[PROTON-1773] Access after free in pn_proactor_disconnect

• Type: Bug
• Status: Closed
• Priority: Blocker
• Resolution: Fixed
• Affects Version/s: proton-c-0.21.0
• Fix Version/s: proton-c-0.21.0
• Component/s: cpp-binding, proton-c
• Assignee: Alan Conway
• Reporter: Andrew Stitcher
• Created: 23/Feb/18 21:10
• Updated: 13/May/18 00:54
• Resolved: 26/Feb/18 23:06

Description

The fix for PROTON-1734 may have caused a sporadic access after free problem detected in one of the new tests in cpp-container_test.

10: TEST: test_container_mt_stop()
10: ==11269== Invalid read of size 8
10: ==11269==    at 0x59772E4: pn_proactor_disconnect (epoll.c:2128)
10: ==11269==    by 0x4E6156F: proton::container::impl::stop(proton::error_condition const&) (proactor_container_impl.cpp:763)
10: ==11269==    by 0x4E5F2D8: proton::container::stop() (container.cpp:80)
10: ==11269==    by 0x409ED4: (anonymous namespace)::test_container_mt_stop() (container_test.cpp:344)
10: ==11269==    by 0x404811: main (container_test.cpp:368)
10: ==11269==  Address 0x6e27748 is 1,256 bytes inside a block of size 1,808 free'd
10: ==11269==    at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
10: ==11269==    by 0x5975221: pconnection_process (epoll.c:1174)
10: ==11269==    by 0x5975C3E: process_inbound_wake (epoll.c:1962)
10: ==11269==    by 0x5975C3E: proactor_do_epoll (epoll.c:1999)
10: ==11269==    by 0x4E6336B: proton::container::impl::thread() (proactor_container_impl.cpp:670)
10: ==11269==    by 0x4E639A3: proton::container::impl::run(int) (proactor_container_impl.cpp:721)
10: ==11269==    by 0x513EA5F: ??? (in /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.19)
10: ==11269==    by 0x60C3183: start_thread (pthread_create.c:312)
10: ==11269==    by 0x56A503C: clone (clone.S:111)
10: ==11269== 
10/46 Test #10: cpp-container_test ...............***Failed    2.53 sec

Issue Links

• relates to: PROTON-1734 [cpp] container.stop() doesn't work when called from non-proactor thread.