Re: lib/54017: jemalloc deadlock?

[christos%zoulas.com@localhost (Christos Zoulas)]

The following reply was made to PR lib/54017; it has been noted by GNATS.

From: christos%zoulas.com@localhost (Christos Zoulas)
To: gnats-bugs%NetBSD.org@localhost, lib-bug-people%netbsd.org@localhost, 
	gnats-admin%netbsd.org@localhost, netbsd-bugs%netbsd.org@localhost, martin%NetBSD.org@localhost
Cc: 
Subject: Re: lib/54017: jemalloc deadlock?
Date: Mon, 11 Mar 2019 18:50:31 -0400

 On Mar 11, 10:35pm, wiz%NetBSD.org@localhost (Thomas Klausner) wrote:
 -- Subject: Re: lib/54017: jemalloc deadlock?
 
 | The following reply was made to PR lib/54017; it has been noted by GNATS.
 | 
 | From: Thomas Klausner <wiz%NetBSD.org@localhost>
 | To: gnats-bugs%NetBSD.org@localhost
 | Cc: 
 | Subject: Re: lib/54017: jemalloc deadlock?
 | Date: Mon, 11 Mar 2019 23:33:42 +0100
 | 
 |  I can confirm that thunderbird and firefox built fine for me.
 |  
 |  I see a new problem with a libc from today, a repeatable pbulk-scan
 |  core dump that did not happen before the userland update. pbulk-scan
 |  binary was from 2017, though I've just rebuilt it to get symbols.
 |  
 |  # /usr/pkg_bulk/bin/bulkbuild
 |  Warning: All log files of the previous pbulk run will be
 |  removed in 5 seconds. If you want to abort, press Ctrl-C.
 |  Removing old scan results
 |  Scanning...
 |  .................................................. 50/211
 |  .................................................. 100/211
 |  .................................................. 150/211
 |  .................................................. 200/211
 |  ...........[1]   Segmentation fault (core dumped) ${pscan} -v -l -I ${pscan_start_script} -m ${m...
 |  # gdb /usr/pkg_bulk/bin/pbulk-scan pbulk-scan.core  
 |  GNU gdb (GDB) 8.0.1
 |  Copyright (C) 2017 Free Software Foundation, Inc.
 |  License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
 |  This is free software: you are free to change and redistribute it.
 |  There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
 |  and "show warranty" for details.
 |  This GDB was configured as "x86_64--netbsd".
 |  Type "show configuration" for configuration details.
 |  For bug reporting instructions, please see:
 |  <http://www.gnu.org/software/gdb/bugs/>.
 |  Find the GDB manual and other documentation resources online at:
 |  <http://www.gnu.org/software/gdb/documentation/>.
 |  For help, type "help".
 |  Type "apropos word" to search for commands related to "word"...
 |  Reading symbols from /usr/pkg_bulk/bin/pbulk-scan...done.
 |  [New process 1]
 |  Core was generated by `pbulk-scan'.
 |  Program terminated with signal SIGSEGV, Segmentation fault.
 |  #0  0x000000004d804c5b in event_dispatch () at event.c:348
 |  
 |  warning: Source file is more recent than executable.
 |  348                         iter < last_iter && ev && (next = LIST_NEXT(ev, ev_link), 1);
 |  (gdb) bt
 |  #0  0x000000004d804c5b in event_dispatch () at event.c:348
 |  #1  0x000000004d80354b in master_mode (master_port=0x7f7fff20542f "192.168.0.33:2001", 
 |      start_script=0x7f7fff2053fe "/usr/pkg_bulk/libexec/pbulk/scan-client-start") at master.c:284
 |  #2  0x000000004d805468 in main (argc=2, argv=0x7f7fff204d88) at pscan.c:155
 |  (gdb) l
 |  343             if (ret == 0 && timeout == 0)
 |  344                     return;
 |  345             if (ret > 0) {
 |  346                     iter = poll_list;
 |  347                     for (ev = LIST_FIRST(&all_events);
 |  348                         iter < last_iter && ev && (next = LIST_NEXT(ev, ev_link), 1);
 |  349                         ev = next, ++iter) {
 |  350                             if (iter->revents) {
 |  351                                     if (!ev->ev_persistent) {
 |  352                                             --active_events;
 |  (gdb) p poll_list
 |  $16 = (struct pollfd *) 0x788c70bc3000
 |  (gdb) p iter
 |  $10 = (struct pollfd *) 0x788c70bc3010
 |  (gdb) p last_iter
 |  $9 = (struct pollfd *) 0x788c70bc3018
 |  (gdb) p ev
 |  $11 = (struct event *) 0x5a5a5a5a5a5a5a5a
 |  (gdb) p all_events
 |  $14 = {lh_first = 0x788c70ba70d8}
 |  (gdb) p &all_events
 |  $15 = (struct {...} *) 0x4db871b0 <all_events>
 |  (gdb) p *all_events.lh_first
 |  $18 = {ev_link = {le_next = 0x788c70ba7198, le_prev = 0x4db871b0 <all_events>}, ev_fd = 8, ev_write = 1, ev_persistent = 0,
 |    ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba70c0}
 |  (gdb) p *all_events.lh_first.ev_link.le_next
 |  $19 = {ev_link = {le_next = 0x788c70ba7018, le_prev = 0x788c70ba70d8}, ev_fd = 7, ev_write = 1, ev_persistent = 0,
 |    ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba7180}
 |  (gdb) p *all_events.lh_first.ev_link.le_next.ev_link.le_next
 |  $20 = {ev_link = {le_next = 0x788c70ba7078, le_prev = 0x788c70ba7198}, ev_fd = 9, ev_write = 1, ev_persistent = 0,
 |    ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba7000}
 |  (gdb) p *all_events.lh_first.ev_link.le_next.ev_link.le_next.ev_link.le_next
 |  $21 = {ev_link = {le_next = 0x4db87160 <signal_event>, le_prev = 0x788c70ba7018}, ev_fd = 10, ev_write = 1, ev_persistent = 0,
 |    ev_handler = 0x4d8047c2 <deferred_write_handler>, ev_arg = 0x788c70ba7060}
 |  (gdb) p *all_events.lh_first.ev_link.le_next.ev_link.le_next.ev_link.le_next.ev_link.le_next
 |  $22 = {ev_link = {le_next = 0x0, le_prev = 0x788c70ba7078}, ev_fd = 4, ev_write = 0, ev_persistent = 1, ev_handler = 0x4d804430 <signal_read_handler>,
 |    ev_arg = 0x0}
 |  
 |  ev looks strange. Is that some poisoning?
 
 Yes, it was probably freed already.
 
 christos