[DISPATCH-929] dangling connection pointer in epoll proactor(?)

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Fix Version/s: Backlog
• Labels: memory-bug
• Assignee: Unassigned
• Reporter: Gordon Sim
• Created: 19/Feb/18 11:48
• Updated: 02/Apr/21 10:16

Description

As yet have no clear reproducer, but observed crashes under CI for a system that uses the router which under valgrind log the following:

2018-02-16 00:00:38.220403 +0000 SERVER (info) Connection from 172.17.0.15:40592 (to 0.0.0.0:55671) failed: amqp:connection:framing-error SSL Failure: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake fa
ilure
2018-02-16 00:00:38.222489 +0000 SERVER (info) Connection from 172.17.0.15:40590 (to 0.0.0.0:55671) failed: amqp:connection:framing-error SSL Failure: error:140940E5:SSL routines:ssl3_read_bytes:ssl handshake fa
ilure
2018-02-16 00:00:38.224534 +0000 SERVER (info) Connection from 172.17.0.15:40586 (to 0.0.0.0:55671) failed: amqp:connection:framing-error SSL Failure: Unknown error
==1== Invalid read of size 4
==1==    at 0x50B0E00: pthread_mutex_lock (in /usr/lib64/libpthread-2.24.so)
==1==    by 0x58C9C68: lock (epoll.c:113)
==1==    by 0x58C9C68: memory_barrier (epoll.c:142)
==1==    by 0x58C9C68: proactor_do_epoll (epoll.c:2016)
==1==    by 0x4E89998: thread_run (server.c:936)
==1==    by 0x4E89A6D: qd_server_run (server.c:1199)
==1==    by 0x401853: main_process (main.c:111)
==1==    by 0x401603: main (main.c:318)
==1==  Address 0x8d76878 is 72 bytes inside a block of size 1,824 free'd
==1==    at 0x4C2ED4A: free (vg_replace_malloc.c:530)
==1==    by 0x569A985: pn_class_decref (object.c:101)
==1==    by 0x58CB01B: pconnection_done (epoll.c:965)
==1==    by 0x58CB01B: pn_proactor_done (epoll.c:2054)
==1==    by 0x4E899E3: thread_run (server.c:941)
==1==    by 0x50AE739: start_thread (in /usr/lib64/libpthread-2.24.so)
==1==    by 0x53CCE7E: clone (in /usr/lib64/libc-2.24.so)
==1==  Block was alloc'd at
==1==    at 0x4C2FA50: calloc (vg_replace_malloc.c:711)
==1==    by 0x569A851: pn_object_new (object.c:202)
==1==    by 0x569A8CB: pn_class_new (object.c:61)
==1==    by 0x58CA677: pn_listener_accept2 (epoll.c:1717)
==1==    by 0x4E88E6A: on_accept (server.c:550)
==1==    by 0x4E88E6A: handle_listener (server.c:709)
==1==    by 0x4E88E6A: handle (server.c:860)
==1==    by 0x4E899B7: thread_run (server.c:939)
==1==    by 0x4E89A6D: qd_server_run (server.c:1199)
==1==    by 0x401853: main_process (main.c:111)
==1==    by 0x401603: main (main.c:318)

All instances of the error did seem to have the ssl handshake failure error. However even if I trigger that error, I can't reproduce the invalid read yet.