* trinity: lots of free(): invalid pointer
@ 2014-01-15 22:37 Jiri Slaby
2014-01-17 19:09 ` Dave Jones
0 siblings, 1 reply; 5+ messages in thread
From: Jiri Slaby @ 2014-01-15 22:37 UTC (permalink / raw)
To: Dave Jones; +Cc: trinity
Hi Dave,
I see lots of $SUBJ generated by the current snapshot of trinity.
0x4120ae below is free in the loop in post_move_pages. So this is
perhaps introduced with one of:
commit ae3b98fcbf52c808b0a3eb4eb5311c9fdf433f55
Author: Dave Jones <davej@redhat.com>
Date: Wed Jan 8 11:08:22 2014 -0500
only allocate page_types array once
commit 2a749813619348b3bfd144fe04488f698d83accc
Author: Dave Jones <davej@redhat.com>
Date: Tue Jan 7 12:11:11 2014 -0500
teach move_pages about the maps list
Any ideas?
*** Error in `trinity': free(): invalid pointer: 0x000000000276d000 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7406f)[0x7fd8d165606f]
/lib64/libc.so.6(+0x7986e)[0x7fd8d165b86e]
/lib64/libc.so.6(+0x7a557)[0x7fd8d165c557]
trinity[0x4120ae]
trinity[0x40abc8]
trinity[0x40dabc]
trinity[0x40338a]
trinity[0x40705c]
trinity[0x402c47]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7fd8d1603b25]
trinity[0x402f13]
======= Memory map: ========
00400000-0042a000 r-xp 00000000 08:01 32548
/usr/bin/trinity
00629000-0062a000 r--p 00029000 08:01 32548
/usr/bin/trinity
0062a000-0068e000 rw-p 0002a000 08:01 32548
/usr/bin/trinity
01f76000-01f97000 rw-p 00000000 00:00 0
[heap]
01f97000-01fb8000 rw-p 00000000 00:00 0
[heap]
01fb8000-01fd9000 rw-p 00000000 00:00 0
[heap]
01fd9000-01ffa000 rw-p 00000000 00:00 0
[heap]
01ffa000-0201b000 rw-p 00000000 00:00 0
[heap]
0201b000-0203c000 rw-p 00000000 00:00 0
[heap]
0203c000-0205d000 rw-p 00000000 00:00 0
[heap]
0205d000-0207e000 rw-p 00000000 00:00 0
[heap]
0207e000-0209f000 rw-p 00000000 00:00 0
[heap]
0209f000-020c0000 rw-p 00000000 00:00 0
[heap]
020c0000-020e1000 rw-p 00000000 00:00 0
[heap]
020e1000-02102000 rw-p 00000000 00:00 0
[heap]
02102000-02123000 rw-p 00000000 00:00 0
[heap]
02123000-02144000 rw-p 00000000 00:00 0
[heap]
02144000-02165000 rw-p 00000000 00:00 0
[heap]
02165000-02186000 rw-p 00000000 00:00 0
[heap]
02186000-021a9000 rw-p 00000000 00:00 0
[heap]
021a9000-021cc000 rw-p 00000000 00:00 0
[heap]
021cc000-021ef000 rw-p 00000000 00:00 0
[heap]
021ef000-02211000 rw-p 00000000 00:00 0
[heap]
02211000-02233000 rw-p 00000000 00:00 0
[heap]
02233000-02255000 rw-p 00000000 00:00 0
[heap]
02255000-02277000 rw-p 00000000 00:00 0
[heap]
02277000-02299000 rw-p 00000000 00:00 0
[heap]
02299000-022bb000 rw-p 00000000 00:00 0
[heap]
022bb000-022dd000 rw-p 00000000 00:00 0
[heap]
022dd000-022fe000 rw-p 00000000 00:00 0
[heap]
022fe000-02320000 rw-p 00000000 00:00 0
[heap]
02320000-02342000 rw-p 00000000 00:00 0
[heap]
02342000-02346000 rw-p 00000000 00:00 0
[heap]
02346000-02367000 rw-p 00000000 00:00 0
[heap]
02367000-02387000 rw-p 00000000 00:00 0
[heap]
02387000-0239f000 rw-p 00000000 00:00 0
[heap]
0239f000-023a8000 rw-p 00000000 00:00 0
[heap]
023a8000-023c8000 rw-p 00000000 00:00 0
[heap]
023c8000-023d9000 rw-p 00000000 00:00 0
[heap]
023d9000-023e1000 rw-p 00000000 00:00 0
[heap]
023e1000-02402000 rw-p 00000000 00:00 0
[heap]
02402000-0241a000 rw-p 00000000 00:00 0
[heap]
0241a000-02433000 rw-p 00000000 00:00 0
[heap]
02433000-02453000 rw-p 00000000 00:00 0
[heap]
02453000-0246d000 rw-p 00000000 00:00 0
[heap]
0246d000-02485000 rw-p 00000000 00:00 0
[heap]
--
js
suse labs
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: trinity: lots of free(): invalid pointer
2014-01-15 22:37 trinity: lots of free(): invalid pointer Jiri Slaby
@ 2014-01-17 19:09 ` Dave Jones
2014-01-20 19:31 ` Jiri Slaby
0 siblings, 1 reply; 5+ messages in thread
From: Dave Jones @ 2014-01-17 19:09 UTC (permalink / raw)
To: Jiri Slaby; +Cc: trinity
On Wed, Jan 15, 2014 at 11:37:57PM +0100, Jiri Slaby wrote:
> Hi Dave,
>
> I see lots of $SUBJ generated by the current snapshot of trinity.
> 0x4120ae below is free in the loop in post_move_pages. So this is
> perhaps introduced with one of:
> commit ae3b98fcbf52c808b0a3eb4eb5311c9fdf433f55
> Author: Dave Jones <davej@redhat.com>
> Date: Wed Jan 8 11:08:22 2014 -0500
>
> only allocate page_types array once
>
> commit 2a749813619348b3bfd144fe04488f698d83accc
> Author: Dave Jones <davej@redhat.com>
> Date: Tue Jan 7 12:11:11 2014 -0500
>
> teach move_pages about the maps list
>
>
> Any ideas?
I rewrote a bunch of that code a few days ago, are you still seeing it ?
I'm not able to reproduce it here. A run with -c move_pages runs and runs.
Dave
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: trinity: lots of free(): invalid pointer
2014-01-17 19:09 ` Dave Jones
@ 2014-01-20 19:31 ` Jiri Slaby
2014-01-20 19:51 ` Jiri Slaby
0 siblings, 1 reply; 5+ messages in thread
From: Jiri Slaby @ 2014-01-20 19:31 UTC (permalink / raw)
To: Dave Jones; +Cc: trinity
On 01/17/2014 08:09 PM, Dave Jones wrote:
> On Wed, Jan 15, 2014 at 11:37:57PM +0100, Jiri Slaby wrote:
> > Hi Dave,
> >
> > I see lots of $SUBJ generated by the current snapshot of trinity.
> > 0x4120ae below is free in the loop in post_move_pages. So this is
> > perhaps introduced with one of:
> > commit ae3b98fcbf52c808b0a3eb4eb5311c9fdf433f55
> > Author: Dave Jones <davej@redhat.com>
> > Date: Wed Jan 8 11:08:22 2014 -0500
> >
> > only allocate page_types array once
> >
> > commit 2a749813619348b3bfd144fe04488f698d83accc
> > Author: Dave Jones <davej@redhat.com>
> > Date: Tue Jan 7 12:11:11 2014 -0500
> >
> > teach move_pages about the maps list
> >
> >
> > Any ideas?
>
> I rewrote a bunch of that code a few days ago, are you still seeing it ?
> I'm not able to reproduce it here. A run with -c move_pages runs and runs.
Yeah, I still see it with the current snapshot. But, not with move_pages
anymore, it seems. There had to be more sources, the current one is
(with -x move_pages):
*** Error in `trinity': double free or corruption (top):
0x00000000014f9bc0 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x740af)[0x7f0c48ba30af]
/lib64/libc.so.6(+0x798de)[0x7f0c48ba88de]
/lib64/libc.so.6(+0x7a5e6)[0x7f0c48ba95e6]
trinity[0x40abc8]
trinity[0x40dabc]
trinity[0x40338a]
trinity[0x40704c]
trinity[0x402c47]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f0c48b50b15]
trinity[0x402f13]
The topmost trinity item 0x40abc8 is "entry->post(childno)". There seems
to be a lost/optimized-out frame between this call and libc :/.
thanks,
--
js
suse labs
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: trinity: lots of free(): invalid pointer
2014-01-20 19:31 ` Jiri Slaby
@ 2014-01-20 19:51 ` Jiri Slaby
2014-01-20 21:37 ` Dave Jones
0 siblings, 1 reply; 5+ messages in thread
From: Jiri Slaby @ 2014-01-20 19:51 UTC (permalink / raw)
To: Dave Jones; +Cc: trinity
On 01/20/2014 08:31 PM, Jiri Slaby wrote:
> On 01/17/2014 08:09 PM, Dave Jones wrote:
>> On Wed, Jan 15, 2014 at 11:37:57PM +0100, Jiri Slaby wrote:
>> > Hi Dave,
>> >
>> > I see lots of $SUBJ generated by the current snapshot of trinity.
>> > 0x4120ae below is free in the loop in post_move_pages. So this is
>> > perhaps introduced with one of:
>> > commit ae3b98fcbf52c808b0a3eb4eb5311c9fdf433f55
>> > Author: Dave Jones <davej@redhat.com>
>> > Date: Wed Jan 8 11:08:22 2014 -0500
>> >
>> > only allocate page_types array once
>> >
>> > commit 2a749813619348b3bfd144fe04488f698d83accc
>> > Author: Dave Jones <davej@redhat.com>
>> > Date: Tue Jan 7 12:11:11 2014 -0500
>> >
>> > teach move_pages about the maps list
>> >
>> >
>> > Any ideas?
>>
>> I rewrote a bunch of that code a few days ago, are you still seeing it ?
>> I'm not able to reproduce it here. A run with -c move_pages runs and runs.
>
> Yeah, I still see it with the current snapshot. But, not with move_pages
> anymore, it seems. There had to be more sources, the current one is
> (with -x move_pages):
> *** Error in `trinity': double free or corruption (top):
> 0x00000000014f9bc0 ***
> ======= Backtrace: =========
> /lib64/libc.so.6(+0x740af)[0x7f0c48ba30af]
> /lib64/libc.so.6(+0x798de)[0x7f0c48ba88de]
> /lib64/libc.so.6(+0x7a5e6)[0x7f0c48ba95e6]
> trinity[0x40abc8]
> trinity[0x40dabc]
> trinity[0x40338a]
> trinity[0x40704c]
> trinity[0x402c47]
> /lib64/libc.so.6(__libc_start_main+0xf5)[0x7f0c48b50b15]
> trinity[0x402f13]
>
> The topmost trinity item 0x40abc8 is "entry->post(childno)". There seems
> to be a lost/optimized-out frame between this call and libc :/.
Ok, -Og looks better:
/lib64/libc.so.6(+0x740af)[0x7f4192eba0af]
/lib64/libc.so.6(+0x798de)[0x7f4192ebf8de]
/lib64/libc.so.6(+0x7a5e6)[0x7f4192ec05e6]
../trinity/trinity[0x410fa4]
../trinity/trinity[0x40a02f]
../trinity/trinity[0x40cf47]
../trinity/trinity[0x402c3c]
../trinity/trinity[0x4060de]
../trinity/trinity[0x4065df]
../trinity/trinity[0x406700]
../trinity/trinity[0x40bd0c]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f4192e67b15]
../trinity/trinity[0x402779]
(gdb) l * 0x410fa4
0x410fa4 is in post_modify_ldt (syscalls/modify_ldt.c:62).
57
58 ptr = (void *) shm->scratch[childno];
59
60 if (ptr != NULL)
61 free(ptr);
62 }
63
64 struct syscallentry syscall_modify_ldt = {
65 .name = "modify_ldt",
66 .num_args = 3,
--
js
suse labs
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: trinity: lots of free(): invalid pointer
2014-01-20 19:51 ` Jiri Slaby
@ 2014-01-20 21:37 ` Dave Jones
0 siblings, 0 replies; 5+ messages in thread
From: Dave Jones @ 2014-01-20 21:37 UTC (permalink / raw)
To: Jiri Slaby; +Cc: trinity
On Mon, Jan 20, 2014 at 08:51:10PM +0100, Jiri Slaby wrote:
> (gdb) l * 0x410fa4
> 0x410fa4 is in post_modify_ldt (syscalls/modify_ldt.c:62).
> 57
> 58 ptr = (void *) shm->scratch[childno];
> 59
> 60 if (ptr != NULL)
> 61 free(ptr);
> 62 }
> 63
> 64 struct syscallentry syscall_modify_ldt = {
> 65 .name = "modify_ldt",
> 66 .num_args = 3,
>
That syscall should probably be marked as AVOID for now, as it's pretty easy
to completely screw up the LDT and segv. We'll need to be a bit more
creative to make it actually find bugs.
Dave
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2014-01-20 21:37 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-01-15 22:37 trinity: lots of free(): invalid pointer Jiri Slaby
2014-01-17 19:09 ` Dave Jones
2014-01-20 19:31 ` Jiri Slaby
2014-01-20 19:51 ` Jiri Slaby
2014-01-20 21:37 ` Dave Jones
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).