                #6  0x00007f08d0af224c free_state (libc.so.6 + 0xd824c)
                #7  0x00007f08d0af23c9 free_dfa_content (libc.so.6 + 0xd83c9)
                #8  0x00007f08d0affc45 regfree (libc.so.6 + 0xe5c45)
                #9  0x00007f08cfad0e2d _ZN5RegexD1Ev (libdnf.so.2 + 0x14be2d)
                #10 0x00007f08d0a58e47 __run_exit_handlers (libc.so.6 + 0x3ee47)
                #11 0x00007f08d0a59000 exit (libc.so.6 + 0x3f000)
                #12 0x00007f08d08cd477 Py_Exit (libpython3.8.so.1.0 + 0x224477)
                #13 0x00007f08d08cd4af handle_system_exit (libpython3.8.so.1.0 + 0x2244af)
                #14 0x00007f08d08cd5f9 _PyErr_PrintEx (libpython3.8.so.1.0 + 0x2245f9)
                #15 0x00007f08d07b032f PyRun_SimpleFileExFlags (libpython3.8.so.1.0 + 0x10732f)
                #16 0x00007f08d08ce73f pymain_run_file (libpython3.8.so.1.0 + 0x22573f)
                #17 0x00007f08d08ce929 Py_BytesMain (libpython3.8.so.1.0 + 0x225929)
                #18 0x00007f08d0a41133 __libc_start_main (libc.so.6 + 0x27133)
                #19 0x0000556a02b5008e _start (python3.8 + 0x108e)

Comment 1 Lukas Slebodnik 2019-12-02 16:40:58 UTC
sh# valgrind dnf -y remove dnf-plugin-subscription-manager                                                                                                            
==28315== Memcheck, a memory error detector                                                                                                                                                
==28315== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.                                                                                                                  
==28315== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info                                                                                                               
==28315== Command: /usr/bin/dnf -y remove dnf-plugin-subscription-manager                                                                                                                  
==28315==                                       
==28316== Warning: invalid file descriptor 1024 in syscall close()                                                                                                                         
==28316== Warning: invalid file descriptor 1025 in syscall close()                                                                                                                         
==28316== Warning: invalid file descriptor 1026 in syscall close()                                                                                                                         
==28316== Warning: invalid file descriptor 1027 in syscall close()                                                                                                                         
==28316==    Use --log-fd=<number> to select an alternative log fd.                                                                                                                        
==28316== Warning: invalid file descriptor 1028 in syscall close()                                                                                                                         
==28316== Warning: invalid file descriptor 1029 in syscall close()                                                                                                                         
Updating Subscription Management repositories.                                                                                                                                             
Unable to read consumer identity                                                                                                                                                           
This system is not registered to Red Hat Subscription Management. You can use su                                                                                                           bscription-manager to register.                                                                                                                                                            
Dependencies resolved.                                                                                                                                                  
================================================================================                                                                                                           
 Package                                Arch   Version           Repo      Size                                                                                                            
================================================================================                                                                                                           
Removing:                                                                                                           
 dnf-plugin-subscription-manager        x86_64 1.25.9-4.fc32     @rawhide  90 k                                                                                                            
Removing unused dependencies:                                                                                                                                                              
 dmidecode                              x86_64 1:3.2-4.fc32      @rawhide 229 k                                                                                                            
 python3-dmidecode                      x86_64 3.12.2-18.fc32    @rawhide 280 k                                                                                                            
 python3-ethtool                        x86_64 0.14-5.fc32       @rawhide  94 k                                                                                                            
 python3-iniparse                       noarch 0.4-39.fc32       @rawhide 106 k                                                                                                            
 python3-inotify                        noarch 0.9.6-19.fc32     @rawhide 243 k                                                                                                            
 python3-librepo                        x86_64 1.11.0-1.fc32     @rawhide 176 k                                                                                                            
 python3-libxml2                        x86_64 2.9.10-1.fc32     @rawhide 1.3 M                                                                                                            
 python3-subscription-manager-rhsm      x86_64 1.25.9-4.fc32     @rawhide 378 k                                                                                                            
 python3-syspurpose                     x86_64 1.25.9-4.fc32     @rawhide 123 k                                                                                                            
 subscription-manager                   x86_64 1.25.9-4.fc32     @rawhide 4.2 M                                                                                                            
 subscription-manager-rhsm-certificates x86_64 1.25.9-4.fc32     @rawhide 7.2 k                                                                                                            
 usermode                               x86_64 1.112-5.fc31      @rawhide 838 k                                                                                                            
 virt-what                              x86_64 1.20-1.fc32       @rawhide  54 k                                                                                                            

Transaction Summary                                                                                                                                         
================================================================================                                                                                                           
Remove  14 Packages                                                                                                                                         

Freed space: 8.0 M                                                                                                                                      
Running transaction check                                                                                                                                                           
Transaction check succeeded.                                                                                                                                                               
Running transaction test                                                                                                                                                        
Transaction test succeeded.                                                                                                                                                                
Running transaction                                                                                                                                         
  Preparing        :                                                        1/1                                                                                                            
  Running scriptlet: dnf-plugin-subscription-manager-1.25.9-4.fc32.x86_64   1/1                                                                                                            
  Erasing          : dnf-plugin-subscription-manager-1.25.9-4.fc32.x86_    1/14                                                                                                            
==28315== Syscall param pwrite64(buf) points to uninitialised byte(s)
==28315==    at 0x494036A: pwrite (in /usr/lib64/libc-2.30.9000.so)                                                                                                                        
==28315==    by 0x814ABA4: __os_io (in /usr/lib64/libdb-5.3.so)                                                                                                                            
==28315==    by 0x81360F0: ??? (in /usr/lib64/libdb-5.3.so)                                                                                                                                
==28315==    by 0x81364B3: __memp_bhwrite (in /usr/lib64/libdb-5.3.so)                                                                                                                     
==28315==    by 0x814682D: __memp_sync_int (in /usr/lib64/libdb-5.3.so)                                                                                                                    
==28315==    by 0x80DC8F6: __db_sync (in /usr/lib64/libdb-5.3.so)                                                                                                                          
==28315==    by 0x80EE6F7: __db_sync_pp (in /usr/lib64/libdb-5.3.so)                                                                                                                       
==28315==    by 0x7909B4D: ??? (in /usr/lib64/librpm.so.9.0.1)                                                                                                                             
==28315==    by 0x78CE33E: ??? (in /usr/lib64/librpm.so.9.0.1)                                                                                                                             
==28315==    by 0x78D1D27: ??? (in /usr/lib64/librpm.so.9.0.1)                                                                                                                             
==28315==    by 0x78E4B2C: ??? (in /usr/lib64/librpm.so.9.0.1)                                                                                                                             
==28315==    by 0x78E5E52: ??? (in /usr/lib64/librpm.so.9.0.1)                                                                                                                             
==28315==  Address 0xd411f2c is in a rw- mapped file /var/lib/rpm/__db.003 segme                                                                                                           nt                                                                                      
==28315==                                                                                                               
  Running scriptlet: subscription-manager-1.25.9-4.fc32.x86_64             2/14                                                                                                            
  Erasing          : subscription-manager-1.25.9-4.fc32.x86_64             2/14                                                                                                            
  Running scriptlet: subscription-manager-1.25.9-4.fc32.x86_64             2/14                                                                                                            
  Erasing          : python3-dmidecode-3.12.2-18.fc32.x86_64               3/14                                                                                                            
  Erasing          : python3-subscription-manager-rhsm-1.25.9-4.fc32.x8    4/14                                                                                                            
  Erasing          : virt-what-1.20-1.fc32.x86_64                          5/14                                                                                                            
  Erasing          : python3-iniparse-0.4-39.fc32.noarch                   6/14                                                                                                            
  Erasing          : subscription-manager-rhsm-certificates-1.25.9-4.fc    7/14                                                                                                            
  Erasing          : python3-inotify-0.9.6-19.fc32.noarch                  8/14                                                                                                            
  Erasing          : python3-syspurpose-1.25.9-4.fc32.x86_64               9/14                                                                                                            
  Erasing          : dmidecode-1:3.2-4.fc32.x86_64                        10/14                                                                                                            
  Erasing          : python3-libxml2-2.9.10-1.fc32.x86_64                 11/14                                                                                                            
  Erasing          : python3-ethtool-0.14-5.fc32.x86_64                   12/14                                                                                                            
  Erasing          : usermode-1.112-5.fc31.x86_64                         13/14                                                                                                            
  Erasing          : python3-librepo-1.11.0-1.fc32.x86_64                 14/14                                                                                                            
  Running scriptlet: python3-librepo-1.11.0-1.fc32.x86_64                 14/14                                                                                                            
  Verifying        : dmidecode-1:3.2-4.fc32.x86_64                         1/14                                                                                                            
  Verifying        : dnf-plugin-subscription-manager-1.25.9-4.fc32.x86_    2/14                                                                                                            
  Verifying        : python3-dmidecode-3.12.2-18.fc32.x86_64               3/14                                                                                                            
  Verifying        : python3-ethtool-0.14-5.fc32.x86_64                    4/14                                                                                                            
  Verifying        : python3-iniparse-0.4-39.fc32.noarch                   5/14                                                                                                            
  Verifying        : python3-inotify-0.9.6-19.fc32.noarch                  6/14                                                                                                            
  Verifying        : python3-librepo-1.11.0-1.fc32.x86_64                  7/14                                                                                                            
  Verifying        : python3-libxml2-2.9.10-1.fc32.x86_64                  8/14                                                                                                            
  Verifying        : python3-subscription-manager-rhsm-1.25.9-4.fc32.x8    9/14                                                                                                            
  Verifying        : python3-syspurpose-1.25.9-4.fc32.x86_64              10/14                                                                                                            
  Verifying        : subscription-manager-1.25.9-4.fc32.x86_64            11/14                                                                                                            
  Verifying        : subscription-manager-rhsm-certificates-1.25.9-4.fc   12/14                                                                                                            
  Verifying        : usermode-1.112-5.fc31.x86_64                         13/14                                                                                                            
  Verifying        : virt-what-1.20-1.fc32.x86_64                         14/14                                                                                                            

Removed:                                                                                                        
  dnf-plugin-subscription-manager-1.25.9-4.fc32.x86_64                                                                                                                                     
  dmidecode-1:3.2-4.fc32.x86_64                                                                                                                                                            
  python3-dmidecode-3.12.2-18.fc32.x86_64
  python3-ethtool-0.14-5.fc32.x86_64                                                                                                                                                       
  python3-iniparse-0.4-39.fc32.noarch                                                                                                                                                      
  python3-inotify-0.9.6-19.fc32.noarch                                                                                                                                                     
  python3-librepo-1.11.0-1.fc32.x86_64                                                                                                                                                     
  python3-libxml2-2.9.10-1.fc32.x86_64                                                                                                                                                     
  python3-subscription-manager-rhsm-1.25.9-4.fc32.x86_64                                                                                                                                   
  python3-syspurpose-1.25.9-4.fc32.x86_64                                                                                                                                                  
  subscription-manager-1.25.9-4.fc32.x86_64                                                                                                                                                
  subscription-manager-rhsm-certificates-1.25.9-4.fc32.x86_64                                                                                                                              
  usermode-1.112-5.fc31.x86_64                                                                                                                                                             
  virt-what-1.20-1.fc32.x86_64                                                                                                                                                             

Complete!                                                                                                           
==28315== Invalid read of size 8                                                                                                                                                           
==28315==    at 0xC60F4F1: UnknownInlinedFun (object.h:470)                                                                                                                                
==28315==    by 0xC60F4F1: UnknownInlinedFun (object.h:541)                                                                                                                                
==28315==    by 0xC60F4F1: exit_librepo (librepomodule.c:137)                                                                                                                              
==28315==    by 0x4B1FD44: UnknownInlinedFun (pylifecycle.c:2285)                                                                                                                          
==28315==    by 0x4B1FD44: Py_FinalizeEx.cold (pylifecycle.c:1372)                                                                                                                         
==28315==    by 0x4C3D467: Py_Exit (pylifecycle.c:2295)                                                                                                                                    
==28315==    by 0x4C3D4AE: handle_system_exit (pythonrun.c:658)                                                                                                                            
==28315==    by 0x4C3D5F8: UnknownInlinedFun (pythonrun.c:668)                                                                                                                             
==28315==    by 0x4C3D5F8: PyErr_PrintEx (pythonrun.c:755)                                                                                                                                 
==28315==    by 0x4B2032E: PyRun_SimpleFileExFlags.cold (pythonrun.c:434)                                                                                                                  
==28315==    by 0x4C3E73E: UnknownInlinedFun (main.c:381)                                                                                                                                  
==28315==    by 0x4C3E73E: UnknownInlinedFun (main.c:565)                                                                                                                                  
==28315==    by 0x4C3E73E: Py_RunMain (main.c:644)                                                                                                                                         
==28315==    by 0x4C3E928: Py_BytesMain (main.c:698)                                                                                                                                       
==28315==    by 0x4877132: (below main) (in /usr/lib64/libc-2.30.9000.so)                                                                                                                  
==28315==  Address 0xb7f1530 is 16 bytes inside a block of size 936 free'd                                                                                                                 
==28315==    at 0x483BA0C: free (vg_replace_malloc.c:540)                                                                                                                                  
==28315==    by 0x4C111EB: type_dealloc (typeobject.c:3360)                                                                                                                                
==28315==    by 0x4B3385E: UnknownInlinedFun (object.h:478)                                                                                                                                
==28315==    by 0x4B3385E: UnknownInlinedFun (gcmodule.c:953)                                                                                                                              
==28315==    by 0x4B3385E: collect.constprop.0 (gcmodule.c:1123)                                                                                                                           
==28315==    by 0x4C3CCA1: _PyGC_CollectNoFail (gcmodule.c:1866)                                                                                                                           
==28315==    by 0x4C3CF53: PyImport_Cleanup (import.c:541)                                                                                                                                 
==28315==    by 0x4C3D335: Py_FinalizeEx (pylifecycle.c:1240)                                                                                                                              
==28315==    by 0x4C3D467: Py_Exit (pylifecycle.c:2295)
==28315==    by 0x4C3D4AE: handle_system_exit (pythonrun.c:658)
==28315==    by 0x4C3D5F8: UnknownInlinedFun (pythonrun.c:668)
==28315==    by 0x4C3D5F8: PyErr_PrintEx (pythonrun.c:755)
==28315==    by 0x4B2032E: PyRun_SimpleFileExFlags.cold (pythonrun.c:434)
==28315==    by 0x4C3E73E: UnknownInlinedFun (main.c:381)
==28315==    by 0x4C3E73E: UnknownInlinedFun (main.c:565)
==28315==    by 0x4C3E73E: Py_RunMain (main.c:644)
==28315==    by 0x4C3E928: Py_BytesMain (main.c:698)
==28315==  Block was alloc'd at
==28315==    at 0x483A80B: malloc (vg_replace_malloc.c:309)
==28315==    by 0x4B292A7: UnknownInlinedFun (obmalloc.c:1628)
==28315==    by 0x4B292A7: UnknownInlinedFun (obmalloc.c:1620)
==28315==    by 0x4B292A7: PyObject_Malloc (obmalloc.c:685)
==28315==    by 0x4B33DE1: UnknownInlinedFun (gcmodule.c:1964)
==28315==    by 0x4B33DE1: _PyObject_GC_Malloc (gcmodule.c:1987)
==28315==    by 0x4B5A6D9: PyType_GenericAlloc (typeobject.c:1010)
==28315==    by 0x4BA0588: type_new (typeobject.c:2563)
==28315==    by 0x4B402CF: UnknownInlinedFun (typeobject.c:969)
==28315==    by 0x4B402CF: _PyObject_MakeTpCall (call.c:159)
==28315==    by 0x4B94FE6: UnknownInlinedFun (abstract.h:125)
==28315==    by 0x4B94FE6: UnknownInlinedFun (abstract.h:115)
==28315==    by 0x4B94FE6: UnknownInlinedFun (abstract.h:147)
==28315==    by 0x4B94FE6: UnknownInlinedFun (call.c:940)
==28315==    by 0x4B94FE6: PyObject_CallFunction (call.c:960)
==28315==    by 0x4C23419: PyErr_NewException (errors.c:1025)
==28315==    by 0xC60D437: init_exceptions (exception-py.c:32)
==28315==    by 0xC60F8B7: PyInit__librepo (librepomodule.c:201)
==28315==    by 0x4C3655E: _PyImport_LoadDynamicModuleWithSpec (importdl.c:164)
==28315==    by 0x4C36734: UnknownInlinedFun (import.c:2220)
==28315==    by 0x4C36734: _imp_create_dynamic (import.c.h:330)
==28315== 
==28315== 
==28315== HEAP SUMMARY:
==28315==     in use at exit: 4,268,173 bytes in 38,063 blocks
==28315==   total heap usage: 932,327 allocs, 894,264 frees, 9,293,605,135 bytes allocated
==28315== 
==28315== LEAK SUMMARY:
==28315==    definitely lost: 288 bytes in 6 blocks
==28315==    indirectly lost: 164 bytes in 3 blocks
==28315==      possibly lost: 946,478 bytes in 8,197 blocks
==28315==    still reachable: 3,320,939 bytes in 29,855 blocks
==28315==                       of which reachable via heuristic:
==28315==                         newarray           : 1,536 bytes in 16 blocks
==28315==         suppressed: 0 bytes in 0 blocks
==28315== Rerun with --leak-check=full to see details of leaked memory
==28315== 
==28315== Use --track-origins=yes to see where uninitialised values come from
==28315== For lists of detected and suppressed errors, rerun with: -s
==28315== ERROR SUMMARY: 125 errors from 3 contexts (suppressed: 0 from 0)

Comment 2 Lukas Slebodnik 2019-12-05 23:37:11 UTC
Do you have some issues to reproduce it yourself?
This bug causes lot of faise positive failures in my testing.
Let me know if you need any help.

Comment 3 Lukas Slebodnik 2019-12-09 10:35:36 UTC
I hit the crash even in install 

sh# yum install mod_auth_gssapi -y
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Last metadata expiration check: 0:11:19 ago on Sun 08 Dec 2019 03:23:43 PM EST.
Dependencies resolved.
================================================================================
 Package                Architecture  Version              Repository      Size
================================================================================
Installing:
 mod_auth_gssapi        x86_64        1.6.1-7.fc31         rawhide         85 k

Transaction Summary
================================================================================
Install  1 Package

Total download size: 85 k
Installed size: 183 k
Downloading Packages:
mod_auth_gssapi-1.6.1-7.fc31.x86_64.rpm         366 kB/s |  85 kB     00:00    
--------------------------------------------------------------------------------
Total                                           183 kB/s |  85 kB     00:00     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : mod_auth_gssapi-1.6.1-7.fc31.x86_64                    1/1 
  Running scriptlet: mod_auth_gssapi-1.6.1-7.fc31.x86_64                    1/1 
  Verifying        : mod_auth_gssapi-1.6.1-7.fc31.x86_64                    1/1 
Installed products updated.

Installed:
  mod_auth_gssapi-1.6.1-7.fc31.x86_64                                           

Complete!
corrupted double-linked list (not small)
/usr/share/beakerlib/testing.sh: line 891: 53028 Aborted                 (core dumped) yum install mod_auth_gssapi -y

Comment 6 Pavla Kratochvilova 2019-12-10 11:53:59 UTC
I am not able to reproduce the segfault, however, valgrind output does contain the "Invalid read of size 8" error.

I found out that it is reproducible with any remove operation, so for example the following reproducer also produces the "Invalid read of size 8" error:
1. dnf install -y dnf-plugin-subscription-manager
2. valgrind dnf remove -y nano

I believe that the problem is either in librepo or in product-id plugin, because the following reproducer does NOT produce the "Invalid read of size 8" error:
1. dnf install -y dnf-plugin-subscription-manager
2. valgrind dnf remove -y nano --disableplugin=product-id

CC Jiri Hnidek from subscription-manager team. Could you also help to investigate the issue?

Comment 8 Lukas Slebodnik 2019-12-11 11:36:38 UTC
(In reply to Pavla Kratochvilova from comment #6)
> I am not able to reproduce the segfault, however, valgrind output does
> contain the "Invalid read of size 8" error.
> 

"Invalid read of size 8" is very likely the issue with segfault.


> I found out that it is reproducible with any remove operation, so for
> example the following reproducer also produces the "Invalid read of size 8"
> error:
> 1. dnf install -y dnf-plugin-subscription-manager

I can reproduce it on some machines even with install operation.

[root@hpe-dl380pgen8-02-vm-15 ~]# valgrind yum install /usr/sbin/semanage -y
==103889== Memcheck, a memory error detector
==103889== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.
==103889== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info
==103889== Command: /usr/bin/yum install /usr/sbin/semanage -y
==103889== 
==103891== Warning: invalid file descriptor 1024 in syscall close()
==103891== Warning: invalid file descriptor 1025 in syscall close()
==103891== Warning: invalid file descriptor 1026 in syscall close()
==103891== Warning: invalid file descriptor 1027 in syscall close()
==103891==    Use --log-fd=<number> to select an alternative log fd.
==103891== Warning: invalid file descriptor 1028 in syscall close()
==103891== Warning: invalid file descriptor 1029 in syscall close()
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Last metadata expiration check: 1:11:10 ago on Wed 11 Dec 2019 05:11:55 AM EST.

Package policycoreutils-python-utils-3.0-1.fc32.noarch is already installed.
Dependencies resolved.
Nothing to do.
Complete!
==103889== Invalid read of size 8
==103889==    at 0xC66D4F1: exit_librepo (in /usr/lib64/python3.8/site-packages/librepo/_librepo.so)
==103889==    by 0x4B23C66: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8E2B7: Py_Exit (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8E2FE: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8E418: PyErr_PrintEx (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4B25491: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8F53E: Py_RunMain (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8F728: Py_BytesMain (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4878132: (below main) (in /usr/lib64/libc-2.30.9000.so)
==103889==  Address 0x5449f50 is 16 bytes inside a block of size 936 free'd
==103889==    at 0x483AA0C: free (vg_replace_malloc.c:540)
==103889==    by 0x4C6A69B: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4B40675: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C7E921: _PyGC_CollectNoFail (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C86EB3: PyImport_Cleanup (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8E185: Py_FinalizeEx (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8E2B7: Py_Exit (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8E2FE: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8E418: PyErr_PrintEx (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4B25491: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8F53E: Py_RunMain (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8F728: Py_BytesMain (in /usr/lib64/libpython3.8.so.1.0)
==103889==  Block was alloc'd at
==103889==    at 0x483980B: malloc (vg_replace_malloc.c:309)
==103889==    by 0x4B69772: PyType_GenericAlloc (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4BBB0D8: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4B4E615: _PyObject_MakeTpCall (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4BA0D96: PyObject_CallFunction (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C65CE9: PyErr_NewException (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0xC66B437: init_exceptions (in /usr/lib64/python3.8/site-packages/librepo/_librepo.so)
==103889==    by 0xC66D8B7: PyInit__librepo (in /usr/lib64/python3.8/site-packages/librepo/_librepo.so)
==103889==    by 0x4C8D79E: _PyImport_LoadDynamicModuleWithSpec (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4C8DB9C: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4B549BE: ??? (in /usr/lib64/libpython3.8.so.1.0)
==103889==    by 0x4B8A48F: PyVectorcall_Call (in /usr/lib64/libpython3.8.so.1.0)
==103889== 
==103889== 
==103889== HEAP SUMMARY:
==103889==     in use at exit: 7,187,976 bytes in 95,193 blocks
==103889==   total heap usage: 3,213,988 allocs, 3,118,795 frees, 8,881,229,667 bytes allocated
==103889== 
==103889== LEAK SUMMARY:
==103889==    definitely lost: 127,932 bytes in 23 blocks
==103889==    indirectly lost: 59,670 bytes in 419 blocks
==103889==      possibly lost: 3,459,284 bytes in 62,946 blocks
==103889==    still reachable: 3,329,762 bytes in 30,058 blocks
==103889==                       of which reachable via heuristic:
==103889==                         newarray           : 1,536 bytes in 16 blocks
==103889==         suppressed: 0 bytes in 0 blocks
==103889== Rerun with --leak-check=full to see details of leaked memory
==103889== 
==103889== For lists of detected and suppressed errors, rerun with: -s
==103889== ERROR SUMMARY: 2 errors from 1 contexts (suppressed: 0 from 0)

Comment 9 Lukas Slebodnik 2019-12-11 11:47:56 UTC
Sorry wrong copy and paste in previous comment

yum install /usr/sbin/semanage -y'
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to register.
Last metadata expiration check: 0:17:24 ago on Tue 10 Dec 2019 11:09:13 AM EST.
Dependencies resolved.
================================================================================
 Package                  Arch   Version                          Repo     Size
================================================================================
Installing:
 policycoreutils-python-utils
                          noarch 3.0-1.fc32                       rawhide  84 k
Installing dependencies:
 checkpolicy              x86_64 3.0-1.fc32                       rawhide 330 k
 python3-audit            x86_64 3.0-0.16.20191104git1c2f876.fc32 rawhide  84 k
 python3-libsemanage      x86_64 3.0-1.fc32                       rawhide  84 k
 python3-policycoreutils  noarch 3.0-1.fc32                       rawhide 2.1 M
 python3-setools          x86_64 4.2.2-3.fc32                     rawhide 647 k

Transaction Summary
================================================================================
Install  6 Packages

Total download size: 3.3 M
Installed size: 10 M
Downloading Packages:
(1/6): python3-audit-3.0-0.16.20191104git1c2f87 324 kB/s |  84 kB     00:00    
(2/6): policycoreutils-python-utils-3.0-1.fc32. 253 kB/s |  84 kB     00:00    
(3/6): python3-libsemanage-3.0-1.fc32.x86_64.rp 555 kB/s |  84 kB     00:00    
(4/6): checkpolicy-3.0-1.fc32.x86_64.rpm        786 kB/s | 330 kB     00:00    
(5/6): python3-setools-4.2.2-3.fc32.x86_64.rpm  2.6 MB/s | 647 kB     00:00    
(6/6): python3-policycoreutils-3.0-1.fc32.noarc 4.1 MB/s | 2.1 MB     00:00    
--------------------------------------------------------------------------------
Total                                           2.5 MB/s | 3.3 MB     00:01     
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                        1/1 
  Installing       : python3-setools-4.2.2-3.fc32.x86_64                    1/6 
  Installing       : python3-libsemanage-3.0-1.fc32.x86_64                  2/6 
  Installing       : python3-audit-3.0-0.16.20191104git1c2f876.fc32.x86_6   3/6 
  Installing       : checkpolicy-3.0-1.fc32.x86_64                          4/6 
  Installing       : python3-policycoreutils-3.0-1.fc32.noarch              5/6 
  Installing       : policycoreutils-python-utils-3.0-1.fc32.noarch         6/6 
  Running scriptlet: policycoreutils-python-utils-3.0-1.fc32.noarch         6/6 
  Verifying        : checkpolicy-3.0-1.fc32.x86_64                          1/6 
  Verifying        : policycoreutils-python-utils-3.0-1.fc32.noarch         2/6 
  Verifying        : python3-audit-3.0-0.16.20191104git1c2f876.fc32.x86_6   3/6 
  Verifying        : python3-libsemanage-3.0-1.fc32.x86_64                  4/6 
  Verifying        : python3-policycoreutils-3.0-1.fc32.noarch              5/6 
  Verifying        : python3-setools-4.2.2-3.fc32.x86_64                    6/6 
Installed products updated.

Installed:
  policycoreutils-python-utils-3.0-1.fc32.noarch                                
  checkpolicy-3.0-1.fc32.x86_64                                                 
  python3-audit-3.0-0.16.20191104git1c2f876.fc32.x86_64                         
  python3-libsemanage-3.0-1.fc32.x86_64                                         
  python3-policycoreutils-3.0-1.fc32.noarch                                     
  python3-setools-4.2.2-3.fc32.x86_64                                           

Complete!
corrupted double-linked list (not small)
48000 Aborted                 (core dumped) yum install /usr/sbin/semanage -y






sh-5.0# valgrind yum install /usr/sbin/semanage -y                                                                                                                                         
==107652== Memcheck, a memory error detector                                                              re                                                                               
==107652== Copyright (C) 2002-2017, and GNU GPL'd, by Julian Seward et al.                                                                                                                 
==107652== Using Valgrind-3.15.0 and LibVEX; rerun with -h for copyright info                                                                                                              
==107652== Command: /usr/bin/yum install /usr/sbin/semanage -y                                                                                                                             
==107652==                                                                                                                                                                                 
==107653== Warning: invalid file descriptor 1024 in syscall close()                                                                                                                        
==107653== Warning: invalid file descriptor 1025 in syscall close()                                                                                                                        
==107653== Warning: invalid file descriptor 1026 in syscall close()                                                                                                                        
==107653== Warning: invalid file descriptor 1027 in syscall close()                                                                                                                        
==107653==    Use --log-fd=<number> to select an alternative log fd.                                                                                                                       
==107653== Warning: invalid file descriptor 1028 in syscall close()                                                                                                                        
==107653== Warning: invalid file descriptor 1029 in syscall close()                                                                                                                        
Updating Subscription Management repositories.                                                                                                                                             
Unable to read consumer identity                                                                                                                                                           
This system is not registered to Red Hat Subscription Management. You can use subscription-manager to regi                                                                                 ster.                                                                                                                                                                                      
Last metadata expiration check: 1:28:25 ago on Wed 11 Dec 2019 05:11:55 AM EST.                                                                                                            
Dependencies resolved.                                                                                                                                                                     
==========================================================================================================                                                                                 
 Package                           Arch        Version                                 Repository    Size                                                                                  
==========================================================================================================                                                                                 
Installing:                                                                                                                                                                                
 policycoreutils-python-utils      noarch      3.0-1.fc32                              rawhide       84 k                                                                                  
Installing dependencies:                                                                                                                                                                   
 checkpolicy                       x86_64      3.0-1.fc32                              rawhide      330 k -0                                                                               
 python3-audit                     x86_64      3.0-0.16.20191104git1c2f876.fc32        rawhide       84 k                                                                                  
 python3-libsemanage               x86_64      3.0-1.fc32                              rawhide       84 k                                                                                  
 python3-policycoreutils           noarch      3.0-1.fc32                              rawhide      2.1 M                                                                                  
 python3-setools                   x86_64      4.2.2-3.fc32                            rawhide      647 k re                                                                               
                                                                                                                                                                                           
Transaction Summary                                                                                                                                                                        
==========================================================================================================                                                                                 
Install  6 Packages                                                                                                                                                                        
                                                                                                                                                                                           
Total download size: 3.3 M                                                                                                                                                                 
Installed size: 10 M                                                                                                                                                                       
Downloading Packages:                                                                                                                                                                      
(1/6): policycoreutils-python-utils-3.0-1.fc32.noarch.rpm                 265 kB/s |  84 kB     00:00                                                                                      
(2/6): python3-audit-3.0-0.16.20191104git1c2f876.fc32.x86_64.rpm          260 kB/s |  84 kB     00:00                                                                                      
(3/6): checkpolicy-3.0-1.fc32.x86_64.rpm                                  493 kB/s | 330 kB     00:00                                                                                      
(4/6): python3-libsemanage-3.0-1.fc32.x86_64.rpm                          283 kB/s |  84 kB     00:00                                                                                      
(5/6): python3-setools-4.2.2-3.fc32.x86_64.rpm                            1.4 MB/s | 647 kB     00:00                                                                                      
(6/6): python3-policycoreutils-3.0-1.fc32.noarch.rpm                      1.3 MB/s | 2.1 MB     00:01                                                                                      
----------------------------------------------------------------------------------------------------------                                                                                 
Total                                                                     841 kB/s | 3.3 MB     00:03                                                                                      
Running transaction check                                                                                                                                                                  
Transaction check succeeded.                                                                                                                                                               
Running transaction test                                                                                                                                                                   
Transaction test succeeded.                                                                                                                                                                
Running transaction
  Preparing        :                                                                                  1/1                                                                                  
  Installing       : python3-setools-4.2.2-3.fc32.x86_64                                              1/6    
  Installing       : python3-libsemanage-3.0-1.fc32.x86_64                                            2/6                                                                                  
  Installing       : python3-audit-3.0-0.16.20191104git1c2f876.fc32.x86_64                            3/6 -0                                                                               
  Installing       : checkpolicy-3.0-1.fc32.x86_64                                                    4/6                                                                                  
  Installing       : python3-policycoreutils-3.0-1.fc32.noarch                                        5/6                                                                                  
  Installing       : policycoreutils-python-utils-3.0-1.fc32.noarch                                   6/6                                                                                  
  Running scriptlet: policycoreutils-python-utils-3.0-1.fc32.noarch                                   6/6 re                                                                               
  Verifying        : checkpolicy-3.0-1.fc32.x86_64                                                    1/6                                                                                  
  Verifying        : policycoreutils-python-utils-3.0-1.fc32.noarch                                   2/6                                                                                  
  Verifying        : python3-audit-3.0-0.16.20191104git1c2f876.fc32.x86_64                            3/6                                                                                  
  Verifying        : python3-libsemanage-3.0-1.fc32.x86_64                                            4/6                                                                                  
  Verifying        : python3-policycoreutils-3.0-1.fc32.noarch                                        5/6                                                                                  
  Verifying        : python3-setools-4.2.2-3.fc32.x86_64                                              6/6                                                                                  
Installed products updated.                                                                                                                                                                
                                                                                                                                                                                           
Installed:                                                                                                                                                                                 
  policycoreutils-python-utils-3.0-1.fc32.noarch              checkpolicy-3.0-1.fc32.x86_64                                                                                                
  python3-audit-3.0-0.16.20191104git1c2f876.fc32.x86_64       python3-libsemanage-3.0-1.fc32.x86_64                                                                                        
  python3-policycoreutils-3.0-1.fc32.noarch                   python3-setools-4.2.2-3.fc32.x86_64                                                                                          
                                                                                                                                                                                           
Complete!                                                                                                                                                                                  
==107652== Invalid read of size 8                                                                                                                                                          
==107652==    at 0xC66D4F1: exit_librepo (in /usr/lib64/python3.8/site-packages/librepo/_librepo.so)                                                                                       
==107652==    by 0x4B23C66: ??? (in /usr/lib64/libpython3.8.so.1.0)                                                                                                                        
==107652==    by 0x4C8E2B7: Py_Exit (in /usr/lib64/libpython3.8.so.1.0)                                                                                                                    
==107652==    by 0x4C8E2FE: ??? (in /usr/lib64/libpython3.8.so.1.0)                                         
==107652==    by 0x4C8E418: PyErr_PrintEx (in /usr/lib64/libpython3.8.so.1.0)                               
==107652==    by 0x4B25491: ??? (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4C8F53E: Py_RunMain (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4C8F728: Py_BytesMain (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4878132: (below main) (in /usr/lib64/libc-2.30.9000.so)                                -0
==107652==  Address 0x5475160 is 16 bytes inside a block of size 936 free'd
==107652==    at 0x483AA0C: free (vg_replace_malloc.c:540)
==107652==    by 0x4C6A69B: ??? (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4B40675: ??? (in /usr/lib64/libpython3.8.so.1.0)                                       re
==107652==    by 0x4C7E921: _PyGC_CollectNoFail (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4C86EB3: PyImport_Cleanup (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4C8E185: Py_FinalizeEx (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4C8E2B7: Py_Exit (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4C8E2FE: ??? (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4C8E418: PyErr_PrintEx (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4B25491: ??? (in /usr/lib64/libpython3.8.so.1.0)                                         
==107652==    by 0x4C8F53E: Py_RunMain (in /usr/lib64/libpython3.8.so.1.0)                                  
==107652==    by 0x4C8F728: Py_BytesMain (in /usr/lib64/libpython3.8.so.1.0)                                
==107652==  Block was alloc'd at                                                                            
==107652==    at 0x483980B: malloc (vg_replace_malloc.c:309)                                                
==107652==    by 0x4B69772: PyType_GenericAlloc (in /usr/lib64/libpython3.8.so.1.0)                         
==107652==    by 0x4BBB0D8: ??? (in /usr/lib64/libpython3.8.so.1.0)                                         
==107652==    by 0x4B4E615: _PyObject_MakeTpCall (in /usr/lib64/libpython3.8.so.1.0)                        
==107652==    by 0x4BA0D96: PyObject_CallFunction (in /usr/lib64/libpython3.8.so.1.0)                       
==107652==    by 0x4C65CE9: PyErr_NewException (in /usr/lib64/libpython3.8.so.1.0)                          
==107652==    by 0xC66B437: init_exceptions (in /usr/lib64/python3.8/site-packages/librepo/_librepo.so)
==107652==    by 0xC66D8B7: PyInit__librepo (in /usr/lib64/python3.8/site-packages/librepo/_librepo.so)     
==107652==    by 0x4C8D79E: _PyImport_LoadDynamicModuleWithSpec (in /usr/lib64/libpython3.8.so.1.0)         
==107652==    by 0x4C8DB9C: ??? (in /usr/lib64/libpython3.8.so.1.0)                                         
==107652==    by 0x4B549BE: ??? (in /usr/lib64/libpython3.8.so.1.0)
==107652==    by 0x4B8A48F: PyVectorcall_Call (in /usr/lib64/libpython3.8.so.1.0)
==107652== 
==107652==                                                                                                -0
==107652== HEAP SUMMARY:
==107652==     in use at exit: 7,347,858 bytes in 96,391 blocks
==107652==   total heap usage: 3,750,438 allocs, 3,654,047 frees, 20,091,704,272 bytes allocated
==107652==                                                                                                re
==107652== LEAK SUMMARY:
==107652==    definitely lost: 191,016 bytes in 21 blocks
==107652==    indirectly lost: 119,683 bytes in 1,499 blocks
==107652==      possibly lost: 3,483,495 bytes in 63,015 blocks
==107652==    still reachable: 3,342,336 bytes in 30,109 blocks
==107652==                       of which reachable via heuristic:
==107652==                         newarray           : 1,536 bytes in 16 blocks                            
==107652==         suppressed: 0 bytes in 0 blocks                                                          
==107652== Rerun with --leak-check=full to see details of leaked memory                                     
==107652==                                                                                                  
==107652== Use --track-origins=yes to see where uninitialised values come from                              
==107652== For lists of detected and suppressed errors, rerun with: -s                                      
==107652== ERROR SUMMARY: 56 errors from 2 contexts (suppressed: 0 from 0)

Comment 10 Lukas Slebodnik 2020-01-06 14:26:48 UTC
The latest update is almost a month old.
I cannot see any link to upstream issue/patch/PR?

It is a quite annoying crash in rawhide.
Is there any update?

Comment 12 Lukáš Hrázký 2020-01-15 15:15:47 UTC
Sorry about the radio silence. I'll take it from here :)

Comment 13 Lukáš Hrázký 2020-01-16 16:41:45 UTC
Here's a full valgrind output without optimizations for librepo and with files and line numbers:

==32653== Invalid read of size 8
==32653==    at 0x18C6CBD1: _Py_DECREF (object.h:470)
==32653==    by 0x18C6CC46: _Py_XDECREF (object.h:541)
==32653==    by 0x18C6D10C: exit_librepo (librepomodule.c:138)
==32653==    by 0x4B2D68A: UnknownInlinedFun (pylifecycle.c:2285)
==32653==    by 0x4B2D68A: Py_FinalizeEx.cold (pylifecycle.c:1372)
==32653==    by 0x4B2D69C: Py_Exit (pylifecycle.c:2295)
==32653==    by 0x4B2D6D6: handle_system_exit (pythonrun.c:658)
==32653==    by 0x4B2D712: _PyErr_PrintEx (pythonrun.c:668)
==32653==    by 0x4B2F07F: UnknownInlinedFun (pythonrun.c:769)
==32653==    by 0x4B2F07F: PyRun_SimpleFileExFlags (pythonrun.c:434)
==32653==    by 0x4B2FB83: UnknownInlinedFun (main.c:381)
==32653==    by 0x4B2FB83: UnknownInlinedFun (main.c:565)
==32653==    by 0x4B2FB83: Py_RunMain.cold (main.c:644)
==32653==    by 0x4C8FE98: Py_BytesMain (main.c:698)
==32653==    by 0x487B062: (below main) (in /usr/lib64/libc-2.30.9000.so)
==32653==  Address 0x13690a60 is 16 bytes inside a block of size 936 free'd
==32653==    at 0x483BA0C: free (vg_replace_malloc.c:540)
==32653==    by 0x4C5B9AB: type_dealloc (typeobject.c:3362)
==32653==    by 0x4B49356: UnknownInlinedFun (object.h:478)
==32653==    by 0x4B49356: UnknownInlinedFun (gcmodule.c:953)
==32653==    by 0x4B49356: collect.constprop.0 (gcmodule.c:1123)
==32653==    by 0x4C80F61: _PyGC_CollectNoFail (gcmodule.c:1866)
==32653==    by 0x4C882D3: PyImport_Cleanup (import.c:541)
==32653==    by 0x4C8EE85: Py_FinalizeEx (pylifecycle.c:1240)
==32653==    by 0x4B2D69C: Py_Exit (pylifecycle.c:2295)
==32653==    by 0x4B2D6D6: handle_system_exit (pythonrun.c:658)
==32653==    by 0x4B2D712: _PyErr_PrintEx (pythonrun.c:668)
==32653==    by 0x4B2F07F: UnknownInlinedFun (pythonrun.c:769)
==32653==    by 0x4B2F07F: PyRun_SimpleFileExFlags (pythonrun.c:434)
==32653==    by 0x4B2FB83: UnknownInlinedFun (main.c:381)
==32653==    by 0x4B2FB83: UnknownInlinedFun (main.c:565)
==32653==    by 0x4B2FB83: Py_RunMain.cold (main.c:644)
==32653==    by 0x4C8FE98: Py_BytesMain (main.c:698)
==32653==  Block was alloc'd at
==32653==    at 0x483A80B: malloc (vg_replace_malloc.c:309)
==32653==    by 0x4B72642: UnknownInlinedFun (obmalloc.c:572)
==32653==    by 0x4B72642: UnknownInlinedFun (obmalloc.c:1628)
==32653==    by 0x4B72642: UnknownInlinedFun (obmalloc.c:1620)
==32653==    by 0x4B72642: UnknownInlinedFun (obmalloc.c:685)
==32653==    by 0x4B72642: UnknownInlinedFun (gcmodule.c:1964)
==32653==    by 0x4B72642: UnknownInlinedFun (gcmodule.c:1987)
==32653==    by 0x4B72642: PyType_GenericAlloc (typeobject.c:1012)
==32653==    by 0x4BC590A: type_new (typeobject.c:2565)
==32653==    by 0x4B57185: UnknownInlinedFun (typeobject.c:971)
==32653==    by 0x4B57185: _PyObject_MakeTpCall (call.c:159)
==32653==    by 0x4BAF076: UnknownInlinedFun (abstract.h:125)
==32653==    by 0x4BAF076: UnknownInlinedFun (abstract.h:115)
==32653==    by 0x4BAF076: UnknownInlinedFun (abstract.h:147)
==32653==    by 0x4BAF076: UnknownInlinedFun (call.c:940)
==32653==    by 0x4BAF076: PyObject_CallFunction (call.c:960)
==32653==    by 0x4C5975D: PyErr_NewException (errors.c:1025)
==32653==    by 0x18C69EBD: init_exceptions (exception-py.c:32)
==32653==    by 0x18C6D210: PyInit__librepo (librepomodule.c:202)
==32653==    by 0x4C8E49E: _PyImport_LoadDynamicModuleWithSpec (importdl.c:164)
==32653==    by 0x4C8E89C: UnknownInlinedFun (import.c:2220)
==32653==    by 0x4C8E89C: _imp_create_dynamic (import.c.h:330)
==32653==    by 0x4B5D4AE: cfunction_vectorcall_FASTCALL (methodobject.c:421)
==32653==    by 0x4B9667F: PyVectorcall_Call (call.c:199)

The error is in decreasing the refcount for LrErr_Exception. I couldn't actually find this documented, but from the output above it is pretty clear that the memory is allocated when PyErr_NewException is called and then deallocated by Python's garbage collector. I don't think the pointer is meant to be decref'd.

Comment 14 Lukáš Hrázký 2020-01-16 16:42:23 UTC
PR: https://github.com/rpm-software-management/librepo/pull/180

Comment 15 Jiri Hnidek 2020-01-21 14:57:15 UTC
Hi,
I thought that I already replied on this or similar bug report. Our dnf plugin is fully implemented in Python and it should not cause any segmentation faults.

Jiri

Comment 16 amatej 2020-02-06 13:27:03 UTC
The patch was release in rawhide in librepo-1.11.1-3.fc32.