Bug 1783169
| Summary: | [abrt] [faf] sssd: _dbus_list_unlink(): /usr/libexec/sssd/sssd_be killed by 11 | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Madhuri <mupadhye> |
| Component: | sssd | Assignee: | Alexey Tikhonov <atikhono> |
| Status: | CLOSED DUPLICATE | QA Contact: | sssd-qe <sssd-qe> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 8.1 | CC: | aboscatt, atikhono, dking, grajaiya, jhrozek, lslebodn, mzidek, pbrezina, sgoveas, sumenon, tscherf, vkreuk |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| URL: | http://faf.lab.eng.brq.redhat.com/faf/reports/bthash/f9cd7a3e9c5e365f6af3b6ea751516a60f67b1af/ | ||
| Whiteboard: | sync-to-jira | ||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2021-06-13 07:30:15 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Madhuri
2019-12-13 07:50:20 UTC
(In reply to Alexey Tikhonov from comment #2) > But it is very similar to bz 1628126 / > https://github.com/SSSD/sssd/pull/646#issuecomment-419115356 Right, this is the same case as in https://github.com/SSSD/sssd/pull/646#issuecomment-419115356 In regards of BZ 1628126 - I think it was linked to that upstream PR/ticket by a mistake. #0 _dbus_list_unlink (list=0x562438401240, link=link@entry=0x0) at ../../dbus/dbus-list.c:502
#1 0x00007f2c69d0c75d in _dbus_list_remove_link (list=<optimized out>, link=0x0) at ../../dbus/dbus-list.c:530
#2 0x00007f2c69cfb0f5 in _dbus_message_remove_counter (message=message@entry=0x5624384011d0, counter=0x56243838a360) at ../../dbus/dbus-message.c:384
#3 0x00007f2c69cee581 in free_outgoing_message (element=0x5624384011d0, data=<optimized out>) at ../../dbus/dbus-connection.c:2704
#4 0x00007f2c69cf00f5 in _dbus_connection_last_unref (connection=0x5624383fd0c0) at ../../dbus/dbus-connection.c:2764
#5 0x00007f2c69cf0781 in dbus_connection_unref (connection=<optimized out>) at ../../dbus/dbus-connection.c:2842
#6 0x00007f2c6a56e381 in sbus_connection_release (conn=0x5624383df010, conn=0x5624383df010) at src/sbus/connection/sbus_connection.c:56
#7 sbus_connection_destructor (conn=conn@entry=0x5624383df010) at src/sbus/connection/sbus_connection.c:73
#8 0x00007f2c69f3325b in _tc_free_internal (location=0x7f2c6a5862e8 "src/sbus/connection/sbus_connection.c:438", tc=0x5624383defb0)
at ../../talloc.c:1137
#9 _talloc_free_internal (location=0x7f2c6a5862e8 "src/sbus/connection/sbus_connection.c:438", ptr=0x5624383df010) at ../../talloc.c:1227
#10 _talloc_free (ptr=0x5624383df010, location=0x7f2c6a5862e8 "src/sbus/connection/sbus_connection.c:438") at ../../talloc.c:1769
#11 0x00007f2c6a14e279 in tevent_common_invoke_timer_handler (te=te@entry=0x56243843ed00, current_time=..., removed=removed@entry=0x0)
at ../../tevent_timed.c:370
#12 0x00007f2c6a14e41e in tevent_common_loop_timer_delay (ev=ev@entry=0x56243833fce0) at ../../tevent_timed.c:442
...
(gdb) frame 6
#6 0x00007f2c6a56e381 in sbus_connection_release (conn=0x5624383df010, conn=0x5624383df010) at src/sbus/connection/sbus_connection.c:56
56 dbus_connection_unref(conn->connection);
(gdb) p conn->connection
$19 = (DBusConnection *) 0x5624383fd0c0
(gdb) p *conn->connection
$13 = {refcount = {value = 0}, mutex = 0x56243838ded0, dispatch_mutex = 0x5624383a7a90, dispatch_cond = 0x562438350690, io_path_mutex = 0x56243839deb0, io_path_cond = 0x5624383feee0, outgoing_messages = 0x562438378790, incoming_messages = 0x5624383787c0, expired_messages = 0x0, message_borrowed = 0x0, n_outgoing = 1, n_incoming = 2, outgoing_counter = 0x56243838a360, transport = 0x562438434aa0, watches = 0x0, timeouts = 0x0, filter_list = 0x0, slot_mutex = 0x5624383b1750, slot_list = {slots = 0x0, n_slots = 0}, pending_replies = 0x0, client_serial = 6, disconnect_message_link = 0x5624383787a8, wakeup_main_function = 0x0, wakeup_main_data = 0x0, free_wakeup_main_data = 0x0, dispatch_status_function = 0x0, dispatch_status_data = 0x0, free_dispatch_status_data = 0x0, last_dispatch_status = DBUS_DISPATCH_DATA_REMAINS, objects = 0x562438323e10, server_guid = 0x0, dispatch_acquired = 0, io_path_acquired = 0, shareable = 0, exit_on_disconnect = 0, route_peer_messages = 0, disconnected_message_arrived = 0, disconnected_message_processed = 0, have_connection_lock = 0, generation = 1}
This is the last frame within SSSD code. Everything else happens inside libdbus.
(gdb) frame 5
#5 0x00007f2c69cf0781 in dbus_connection_unref (connection=<optimized out>) at ../../dbus/dbus-connection.c:2842
2842 _dbus_connection_last_unref (connection);
(gdb) frame 4
#4 0x00007f2c69cf00f5 in _dbus_connection_last_unref (connection=0x5624383fd0c0) at ../../dbus/dbus-connection.c:2764
2764 _dbus_list_foreach (&connection->outgoing_messages,
(gdb) frame 3
#3 0x00007f2c69cee581 in free_outgoing_message (element=0x5624384011d0, data=<optimized out>) at ../../dbus/dbus-connection.c:2704
2704 _dbus_message_remove_counter (message, connection->outgoing_counter);
(gdb) p *message
$16 = {refcount = {value = 0}, header = {data = {dummy1 = 0x56243836e990, dummy2 = 48, dummy3 = 168, dummy_bit1 = 0, dummy_bit2 = 0, dummy_bit3 = 0, dummy_bits = 0}, fields = {{value_pos = -1}, {value_pos = -1}, {value_pos = -1}, {value_pos = -1}, {value_pos = -1}, { value_pos = -1}, {value_pos = -1}, {value_pos = -1}, {value_pos = -1}, {value_pos = -1}}, padding = 0, byte_order = 0}, body = {dummy1 = 0x5624383d2b60, dummy2 = 0, dummy3 = 80, dummy_bit1 = 0, dummy_bit2 = 0, dummy_bit3 = 0, dummy_bits = 0}, locked = 1, in_cache = 1, counters = 0x0, size_counter_delta = 48, changed_stamp = 0, slot_list = {slots = 0x562438323ed0, n_slots = 1}, generation = 1, unix_fds = 0x0, n_unix_fds = 0, n_unix_fds_allocated = 0, unix_fd_counter_delta = 0}
(gdb) frame 2
#2 0x00007f2c69cfb0f5 in _dbus_message_remove_counter (message=message@entry=0x5624384011d0, counter=0x56243838a360)
at ../../dbus/dbus-message.c:384
384 _dbus_list_remove_link (&message->counters, link);
(gdb) list
379
380 link = _dbus_list_find_last (&message->counters,
381 counter);
382 _dbus_assert (link != NULL);
383
384 _dbus_list_remove_link (&message->counters, link);
385
386 _dbus_counter_adjust_size (counter, - message->size_counter_delta);
387
388 #ifdef HAVE_UNIX_FD_PASSING
(gdb) frame 1
#1 0x00007f2c69d0c75d in _dbus_list_remove_link (list=<optimized out>, link=0x0) at ../../dbus/dbus-list.c:530
530 _dbus_list_unlink (list, link);
(gdb) p link
$18 = (DBusList *) 0x0
(gdb) frame 0
#0 _dbus_list_unlink (list=0x562438401240, link=link@entry=0x0) at ../../dbus/dbus-list.c:502
502 if (link->next == link)
So it looks like in the frame #2 `_dbus_message_remove_counter()::_dbus_list_find_last()` returns 0 and this 0 is dereferenced in frame 0.
(as was explained in https://bugzilla.redhat.com/show_bug.cgi?id=1752730#c7 "Assertions are disabled in the dbus package.")
David, could you please take a look at this backtrace?
Is it possible SSSD uses libdbus in a wrong way?
Please tell me if there is additional information from coredump required.
(gdb) frame 2
#2 0x00007f2c69cfb0f5 in _dbus_message_remove_counter (message=message@entry=0x5624384011d0, counter=0x56243838a360)
at ../../dbus/dbus-message.c:384
384 _dbus_list_remove_link (&message->counters, link);
(gdb) list
379
380 link = _dbus_list_find_last (&message->counters,
381 counter);
...
(gdb) p message->counters
$3 = (DBusList *) 0x0
_dbus_list_find_last(&0,...) -> _dbus_list_get_last_link(&0):
```
_dbus_list_get_last_link (DBusList **list)
{
if (*list == NULL)
return NULL;
```
So the problem is message->counters = 0.
Is there anything SSSD can do wrong that leads to this situation or is it libdbus internal bug?
*** Bug 1846395 has been marked as a duplicate of this bug. *** *** Bug 1849890 has been marked as a duplicate of this bug. *** *** Bug 1861233 has been marked as a duplicate of this bug. *** After evaluating this issue, there are no plans to address it further or fix it in an upcoming release. Therefore, it is being closed. If plans change such that this issue will be fixed in an upcoming release, then the bug can be reopened. *** This bug has been marked as a duplicate of bug 1752730 *** |