Details
-
Bug
-
Status: Closed
-
Blocker
-
Resolution: Fixed
-
1.5.0
-
None
-
Proton version 0.28.0
Description
I can cause the router to crash by applying the attached patch, rebuilding with CMAKE_BUILD_TYPE=Debug, and running cmake -VV -R tests_edge_router
This will cause a bunch of tests to fail, but then a crash will occur with the following traceback (on current master):
#0 0x00007f4dbc571e82 in qdr_forward_deliver_CT (core=0x2202e60, out_link=0x9999999999999999, out_dlv=0x7f4d9034de68)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/forwarder.c:201
#1 0x00007f4dbc568d98 in qdrc_endpoint_send_CT (core=0x2202e60, ep=0x7f4da009f168, dlv=0x7f4d9034de68, presettled=true)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/core_link_endpoint.c:126
#2 0x00007f4dbc591364 in qdrc_send_message (core=0x2202e60, addr=0x7f4da0031f68, endpoint=0x7f4da009f168, insert_addr=false)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/modules/edge_addr_tracking/edge_addr_tracking.c:181
#3 0x00007f4dbc5916d0 in on_addr_event (context=0x7f4da0050050, event=524288, addr=0x7f4da0031f68)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/modules/edge_addr_tracking/edge_addr_tracking.c:249
#4 0x00007f4dbc5686b6 in qdrc_event_addr_raise (core=0x2202e60, event=524288, addr=0x7f4da0031f68)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/core_events.c:114
#5 0x00007f4dbc57c325 in qdr_core_unbind_address_link_CT (core=0x2202e60, addr=0x7f4da0031f68, link=0x22c49a8)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/router_core.c:562
#6 0x00007f4dbc567932 in qdr_link_inbound_detach_CT (core=0x2202e60, action=0x7f4d9003e268, discard=false)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/connections.c:1660
#7 0x00007f4dbc57e179 in router_core_thread (arg=0x2202e60) at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/router_core_thread.c:148
#8 0x00007f4dbbe84594 in start_thread () from /lib64/libpthread.so.0
#9 0x00007f4dbb133f4f in clone () from /lib64/libc.so.6
And on 1.5.0:
#0 0x00007f30e6bc55dc in qdrc_endpoint_delivery_CT (core=0x14219a0, endpoint=0x9999999999999999, message=0x7f30c4226468)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/core_link_endpoint.c:137
#1 0x00007f30e6bed632 in qdrc_send_message (core=0x14219a0, addr=0x7f30cc031f68, endpoint=0x9999999999999999, insert_addr=false)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/modules/edge_addr_tracking/edge_addr_tracking.c:179
#2 0x00007f30e6bed9c4 in on_addr_event (context=0x7f30cc050050, event=524288, addr=0x7f30cc031f68)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/modules/edge_addr_tracking/edge_addr_tracking.c:249
#3 0x00007f30e6bc4e8d in qdrc_event_addr_raise (core=0x14219a0, event=524288, addr=0x7f30cc031f68)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/core_events.c:114
#4 0x00007f30e6bd868a in qdr_core_unbind_address_link_CT (core=0x14219a0, addr=0x7f30cc031f68, link=0x7f30c80ac568)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/router_core.c:504
#5 0x00007f30e6bc40c5 in qdr_link_inbound_detach_CT (core=0x14219a0, action=0x161bba8, discard=false)
at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/connections.c:1657
#6 0x00007f30e6bda368 in router_core_thread (arg=0x14219a0) at /home/kgiusti/work/dispatch/qpid-dispatch/src/router_core/router_core_thread.c:124
#7 0x00007f30e64e1594 in start_thread () from /lib64/libpthread.so.0
#8 0x00007f30e5790f4f in clone () from /lib64/libc.so.6
It appears as though a endpoint context for the edge_addr_tracking module has been referenced after it has been freed.
On further testing it appears as if the endpoint context is being referenced by multiple qdr_link_t which should not happen.