[Bug libc/770] possible deadlock on double-free logging

[Bug libc/770] possible deadlock on double-free logging

[arequipeno at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=770

Ian Pilcher <arequipeno at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |arequipeno at gmail dot com

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug libc/770] possible deadlock on double-free logging

[arequipeno at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=770

--- Comment #11 from Ian Pilcher <arequipeno at gmail dot com> 2011-05-17 02:38:49 UTC ---
Created attachment 5729
  --> http://sourceware.org/bugzilla/attachment.cgi?id=5729
gdb backtrace of deadlocked X server

I believe that I just hit this bug.  My X server locks hard every time I log
out -- apparently trying to print an error message about a corrupted double-
linked list.

#0  __lll_lock_wait_private () at
../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:100
#1  0x000000351127ec11 in _L_lock_10461 () from /lib64/libc.so.6
#2  0x000000351127c9d7 in __libc_malloc (bytes=227924349408) at malloc.c:3657
#3  0x000000351127235d in __libc_message (do_abort=2, 
    fmt=0x351135d8c8 "*** glibc detected *** %s: %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:137
#4  0x000000351127896a in malloc_printerr (action=3, 
    str=0x351135a8d2 "corrupted double-linked list", ptr=<optimized out>) at
malloc.c:6283
#5  0x0000003511278d80 in malloc_consolidate (av=0x35115991e0) at malloc.c:5169
#6  0x0000003511279669 in malloc_consolidate (av=0x35115991e0) at malloc.c:5115
#7  _int_free (av=0x35115991e0, p=<optimized out>, have_lock=0) at
malloc.c:5034
#8  0x0000000000461094 in FreeOsBuffers (oc=0x1237b30) at io.c:1101
#9  0x000000000045f283 in CloseDownConnection (client=0x1237b70) at
connection.c:1068
#10 0x000000000042e1c6 in CloseDownClient (client=0x1237b70) at dispatch.c:3432
#11 0x000000000042ec3a in Dispatch () at dispatch.c:441
#12 0x0000000000422e1a in main (argc=<optimized out>, argv=0x7fff630ba4b8,
envp=<optimized out>)
    at main.c:287

Needless to say, this is really painful, since the only way to recover the
system is to ssh in and kill -9 the X server.  (A simply crash would be a
lot easier to deal with, since the X server is shutting down anyway.)  Is
there any way to suppress the printing of this message?

(This is on Fedora 15 with glibc-2.13.90-11.x86_64, BTW.)

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/770] possible deadlock on double-free logging

[jsm28 at gcc dot gnu.org]

http://sourceware.org/bugzilla/show_bug.cgi?id=770

Joseph Myers <jsm28 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|libc                        |malloc

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/770] possible deadlock on double-free logging

[siddhesh at redhat dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=770

Siddhesh Poyarekar <siddhesh at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |siddhesh at redhat dot com

--- Comment #12 from Siddhesh Poyarekar <siddhesh at redhat dot com> 2012-04-16 13:48:38 UTC ---
Ian, what you're hitting should have been fixed with commit id f8a3b5bf. The X
backtrace is waiting on a lock in a malloc within __libc_message. The commit I
mentioned replaces these malloc calls with mmap() calls to avoid getting
tangled up in the arena locks.

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/770] possible deadlock on double-free logging

[arequipeno at gmail dot com]

http://sourceware.org/bugzilla/show_bug.cgi?id=770

--- Comment #13 from Ian Pilcher <arequipeno at gmail dot com> 2012-04-17 04:39:21 UTC ---
(In reply to comment #12)
> Ian, what you're hitting should have been fixed with commit id f8a3b5bf. The X
> backtrace is waiting on a lock in a malloc within __libc_message. The commit I
> mentioned replaces these malloc calls with mmap() calls to avoid getting
> tangled up in the arena locks.

Thanks Siddhesh!

Fortunately, I haven't seen this problem in quite a while.  (I'd like to think
that the real problem in X has been fixed, but it seems more likely that my
system has changed enough that the race condition that causes the memory
corruption/detection isn't being triggered any more.  Oh well.)

-- 
Configure bugmail: http://sourceware.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug malloc/770] possible deadlock on double-free logging

[neleai at seznam dot cz]

https://sourceware.org/bugzilla/show_bug.cgi?id=770

Ondrej Bilka <neleai at seznam dot cz> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
                 CC|                            |neleai at seznam dot cz
         Resolution|---                         |DUPLICATE

--- Comment #14 from Ondrej Bilka <neleai at seznam dot cz> ---
Fixed in duplicate bug as was mentioned earlier in thread.

*** This bug has been marked as a duplicate of bug 10282 ***

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/770] possible deadlock on double-free logging

[jackie.rosen at hushmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=770

Jackie Rosen <jackie.rosen at hushmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jackie.rosen at hushmail dot com

--- Comment #15 from Jackie Rosen <jackie.rosen at hushmail dot com> ---
*** Bug 260998 has been marked as a duplicate of this bug. ***
Seen from the domain http://volichat.com
Page where seen: http://volichat.com/adult-chat-rooms
Marked for reference. Resolved as fixed @bugzilla.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/770] possible deadlock on double-free logging

[schwab at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=770

Andreas Schwab <schwab at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|jackie.rosen at hushmail dot com   |

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug malloc/770] possible deadlock on double-free logging

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=770

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-

-- 
You are receiving this mail because:
You are on the CC list for the bug.