You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@trafficserver.apache.org by GitBox <gi...@apache.org> on 2021/05/18 00:34:54 UTC
[GitHub] [trafficserver] shinrich opened a new issue #7851: Crashes on what appears to be double freeing SSLNetVConnection objects
shinrich opened a new issue #7851:
URL: https://github.com/apache/trafficserver/issues/7851
We have been seeing this occaisionally with 9.0.x for the last couple months. At first I thought it was just the shutdown crash (crashes due to SSL library unloading on shutdown). But on closer inspection, it looks like we are deleting a SSLNetVConnection that has already been deleted.
```
(gdb) bt
#0 0x00002b2da89703b0 in asn1_string_embed_free (a=0x2000796c6e4f70, embed=0) at crypto/asn1/asn1_lib.c:340
#1 0x00002b2da8979e7f in asn1_primitive_free (pval=<optimized out>, it=<optimized out>, embed=<optimized out>) at crypto/asn1/tasn_fre.c:204
#2 0x00002b2da897a2c0 in asn1_template_free (pval=0x2b34b128ae80, tt=tt@entry=0x2b2da8da2740 <X509_CINF_seq_tt>) at crypto/asn1/tasn_fre.c:142
#3 0x00002b2da8979fa6 in asn1_item_embed_free (pval=0x2b2db0574340, it=0x2b2da8d98da0 <X509_CINF_it>, embed=4096) at crypto/asn1/tasn_fre.c:110
#4 0x00002b2da897a2c0 in asn1_template_free (pval=0x2b2db0574340, tt=tt@entry=0x2b2da8da26c0 <X509_seq_tt>) at crypto/asn1/tasn_fre.c:142
#5 0x00002b2da8979fa6 in asn1_item_embed_free (pval=0x2b2db05743e8, it=0x2b2da8d98d20 <X509_it>, embed=0) at crypto/asn1/tasn_fre.c:110
#6 0x00002b2da897a205 in ASN1_item_free (val=<optimized out>, it=<optimized out>) at crypto/asn1/tasn_fre.c:20
#7 0x00002b2da8ab4f40 in OPENSSL_sk_pop_free (st=0x2b33fa5103a0, func=0x4bf000 <X5...@plt>) at crypto/stack/stack.c:368
#8 0x00002b2da8685714 in sk_X509_pop_free (freefunc=<optimized out>, sk=<optimized out>) at include/openssl/x509.h:99
#9 SSL_free (s=0x2b44a6055c00) at ssl/ssl_lib.c:1218
#10 SSL_free (s=0x2b44a6055c00) at ssl/ssl_lib.c:1146
#11 0x000000000076bef0 in SSLNetVConnection::clear (this=0x2b3ada3a0a00) at ../../../../../../_vcs/trafficserver9/iocore/net/SSLNetVConnection.cc:929
#12 0x000000000076a203 in free (t=0x2b2dada30f00, this=0x2b3ada3a0a00) at ../../../../../../_vcs/trafficserver9/iocore/net/SSLNetVConnection.cc:973
#13 SSLNetVConnection::free (this=0x2b3ada3a0a00, t=0x2b2dada30f00) at ../../../../../../_vcs/trafficserver9/iocore/net/SSLNetVConnection.cc:948
#14 0x0000000000791d3f in NetHandler::free_netevent (this=0x2b2dada34fc0, ne=ne@entry=0x2b3ada3a0ba8) at ../../../../../../_vcs/trafficserver9/iocore/net/UnixNet.cc:368
#15 0x000000000079eb66 in write_signal_and_update (event=<optimized out>, vc=0x2b3ada3a0a00) at ../../../../../../_vcs/trafficserver9/iocore/net/UnixNetVConnection.cc:140
#16 read_signal_and_update(int, UnixNetVConnection*) () at ../../../../../../_vcs/trafficserver9/iocore/net/UnixNetVConnection.cc:114
#17 0x00000000007707e8 in SSLNetVConnection::net_read_io(NetHandler*, EThread*) () at ../../../../../../_vcs/trafficserver9/iocore/net/SSLNetVConnection.cc:670
#18 0x000000000079200e in NetHandler::process_ready_list (this=this@entry=0x2b2dada34fc0) at ../../../../../../_vcs/trafficserver9/iocore/net/UnixNet.cc:416
#19 0x0000000000792498 in NetHandler::waitForActivity(long) () at ../../../../../../_vcs/trafficserver9/iocore/net/UnixNet.cc:551
#20 0x00000000007e3e51 in EThread::execute_regular (this=this@entry=0x2b2dada30f00) at ../../../../../../_vcs/trafficserver9/iocore/eventsystem/I_PriorityEventQueue.h:115
#21 0x00000000007e40a6 in execute (this=0x2b2dada30f00) at ../../../../../../_vcs/trafficserver9/iocore/eventsystem/UnixEThread.cc:332
#22 EThread::execute (this=0x2b2dada30f00) at ../../../../../../_vcs/trafficserver9/iocore/eventsystem/UnixEThread.cc:310
#23 0x00000000007e2289 in spawn_thread_internal (a=0x2b2dab0dfe80) at ../../../../../../_vcs/trafficserver9/iocore/eventsystem/Thread.cc:92
#24 0x00002b2da9538ea5 in start_thread (arg=0x2b2db0576700) at pthread_create.c:307
#25 0x00002b2daa26e8dd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficserver] bryancall closed issue #7851: Crashes on what appears to be double freeing SSLNetVConnection objects
Posted by GitBox <gi...@apache.org>.
bryancall closed issue #7851:
URL: https://github.com/apache/trafficserver/issues/7851
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficserver] bryancall commented on issue #7851: Crashes on what appears to be double freeing SSLNetVConnection objects
Posted by GitBox <gi...@apache.org>.
bryancall commented on issue #7851:
URL: https://github.com/apache/trafficserver/issues/7851#issuecomment-1067414778
We are not seeing this crash anymore.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [trafficserver] shinrich commented on issue #7851: Crashes on what appears to be double freeing SSLNetVConnection objects
Posted by GitBox <gi...@apache.org>.
shinrich commented on issue #7851:
URL: https://github.com/apache/trafficserver/issues/7851#issuecomment-842737557
I think it may be due to NetHandler::manage_keep_alive_queue. From within that function it calls
```
_close_ne(ne, now, handle_event, closed, total_idle_time, total_idle_count);
```
Which in turn calls
```
if (ne->closed) {
free_netevent(ne);
++closed;
}
```
Even if the recursion count is greater than 0.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
users@infra.apache.org