Qpid
  1. Qpid
  2. QPID-5218

[dispatch] Crash when outgoing window > 0 and multiple subscribed Messenger clients

    Details

    • Type: Bug Bug
    • Status: Resolved
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 0.25
    • Fix Version/s: Future
    • Component/s: Qpid Dispatch
    • Labels:
      None

      Description

      I can cause the dispatcher to crash by having two Messenger clients subscribe to the same address, with non-zero outgoing window sizes.

      To reproduce:

      1) Run ./router/dispatch-router -c ../etc/qpid-dispatch.conf
      2) Start two msgr-recv clients like this:

      msgr-recv -a amqp://0.0.0.0/test.topic -W 2048 -R &
      msgr-recv -a amqp://0.0.0.0/test.topic -W 2048 -R &

      3) Run a msgr-send client like this:

      msgr-send -c 1 -w 2048 -a amqp://0.0.0.0/test.topic -R

      This should cause dispatch-router to crash.

        Activity

        Ken Giusti created issue -
        Hide
        Ken Giusti added a comment -

        core dump traceback:

        (gdb) bt
        #0 0x0000003ed0a35c55 in __GI_raise (sig=sig@entry=6)
        at ../nptl/sysdeps/unix/sysv/linux/raise.c:63
        #1 0x0000003ed0a37408 in __GI_abort () at abort.c:90
        #2 0x0000003ed0a2e972 in __assert_fail_base (fmt=
        0x3ed0b79268 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
        assertion=assertion@entry=0x7fe5ec1c7701 "(item)->next == 0",
        file=file@entry=
        0x7fe5ec1c75b0 "/home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/src/alloc.c", line=line@entry=180, function=function@entry=
        0x7fe5ec1c785b <_PRETTY_FUNCTION_.3064> "dx_dealloc") at assert.c:92
        #3 0x0000003ed0a2ea22 in _GI__assert_fail (assertion=
        0x7fe5ec1c7701 "(item)->next == 0", file=
        0x7fe5ec1c75b0 "/home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/src/alloc.c", line=180, function=0x7fe5ec1c785b <_PRETTY_FUNCTION_.3064> "dx_dealloc")
        at assert.c:101
        #4 0x00007fe5ec1b2b9c in dx_dealloc ()
        from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0
        #5 0x00007fe5ec1b5a60 in free_dx_delivery_t ()
        from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0
        #6 0x00007fe5ec1b7148 in dx_delivery_free ()
        from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0
        #7 0x00007fe5ec1bf687 in router_writable_link_handler ()
        from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0
        #8 0x00007fe5ec1b5d5c in do_writable ()
        from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0
        #9 0x00007fe5ec1b61b4 in process_handler ()
        from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0
        #10 0x00007fe5ec1b6463 in handler ()
        from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0
        #11 0x00007fe5ec1c41fd in process_connector ()
        from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0
        #12 0x00007fe5ec1c49a7 in thread_run ()
        from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0
        #13 0x0000003ed1607d15 in start_thread (arg=0x7fe5e3ab8700)
        at pthread_create.c:308
        #14 0x0000003ed0af253d in clone ()
        at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114

        Show
        Ken Giusti added a comment - core dump traceback: (gdb) bt #0 0x0000003ed0a35c55 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:63 #1 0x0000003ed0a37408 in __GI_abort () at abort.c:90 #2 0x0000003ed0a2e972 in __assert_fail_base (fmt= 0x3ed0b79268 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", assertion=assertion@entry=0x7fe5ec1c7701 "(item)->next == 0", file=file@entry= 0x7fe5ec1c75b0 "/home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/src/alloc.c", line=line@entry=180, function=function@entry= 0x7fe5ec1c785b <_ PRETTY_FUNCTION _.3064> "dx_dealloc") at assert.c:92 #3 0x0000003ed0a2ea22 in _ GI __assert_fail (assertion= 0x7fe5ec1c7701 "(item)->next == 0", file= 0x7fe5ec1c75b0 "/home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/src/alloc.c", line=180, function=0x7fe5ec1c785b <_ PRETTY_FUNCTION _.3064> "dx_dealloc") at assert.c:101 #4 0x00007fe5ec1b2b9c in dx_dealloc () from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0 #5 0x00007fe5ec1b5a60 in free_dx_delivery_t () from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0 #6 0x00007fe5ec1b7148 in dx_delivery_free () from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0 #7 0x00007fe5ec1bf687 in router_writable_link_handler () from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0 #8 0x00007fe5ec1b5d5c in do_writable () from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0 #9 0x00007fe5ec1b61b4 in process_handler () from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0 #10 0x00007fe5ec1b6463 in handler () from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0 #11 0x00007fe5ec1c41fd in process_connector () from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0 #12 0x00007fe5ec1c49a7 in thread_run () from /home/kgiusti/work/qpid/qpid/qpid/extras/dispatch/build/libqpid-dispatch.so.0 #13 0x0000003ed1607d15 in start_thread (arg=0x7fe5e3ab8700) at pthread_create.c:308 #14 0x0000003ed0af253d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:114
        Ted Ross made changes -
        Field Original Value New Value
        Assignee Ted Ross [ tedross ]
        Hide
        Ted Ross added a comment -

        Of interest here:

        The -W option in msgr-recv has no effect. It is the "outgoing" window. Note that the -w and -W options have opposite meanings for msgr-send and msgr-recv (which is confusing).

        Also interesting is that the router does not crash when you use the "correct" arguments.

        Show
        Ted Ross added a comment - Of interest here: The -W option in msgr-recv has no effect. It is the "outgoing" window. Note that the -w and -W options have opposite meanings for msgr-send and msgr-recv (which is confusing). Also interesting is that the router does not crash when you use the "correct" arguments.
        Hide
        ASF subversion and git services added a comment -

        Commit 1530415 from Ted Ross in branch 'qpid/trunk'
        [ https://svn.apache.org/r1530415 ]

        QPID-5218 - Fixed crash caused by fanned-out non-presettled messages.

        Show
        ASF subversion and git services added a comment - Commit 1530415 from Ted Ross in branch 'qpid/trunk' [ https://svn.apache.org/r1530415 ] QPID-5218 - Fixed crash caused by fanned-out non-presettled messages.
        Ted Ross made changes -
        Status Open [ 1 ] Resolved [ 5 ]
        Resolution Fixed [ 1 ]
        Transition Time In Source Status Execution Times Last Executer Last Execution Date
        Open Open Resolved Resolved
        1h 50m 1 Ted Ross 08/Oct/13 21:33

          People

          • Assignee:
            Ted Ross
            Reporter:
            Ken Giusti
          • Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development