Bug 763343 - (GLUSTER-1611) crash in gf_free
crash in gf_free
Status: CLOSED CURRENTRELEASE
Product: GlusterFS
Classification: Community
Component: glusterd (Show other bugs)
mainline
All Linux
low Severity high
: ---
: ---
Assigned To: Amar Tumballi
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-09-15 07:52 EDT by Anush Shetty
Modified: 2015-12-01 11:45 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: fuse
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Anush Shetty 2010-09-15 07:52:35 EDT
This crash was seen over rdma transport 

gdb) bt
#0  0x00000038b5271d71 in _int_free () from /lib64/libc.so.6
#1  0x00000038b527273b in free () from /lib64/libc.so.6
#2  0x00002b1e70c09758 in __gf_free (free_ptr=0x1d0dcfc8) at mem-pool.c:291
#3  0x00002b1e70bf1d83 in gf_timer_call_cancel (ctx=0x1d0a8010, event=0x1d0dcfc8) at timer.c:132
#4  0x00002b1e70e4b21d in rpc_clnt_reconnect (trans_ptr=0x2aaab0001a18) at rpc-clnt.c:378
#5  0x00002b1e70bf1f4f in gf_timer_proc (ctx=0x1d0a8010) at timer.c:177
#6  0x00000038b5a064a7 in start_thread () from /lib64/libpthread.so.0
#7  0x00000038b52d3c2d in clone () from /lib64/libc.so.6
(gdb) info thr
  5 Thread 4599  0x00000038b52d4018 in epoll_wait () from /lib64/libc.so.6
  4 Thread 4600  0x00000038b5a0e4e8 in do_sigwait () from /lib64/libpthread.so.0
  3 Thread 4601  0x00000038b5a0d5cb in read () from /lib64/libpthread.so.0
  2 Thread 4602  0x00000038b5a0d5cb in read () from /lib64/libpthread.so.0
* 1 Thread 4604  0x00000038b5271d71 in _int_free () from /lib64/libc.so.6
Comment 1 Amar Tumballi 2010-09-17 21:44:53 EDT
This crash is happening in 'free()', that means its a genuine case of double free. Just reviewing the code, and see that in 'fini()' of rdma.c we are not doing event_unregister() of the socket, which means, we may get stale events on the transport.
Comment 2 Vijay Bellur 2010-09-17 23:35:08 EDT
PATCH: http://patches.gluster.com/patch/4847 in master (rdma: do event_unregister() in fini() too.)

Note You need to log in before you can comment on or make changes to this bug.