Bug 766580 - corosync segfaults on normal exit (master branch)
Summary: corosync segfaults on normal exit (master branch)
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Corosync Cluster Engine
Classification: Retired
Component: unknown
Version: 1.4
Hardware: Unspecified
OS: Unspecified
medium
medium
Target Milestone: ---
Assignee: Angus Salkeld
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-12-12 11:22 UTC by Fabio Massimo Di Nitto
Modified: 2012-06-13 00:02 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-06-13 00:02:15 UTC

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Fabio Massimo Di Nitto 2011-12-12 11:22:39 UTC 
[root@fedora-master-node2 coro]# rpm -q -i libqb
Name        : libqb
Version     : 0.7.0
Release     : 1.fc17

start corosync:

[root@fedora-master-node2 coro]# corosync -f
(lots of output)
hit ctrl+c

Dec 12 12:21:13 notice  [MAIN  ] Corosync Cluster Engine exiting normally
Ringbuffer: 
 ->OVERWRITE
 ->write_pt [5687]
 ->read_pt [0]
 ->size [2097152 words]
 =>free [8365856 bytes]
 =>used [22748 bytes]
Segmentation fault

one node is enough, no iptables, no ip6tables, no selinux.

this is master branch built at 620b86d1ad019cbb51fe55a3c8de1efbb0e31c6d
Comment 1 Angus Salkeld 2011-12-12 22:27:09 UTC 
I can't reproduce this on Fedora 16.

rpm -q libqb
libqb-0.7.0-1.fc16.x86_64

and on corosync branch topic-quorum-fabbione
Comment 2 Angus Salkeld 2011-12-13 02:55:08 UTC 
OK, valgrind pointed out to me.

I was using the wrong loop variable.
Submitted upstream.

diff --git a/exec/logsys.c b/exec/logsys.c
index 158bf1a..0a44454 100644
--- a/exec/logsys.c
+++ b/exec/logsys.c
@@ -249,7 +249,7 @@ void logsys_system_fini (void)
        int f;
        for (i = 0; i < LOGSYS_MAX_SUBSYS_COUNT; i++) {
                free(logsys_loggers[i].logfile);
-               for (f = 0; i < logsys_loggers[i].file_idx; f++) {
+               for (f = 0; f < logsys_loggers[i].file_idx; f++) {
                        free(logsys_loggers[i].files[f]);
                }
        }
Note You need to log in before you can comment on or make changes to this bug.