Re: lib/54017: jemalloc deadlock?

[christos%zoulas.com@localhost (Christos Zoulas)]

On Mar 11, 10:35pm, wiz%NetBSD.org@localhost (Thomas Klausner) wrote:
-- Subject: Re: lib/54017: jemalloc deadlock?

| The following reply was made to PR lib/54017; it has been noted by GNATS.
| 
| From: Thomas Klausner <wiz%NetBSD.org@localhost>
| To: gnats-bugs%NetBSD.org@localhost
| Cc: 
| Subject: Re: lib/54017: jemalloc deadlock?
| Date: Mon, 11 Mar 2019 23:33:42 +0100
| 
|  I can confirm that thunderbird and firefox built fine for me.
|  
|  I see a new problem with a libc from today, a repeatable pbulk-scan
|  core dump that did not happen before the userland update. pbulk-scan
|  binary was from 2017, though I've just rebuilt it to get symbols.
|  
|  # /usr/pkg_bulk/bin/bulkbuild
|  Warning: All log files of the previous pbulk run will be
|  removed in 5 seconds. If you want to abort, press Ctrl-C.
|  Removing old scan results
|  Scanning...
|  .................................................. 50/211
|  .................................................. 100/211
|  .................................................. 150/211
|  .................................................. 200/211
|  ...........[1]   Segmentation fault (core dumped) ${pscan} -v -l -I ${pscan_start_script} -m ${m...
|  # gdb /usr/pkg_bulk/bin/pbulk-scan pbulk-scan.core  
|  GNU gdb (GDB) 8.0.1
|  Copyright (C) 2017 Free Software Foundation, Inc.
|  License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
|  This is free software: you are free to change and redistribute it.
|  There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
|  and "show warranty" for details.
|  This GDB was configured as "x86_64--netbsd".
|  Type "show configuration" for configuration details.
|  For bug reporting instructions, please see:
|  <http://www.gnu.org/software/gdb/bugs/>.
|  Find the GDB manual and other documentation resources online at:
|  <http://www.gnu.org/software/gdb/documentation/>.
|  For help, type "help".
|  Type "apropos word" to search for commands related to "word"...
|  Reading symbols from /usr/pkg_bulk/bin/pbulk-scan...done.
|  [New process 1]
|  Core was generated by `pbulk-scan'.
|  Program terminated with signal SIGSEGV, Segmentation fault.
|  #0  0x000000004d804c5b in event_dispatch () at event.c:348
|  
|  warning: Source file is more recent than executable.
|  348                         iter < last_iter && ev && (next = LIST_NEXT(ev, ev_link), 1);
|  (gdb) bt
|  #0  0x000000004d804c5b in event_dispatch () at event.c:348
|  #1  0x000000004d80354b in master_mode (master_port=0x7f7fff20542f "192.168.0.33:2001", 
|      start_script=0x7f7fff2053fe "/usr/pkg_bulk/libexec/pbulk/scan-client-start") at master.c:284
|  #2  0x000000004d805468 in main (argc=2, argv=0x7f7fff204d88) at pscan.c:155
|  (gdb) l
|  343             if (ret == 0 && timeout == 0)
|  344                     return;
|  345             if (ret > 0) {
|  346                     iter = poll_list;
|  347                     for (ev = LIST_FIRST(&all_events);
|  348                         iter < last_iter && ev && (next = LIST_NEXT(ev, ev_link), 1);
|  349                         ev = next, ++iter) {
|  350                             if (iter->revents) {
|  351                                     if (!ev->ev_persistent) {
|  352                                             --active_events;
|  (gdb) p poll_list
|  $16 = (struct pollfd *) 0x788c70bc3000
|  (gdb) p iter
|  $10 = (struct pollfd *) 0x788c70bc3010
|  (gdb) p last_iter
|  $9 = (struct pollfd *) 0x788c70bc3018
|  (gdb) p ev
|  $11 = (struct event *) 0x5a5a5a5a5a5a5a5a
|  (gdb) p all_events
|  $14 = {lh_first = 0x788c70ba70d8}
|  (gdb) p &all_events
|  $15 = (struct {...} *) 0x4db871b0 <all_events>
|  (gdb) p *all_events.lh_first
|  $18 = {ev_link = {le_next = 0x788c70ba7198, le_prev = 0x4db871b0 <all_events>}, ev_fd = 8, ev_write = 1, ev_persistent = 0,
|    ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba70c0}
|  (gdb) p *all_events.lh_first.ev_link.le_next
|  $19 = {ev_link = {le_next = 0x788c70ba7018, le_prev = 0x788c70ba70d8}, ev_fd = 7, ev_write = 1, ev_persistent = 0,
|    ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba7180}
|  (gdb) p *all_events.lh_first.ev_link.le_next.ev_link.le_next
|  $20 = {ev_link = {le_next = 0x788c70ba7078, le_prev = 0x788c70ba7198}, ev_fd = 9, ev_write = 1, ev_persistent = 0,
|    ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba7000}
|  (gdb) p *all_events.lh_first.ev_link.le_next.ev_link.le_next.ev_link.le_next
|  $21 = {ev_link = {le_next = 0x4db87160 <signal_event>, le_prev = 0x788c70ba7018}, ev_fd = 10, ev_write = 1, ev_persistent = 0,
|    ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba7060}
|  (gdb) p *all_events.lh_first.ev_link.le_next.ev_link.le_next.ev_link.le_next.ev_link.le_next
|  $22 = {ev_link = {le_next = 0x0, le_prev = 0x788c70ba7078}, ev_fd = 4, ev_write = 0, ev_persistent = 1, ev_handler = 0x4d804430 <signal_read_handler>,
|    ev_arg = 0x0}
|  
|  ev looks strange. Is that some poisoning?

Yes, it was probably freed already.

christos