subversion-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Stefan Sperling <s...@apache.org>
Subject server crash in authz object pool
Date Mon, 12 Feb 2018 11:50:12 GMT
The svn-bb-openbsd bot has found a crash in the object pool code.

It is triggered when running RA serf tests on OpenBSD. The httpd
work processes crash due to what looks like a use-after-free (0xdf
means this byte of memory has been freed).

I can reproduce this on sparc64 and amd64 machines.
The build is without APR_HAS_THREADS, using the prefork MPM with HTTPD 2.2.
Let me know if you need more details. I have no time at present to hunt
this down myself, so I'm sending this info to the list in hope that it
will be useful.

#2  0x00000efde1f5550d in lookup (object=0xefe4c595ac0, object_pool=0xefe97bc4f60, key=0xefe97bc4ac0,
result_pool=0xefddbb18500)
    at subversion/libsvn_subr/object_pool.c:193
193         = apr_hash_get(object_pool->objects, key->data, key->size);
(gdb) p *object_pool->objects
$3 = {pool = 0xdfdfdfdfdfdfdfdf, array = 0xdfdfdfdfdfdfdfdf, iterator = {ht = 0x0, this =
0x0, next = 0xdfdfdfdfdfdfdfdf, index = 3755991007},
  count = 3755991007, max = 3755991007, seed = 3755991007, hash_func = 0xdfdfdfdfdfdfdfdf,
free = 0xdfdfdfdfdfdfdfdf}
(gdb) bt
#0  0x00000efe4199790c in find_entry (ht=0x2e646e762f6e6f69, key=0xefec8a8aa40, klen=16, val=0x0)
    at /home/stsp/svn/src/apr-1.5.2/tables/apr_hash.c:293
#1  0x00000efe41997c7a in apr_hash_get (ht=0x2e646e762f6e6f69, key=0xefec8a8aa40, klen=16)
at /home/stsp/svn/src/apr-1.5.2/tables/apr_hash.c:367
#2  0x00000efde1f5550d in lookup (object=0xefe4c595ac0, object_pool=0xefe97bc4f60, key=0xefe97bc4ac0,
result_pool=0xefddbb18500)
    at subversion/libsvn_subr/object_pool.c:193
#3  0x00000efde1f55814 in svn_object_pool__lookup (object=0xefe4c595ac0, object_pool=0xefe97bc4f60,
key=0xefe97bc4ac0,
    result_pool=0xefddbb18500) at subversion/libsvn_subr/object_pool.c:309
#4  0x00000efe40b70459 in authz_read (authz_p=0xefe4c595ac0, authz_id=0xefe4c595ac8,
---Type <return> to continue, or q <return> to quit---
    path=0xefe5f813680 "/home/stsp/svn/svn-trunk/subversion/tests/cmdline/svn-test-work/authz",
groups_path=0x0, must_exist=1, repos_hint=0x0,
    result_pool=0xefddbb18500, scratch_pool=0xefddbb1a600) at subversion/libsvn_repos/authz.c:1579
#5  0x00000efe40b7067f in svn_repos_authz_read3 (authz_p=0x7f7ffffe2170,
    path=0xefe5f813680 "/home/stsp/svn/svn-trunk/subversion/tests/cmdline/svn-test-work/authz",
groups_path=0x0, must_exist=1, repos_hint=0x0,
    result_pool=0xefddbb18500, scratch_pool=0xefddbb1a600) at subversion/libsvn_repos/authz.c:1642
#6  0x00000efecc0ae158 in get_access_conf (r=0xefe412bb400, conf=0xefe1d05af00, scratch_pool=0xefddbb1a600)
    at subversion/mod_authz_svn/mod_authz_svn.c:467
#7  0x00000efecc0ae7c6 in req_check_access (r=0xefe412bb400, conf=0xefe1d05af00, repos_path_ref=0x7f7ffffe2320,
---Type <return> to continue, or q <return> to quit---
    dest_repos_path_ref=0x7f7ffffe2318) at subversion/mod_authz_svn/mod_authz_svn.c:690
#8  0x00000efecc0aefb0 in auth_checker (r=0xefe412bb400) at subversion/mod_authz_svn/mod_authz_svn.c:1036
#9  0x00000efbd47194bb in ap_run_auth_checker (r=0xefe412bb400) at /home/stsp/svn/src/httpd-2.2.32/server/request.c:78
#10 0x00000efbd4719b87 in ap_process_request_internal (r=0xefe412bb400) at /home/stsp/svn/src/httpd-2.2.32/server/request.c:198
#11 0x00000efbd478241d in ap_process_request (r=0xefe412bb400) at /home/stsp/svn/src/httpd-2.2.32/modules/http/http_request.c:296
#12 0x00000efbd477f051 in ap_process_http_connection (c=0xefde19a0200) at /home/stsp/svn/src/httpd-2.2.32/modules/http/http_core.c:190
#13 0x00000efbd4729a83 in ap_run_process_connection (c=0xefde19a0200) at /home/stsp/svn/src/httpd-2.2.32/server/connection.c:43
#14 0x00000efbd4729f2d in ap_process_connection (c=0xefde19a0200, csd=0xefde5a3b300) at /home/stsp/svn/src/httpd-2.2.32/server/connection.c:190
---Type <return> to continue, or q <return> to quit---
#15 0x00000efbd47b5d6e in child_main (child_num_arg=5) at /home/stsp/svn/src/httpd-2.2.32/server/mpm/prefork/prefork.c:667
#16 0x00000efbd47b5f4f in make_child (s=0xefe150eda00, slot=5) at /home/stsp/svn/src/httpd-2.2.32/server/mpm/prefork/prefork.c:768
#17 0x00000efbd47b61e9 in perform_idle_server_maintenance (p=0xefe150ed500) at /home/stsp/svn/src/httpd-2.2.32/server/mpm/prefork/prefork.c:903
#18 0x00000efbd47b674b in ap_mpm_run (_pconf=0xefe150ed500, plog=0xefe150ed800, s=0xefe150eda00)
    at /home/stsp/svn/src/httpd-2.2.32/server/mpm/prefork/prefork.c:1107
#19 0x00000efbd4703e23 in main (argc=5, argv=0x7f7ffffe2878) at /home/stsp/svn/src/httpd-2.2.32/server/main.c:753
(gdb)

Mime
View raw message