Re: libc failure

[Marcus Brinkmann]

On Mon, Nov 18, 2002 at 09:26:56AM +0100, Marcus Brinkmann wrote:
> Hi,
> 
> this is a bit more debugging info on the glibc 2.3 release (I will try the
> latest version soon, I just want to send this as long as I am still able to
> reproduce it).  I don't really know how to make sense of this.  I spotted
> that main_arena's next pointer is zero, while the code assumes that the list
> is circular.

Ok, I forgot to include the actual info.

Breakpoint 2, ptmalloc_lock_all () at ../sysdeps/mach/i386/machine-lock.h:52
52        __asm__ __volatile ("xchgl %0, %1"
(gdb) bt full
#0  ptmalloc_lock_all () at ../sysdeps/mach/i386/machine-lock.h:52
        ar_ptr = (struct malloc_state *) 0x0
#1  0x01123b69 in __fork () at ../sysdeps/mach/hurd/fork.c:101
        env = {{__jmpbuf = {18602200, 18837456, 0, 16873976, 16873472, 
17971976},
    __mask_was_saved = 0, __saved_mask = 0}}
        pid = 93340
        i = 1034514604
        err = 91052
        ss = (struct hurd_sigstate * volatile) 0x11f8808
#2  0x08061ff7 in group_member ()
No symbol table info available.
#3  0x08059e16 in group_member ()
No symbol table info available.
#4  0x08058f7a in group_member ()
No symbol table info available.
#5  0x08056711 in group_member ()
No symbol table info available.
#6  0x080562d1 in group_member ()
No symbol table info available.
#7  0x0804cd75 in endgrent () at ../nss/getXXent_r.c:137
No symbol table info available.
#8  0x0804b378 in endgrent () at ../nss/getXXent_r.c:137
No symbol table info available.
#9  0x01099627 in __libc_start_main (main=0x804ad08 <endgrent+192>, argc=1, 
ubp_av=0x0,
    init=0x804a1f0 <_init>, fini=0x1017a08, rtld_fini=0x1123b08 <__fork+152>, 
stack_end=0x11bebc0)
    at ../sysdeps/generic/libc-start.c:144
        ubp_ev = (char **) 0x11bebc0
        result = 0
(gdb) info reg
eax            0x0      0
ecx            0x1123b08        17971976
edx            0x11bebc0        18607040
ebx            0x11bd8d8        18602200
esp            0x10177f0        0x10177f0
ebp            0x1017808        0x1017808
esi            0x11bc0dc        18596060
edi            0x0      0
eip            0x10ecd4b        0x10ecd4b
eflags         0x206    518
cs             0x17     23
ss             0x1f     31
ds             0x1f     31
es             0x1f     31
fs             0x1f     31
gs             0x1f     31
fctrl          0x0      0
fstat          0x0      0
ftag           0x0      0
fiseg          0x0      0
fioff          0x0      0
foseg          0x0      0
fooff          0x0      0
fop            0x0      0
(gdb) x/20i $pc
0x10ecd4b <ptmalloc_lock_all+21>:       mov    $0x1,%eax
0x10ecd50 <ptmalloc_lock_all+26>:       xchg   %eax,0x2118(%ebx)
0x10ecd56 <ptmalloc_lock_all+32>:       test   %eax,%eax
0x10ecd58 <ptmalloc_lock_all+34>:       je     0x10ecd6c <ptmalloc_lock_all+54>
0x10ecd5a <ptmalloc_lock_all+36>:       sub    $0xc,%esp
0x10ecd5d <ptmalloc_lock_all+39>:       lea    0x2118(%ebx),%eax
0x10ecd63 <ptmalloc_lock_all+45>:       push   %eax
0x10ecd64 <ptmalloc_lock_all+46>:       call   0x1074fd8 <key+104000>
0x10ecd69 <ptmalloc_lock_all+51>:       add    $0x10,%esp
0x10ecd6c <ptmalloc_lock_all+54>:       lea    0x1c68(%ebx),%edi
0x10ecd72 <ptmalloc_lock_all+60>:       mov    $0x1,%esi
0x10ecd77 <ptmalloc_lock_all+65>:       mov    %esi,%eax
0x10ecd79 <ptmalloc_lock_all+67>:       xchg   %eax,(%edi)
0x10ecd7b <ptmalloc_lock_all+69>:       test   %eax,%eax
0x10ecd7d <ptmalloc_lock_all+71>:       je     0x10ecd8b <ptmalloc_lock_all+85>
0x10ecd7f <ptmalloc_lock_all+73>:       sub    $0xc,%esp
0x10ecd82 <ptmalloc_lock_all+76>:       push   %edi
0x10ecd83 <ptmalloc_lock_all+77>:       call   0x1074fd8 <key+104000>
0x10ecd88 <ptmalloc_lock_all+82>:       add    $0x10,%esp
0x10ecd8b <ptmalloc_lock_all+85>:       mov    0x46c(%edi),%edi
(gdb) x/20i ptmalloc_lock_all
0x10ecd36 <ptmalloc_lock_all>:  push   %ebp
0x10ecd37 <ptmalloc_lock_all+1>:        mov    %esp,%ebp
0x10ecd39 <ptmalloc_lock_all+3>:        push   %edi
0x10ecd3a <ptmalloc_lock_all+4>:        push   %esi
0x10ecd3b <ptmalloc_lock_all+5>:        push   %ebx
0x10ecd3c <ptmalloc_lock_all+6>:        sub    $0xc,%esp
0x10ecd3f <ptmalloc_lock_all+9>:        call   0x10ecd44 <ptmalloc_lock_all+14>
0x10ecd44 <ptmalloc_lock_all+14>:       pop    %ebx
0x10ecd45 <ptmalloc_lock_all+15>:       add    $0xd0b94,%ebx
0x10ecd4b <ptmalloc_lock_all+21>:       mov    $0x1,%eax
(gdb) print list_lock
$16 = {held = 0, lock = 0, name = 0x0, queue = {head = 0x0, tail = 0x0}, holder 
= 0x0}
(gdb) print &list_lock
$17 = (struct mutex *) 0x11bf9f0
(gdb) print main_arena
$18 = {mutex = {held = 0, lock = 0, name = 0x0, queue = {head = 0x0, tail = 
0x0}, holder = 0x0},
  stat_lock_direct = 0, stat_lock_loop = 0, stat_lock_wait = 0, pad0_ = {0}, 
max_fast = 0,
  fastbins = {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, top = 0x0, 
last_remainder = 0x0,
  bins = {0x0 <repeats 256 times>}, binmap = {0, 0, 0, 0}, next = 0x0, 
system_mem = 0,
  max_system_mem = 0}
(gdb) print &main_arena
$19 = (struct malloc_state *) 0x11bf540
(gdb) print ar_ptr
$20 = (struct malloc_state *) 0x0
(gdb) print main_arena.next
$21 = (struct malloc_state *) 0x0
(gdb)

> When I started to stepi through the code, it first took the list lock, then
> the main arena's mutex, and then it got:
> 
> (gdb) stepi
> 
> Program received signal EXC_BAD_ACCESS, Could not access memory.
> 0x010ecd79 in ptmalloc_lock_all () at ../sysdeps/mach/i386/machine-lock.h:52
> 52        __asm__ __volatile ("xchgl %0, %1"
> 
> when trying to lock main_arena.next (which was 0).

-- 
`Rhubarb is no Egyptian god.' GNU      http://www.gnu.org    marcus@gnu.org
Marcus Brinkmann              The Hurd http://www.gnu.org/software/hurd/
Marcus.Brinkmann@ruhr-uni-bochum.de
http://www.marcus-brinkmann.de/