Bug 220923 - python gets "double free or corruption" reported by glibc
python gets "double free or corruption" reported by glibc
Status: CLOSED RAWHIDE
Product: Fedora
Classification: Fedora
Component: pyxf86config (Show other bugs)
rawhide
All Linux
medium Severity medium
: ---
: ---
Assigned To: Adam Jackson
: Reopened
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2006-12-28 17:18 EST by Michal Jaegermann
Modified: 2007-11-30 17:11 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-01-11 10:21:00 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Michal Jaegermann 2006-12-28 17:18:46 EST
Description of problem:

This is a result of experiments with pungi-0.1.2-1.fc7. Repos used
in this are two disk directories, one with rpms from FC6 x86_64
release and the other with current FC6 updates. Metadata are created
with 'createrepo' runs and no sources at this time.

With configurations adjusted accordingly this runs at some moment
the following:

/usr/lib/anaconda-runtime/pkgorder /vols/l2/pungi/target/6.89/x86_64/os \
      x86_64 Fedora > /vols/l2/pungi/target/pkgorder-x86_64

With 2097 packages in /vols/l2/pungi/target/6.89/x86_64/os/Fedora the
above writes 2097 lines in pkgorder-x86_64 and stops with

*** glibc detected *** /usr/bin/python: double free or corruption (out):
 0x00002aaaaaae8080 ***

Nothing happens after that and attaching 'strace' to a process shows
that it stuck that way:

# strace -p 7945
Process 7945 attached - interrupt to quit
futex(0x3660947960, FUTEX_WAIT, 2, NULL

until it is killed.

Version-Release number of selected component (if applicable):
python-2.5-6.fc7

How reproducible:
I tried three time the command above and results every time were
precisly the same.
Comment 1 Brandon Rioja 2006-12-31 15:00:05 EST
I am also seeing this bug. This started happening after doing a "yum update"
with the development repos.


[root@localhost ~]# system-config-display 
*** glibc detected *** python2: free(): invalid pointer: 0xb7ebe2d0 ***
======= Backtrace: =========
/lib/libc.so.6[0x175ffd]
/lib/libc.so.6(cfree+0x90)[0x179650]
/usr/lib/python2.5/site-packages/ixf86configmodule.so[0x962429]
/usr/lib/libpython2.5.so.1.0[0xcbbcfd]
/usr/lib/libpython2.5.so.1.0(PyEval_EvalFrameEx+0x513e)[0xcf3a9e]
/usr/lib/libpython2.5.so.1.0(PyEval_EvalFrameEx+0x63cf)[0xcf4d2f]
/usr/lib/libpython2.5.so.1.0(PyEval_EvalFrameEx+0x63cf)[0xcf4d2f]
/usr/lib/libpython2.5.so.1.0(PyEval_EvalCodeEx+0x7ef)[0xcf5b7f]
/usr/lib/libpython2.5.so.1.0(PyEval_EvalCode+0x63)[0xcf5c03]
/usr/lib/libpython2.5.so.1.0[0xd0f496]
/usr/lib/libpython2.5.so.1.0(PyRun_FileExFlags+0x8e)[0xd0f54e]
/usr/lib/libpython2.5.so.1.0(PyRun_SimpleFileExFlags+0x198)[0xd10c08]
/usr/lib/libpython2.5.so.1.0(PyRun_AnyFileExFlags+0x7a)[0xd1136a]
/usr/lib/libpython2.5.so.1.0(Py_Main+0xa0d)[0xd1adfd]
python2(main+0x32)[0x8048582]
/lib/libc.so.6(__libc_start_main+0xdc)[0x125e5c]
python2[0x80484c1]
======= Memory map: ========
00110000-00259000 r-xp 00000000 fd:00 360469     /lib/libc-2.5.90.so
00259000-0025b000 r-xp 00149000 fd:00 360469     /lib/libc-2.5.90.so
0025b000-0025c000 rwxp 0014b000 fd:00 360469     /lib/libc-2.5.90.so
0025c000-0025f000 rwxp 0025c000 00:00 0 
0025f000-00284000 r-xp 00000000 fd:00 1608145   
/usr/lib/python2.5/site-packages/gtk-2.0/gobject/_gobject.so
00284000-00287000 rwxp 00024000 fd:00 1608145   
/usr/lib/python2.5/site-packages/gtk-2.0/gobject/_gobject.so
00287000-002c5000 r-xp 00000000 fd:00 360518     /lib/libgobject-2.0.so.0.1200.6
002c5000-002c6000 rwxp 0003e000 fd:00 360518     /lib/libgobject-2.0.so.0.1200.6
002c6000-002ca000 r-xp 00000000 fd:00 360520     /lib/libgthread-2.0.so.0.1200.6
002ca000-002cb000 rwxp 00003000 fd:00 360520     /lib/libgthread-2.0.so.0.1200.6
002cb000-002ce000 r-xp 00000000 fd:00 1381283   
/usr/lib/python2.5/lib-dynload/timemodule.so
002ce000-002d0000 rwxp 00002000 fd:00 1381283   
/usr/lib/python2.5/lib-dynload/timemodule.so
002d0000-002d3000 r-xp 00000000 fd:00 1381238   
/usr/lib/python2.5/lib-dynload/_localemodule.so
002d3000-002d4000 rwxp 00003000 fd:00 1381238   
/usr/lib/python2.5/lib-dynload/_localemodule.so
002d4000-002da000 r-xp 00000000 fd:00 1381271   
/usr/lib/python2.5/lib-dynload/operator.so
002da000-002db000 rwxp 00006000 fd:00 1381271   
/usr/lib/python2.5/lib-dynload/operator.so
002db000-002ed000 r-xp 00000000 fd:00 855691     /usr/lib/libz.so.1.2.3
002ed000-002ee000 rwxp 00011000 fd:00 855691     /usr/lib/libz.so.1.2.3
002ee000-002ef000 r-xp 00000000 fd:00 1608070   
/usr/lib/python2.5/site-packages/rhpl/_translate.so
002ef000-002f0000 rwxp 00000000 fd:00 1608070   
/usr/lib/python2.5/site-packages/rhpl/_translate.so
002f0000-002f3000 r-xp 00000000 fd:00 857611     /usr/lib/libXrandr.so.2.0.0
002f3000-002f4000 rwxp 00002000 fd:00 857611     /usr/lib/libXrandr.so.2.0.0
002f4000-00303000 r-xp 00000000 fd:00 866757     /usr/lib/libXext.so.6.4.0
00303000-00304000 rwxp 0000e000 fd:00 866757     /usr/lib/libXext.so.6.4.0
00366000-0036e000 r-xp 00000000 fd:00 857584     /usr/lib/libXrender.so.1.3.0
0036e000-0036f000 rwxp 00007000 fd:00 857584     /usr/lib/libXrender.so.1.3.0
0037b000-0037d000 r-xp 00000000 fd:00 360516     /lib/libgmodule-2.0.so.0.1200.6
0037d000-0037e000 rwxp 00002000 fd:00 360516     /lib/libgmodule-2.0.so.0.1200.6
0037e000-00491000 r-xp 00000000 fd:00 1608099   
/usr/lib/python2.5/site-packages/rhpl/iconv.so
00491000-004b7000 rwxp 00112000 fd:00 1608099   
/usr/lib/python2.5/site-packages/rhpl/iconv.so
004b7000-004bc000 rwxp 004b7000 00:00 0 
004fa000-00500000 r-xp 00000000 fd:00 1381247   
/usr/lib/python2.5/lib-dynload/_struct.so
00500000-00501000 rwxp 00006000 fd:00 1381247   
/usr/lib/python2.5/lib-dynload/_struct.so
00506000-00507000 r-xp 00506000 00:00 0          [vdso]
00583000-0059e000 r-xp 00000000 fd:00 360457     /lib/ld-2.5.90.so
0059e000-0059f000 r-xp 0001a000 fd:00 360457     /lib/ld-2.5.90.so
0059f000-005a0000 rwxp 0001b000 fd:00 360457     /lib/ld-2.5.90.so
005cc000-005ce000 r-xp 00000000 fd:00 360504     /lib/libutil-2.5.90.so
005ce000-005cf000 r-xp 00001000 fd:00 360504     /lib/libutil-2.5.90.so
005cf000-005d0000 rwxp 00002000 fd:00 360504     /lib/libutil-2.5.90.so
005ef000-005f2000 r-xp 00000000 fd:00 360478     /lib/libdl-2.5.90.so
005f2000-005f3000 r-xp 00002000 fd:00 360478     /lib/libdl-2.5.90.so
005f3000-005f4000 rwxp 00003000 fd:00 360478     /lib/libdl-2.5.90.so
005f4000-00707000 r-xp 00000000 fd:00 1675837   
/usr/lib/python2.5/site-packages/rhpxl/_pyrandr.so
00707000-0072c000 rwxp 00113000 fd:00 1675837   
/usr/lib/python2.5/site-packages/rhpxl/_pyrandr.so
0072c000-00732000 rwxp 0072c000 00:00 0 
007b0000-007ce000 r-xp 00000000 fd:00 1383241   
/usr/lib/python2.5/site-packages/_kudzumodule.so
007ce000-007cf000 rwxp 0001e000 fd:00 1383241   
/usr/lib/python2.5/site-packages/_kudzumodule.so
007e4000-007e8000 r-xp 00000000 fd:00 1381287   
/usr/lib/python2.5/lib-dynload/zlibmodule.so
007e8000-007e9000 rwxp 00004000 fd:00 1381287   
/usr/lib/python2.5/lib-dynload/zlibmodule.so
0081d000-00821000 r-xp 00000000 fd:00 1381252   
/usr/lib/python2.5/lib-dynload/binascii.so
00821000-00822000 rwxp 00003000 fd:00 1381252   
/usr/lib/python2.5/lib-dynload/binascii.so
0085b000-0085e000 r-xp 00000000 fd:00 1381262   
/usr/lib/python2.5/lib-dynload/fcntlmodule.so
0085e000-0085f000 rwxp 00003000 fd:00 1381262   
/usr/lib/python2.5/lib-dynload/fcntlmodule.so
00888000-0089c000 r-xp 00000000 fd:00 360496     /lib/libpthread-2.5.90.so
0089c000-0089d000 r-xp 00013000 fd:00 360496     /lib/libpthread-2.5.90.so
0089d000-0089e000 rwxp 00014000 fd:00 360496     /lib/libpthread-2.5.90.so
0089e000-008a0000 rwxp 0089e000 00:00 0 
0095a000-00974000 r-xp 00000000 fd:00 1379730   
/usr/lib/python2.5/site-packages/ixf86configmodule.so
00974000-00978000 rwxp 0001a000 fd:00 1379730   
/usr/lib/python2.5/site-packages/ixf86configmodule.so
009ea000-009ee000 r-xp 00000000 fd:00 1381280   
/usr/lib/python2.5/lib-dynload/stropmodule.so
009ee000-009f0000 rwxp 00003000 fd:00 1381280   
/usr/lib/python2.5/lib-dynload/stropmodule.so
00adb000-00b02000 r-xp 00000000 fd:00 360480     /lib/libm-2.5.90.so
00b02000-00b03000 r-xp 00026000 fd:00 360480     /lib/libm-2.5.90.so
00b03000-00b04000 rwxp 00027000 fd:00 360480     /lib/libm-2.5.90.so
00b14000-00b1b000 r-xp 00000000 fd:00 360500     /lib/librt-2.5.90.so
00b1b000-00b1c000 r-xp 00006000 fd:00 360500     /lib/librt-2.5.90.so
00b1c000-00b1d000 rwxp 00007000 fd:00 360500     /lib/librt-2.5.90.so
00b1f000-00b22000 r-xp 00000000 fd:00 1381278   
/usr/lib/python2.5/lib-dynload/selectmodule.so
00b22000-00b23000 rwxp 00002000 fd:00 1381278   
/usr/lib/python2.5/lib-dynload/selectmodule.so
00b83000-00b85000 r-xp 00000000 fd:00 1381242   
/usr/lib/python2.5/lib-dynload/_randommodule.so
00b85000-00b86000 rwxp 00002000 fd:00 1381242   
/usr/lib/python2.5/lib-dynload/_randommodule.so
00be8000-00bf3000 r-xp 00000000 fd:00 557603     /lib/libgcc_s-4.1.1-20061220.so.1
00bf3000-00bf4000 rwxp 0000a000 fd:00 557603     /lib/libgcc_s-4.1.1-20061220.so.1
00c11000-00c13000 r-xp 00000000 fd:00 856040     /usr/lib/libXau.so.6.0.0
00c13000-00c14000 rwxp 00001000 fd:00 856040     /usr/lib/libXau.so.6.0.0
00c53000-00d6b000 r-xp 00000000 fd:00 879834     /usr/lib/libpython2.5.so.1.0
00d6b000-00d91000 rwxp 00117000 fd:00 879834     /usr/lib/libpython2.5.so.1.0
00d91000-00d97000 rwxp 00d91000 00:00 0 
00dfd000-00e9a000 r-xp 00000000 fd:00 360514     /lib/libglib-2.0.so.0.1200.6
00e9a000-00e9b000 rwxp 0009d000 fd:00 360514     /lib/libglib-2.0.so.0.1200.6
00f2f000-00f34000 r-xp 00000000 fd:00 856105     /usr/lib/libXdmcp.so.6.0.0
00f34000-00f35000 rwxp 00004000 fd:00 856105     /usr/lib/libXdmcp.so.6.0.0
00f76000-00f79000 r-xp 00000000 fd:00 1381268   
/usr/lib/python2.5/lib-dynload/mathmodule.so
00f79000-00f7a000 rwxp 00002000 fd:00 1381268   
/usr/lib/python2.5/lib-dynload/mathmodule.so
00f7a000-01078000 r-xp 00000000 fd:00 871708     /usr/lib/libX11.so.6.2.0
01078000-0107c000 rwxp 000fd000 fd:00 871708     /usr/lib/libX11.so.6.2.0
08048000-08049000 r-xp 00000000 fd:00 878431     /usr/bin/python
08049000-0804a000 rw-p 00000000 fd:00 878431     /usr/bin/python
089de000-08b93000 rw-p 089de000 00:00 0 
b7b00000-b7b21000 rw-p b7b00000 00:00 0 
b7b21000-b7c00000 ---p b7b21000 00:00 0 
b7c7b000-b7cbc000 rw-p b7c7b000 00:00 0 
b7cbd000-b7ebd000 r--p 00000000 fd:00 866895     /usr/lib/locale/locale-archive
b7ebd000-b7f42000 rw-p b7ebd000 00:00 0 
b7f50000-b7f57000 r--s 00000000 fd:00 920768     /usr/lib/gconv/gconv-modules.cache
bf89e000-bf8b4000 rw-p bf89e000 00:00 0          [stack]
/usr/share/system-config-display/system-config-display: line 2:  3049 Aborted  
              python2 /usr/share/system-config-display/xconf.py $@
[root@localhost ~]# 
Comment 2 Jeremy Katz 2007-01-06 15:38:06 EST
This is being caused by pyxf86config allocating memory with PyObject_Malloc and
then freeing it with PyMem_DEL.  In python 2.5, these actually have a
differences (so that the interpreter can return memory to the system).

Fixed in pyxf86config-0.3.32
Comment 3 Michal Jaegermann 2007-01-10 22:18:57 EST
anaconda-11.2.0.8-1 from the last updates has the following in changelog:
- python2.5 fixes
and comment #2 suggests that this is fixed.  Still the same
'pkgorder' command as quoted in the original report gets

*** glibc detected *** /usr/bin/python: double free or corruption (out):
 0x00002aaaaaae8080 ***

and a hang.  Killing it at this moment actually allows pungi to
finish its job.

Comment 4 Jeremy Katz 2007-01-11 10:21:00 EST
> and comment #2 suggests that this is fixed.  Still the same
> 'pkgorder' command as quoted in the original report gets
> 
> *** glibc detected *** /usr/bin/python: double free or corruption (out):
>  0x00002aaaaaae8080 ***
> 
> and a hang.  Killing it at this moment actually allows pungi to
> finish its job.

This is a different manifestation of a similar problem; today's pyparted should
fix it

Note You need to log in before you can comment on or make changes to this bug.