segfault in 2.1 head

[Bill Stoddard <bi...@wstoddard.com>]

Hitting a segfault running traffic through proxy gateway
(ProxyPass/ProxyPassReverse) while reading the response from the backend. The
backend page has a few dozen components. Last time I checked, we do not have
this problem in 2.0 HEAD.

Preliminary analysis:
At line 801 in proxy_http.c (in ap_proxy_http_process_response()) we call bb =
apr_brigade_create(p, c->bucket_alloc). This brigade is getting stomped on which
is causing the segfault.  The stopmage is happening during a call to
apr_bucket_read() from core.c line 3595 (in core_input_filter). Drilling down
into apr_bucket_read, we are doing a read of a socket bucket. From
socket_bucket_read we call apr_bucket_heap_make. apr_bucket_heap_make calls
apr_bucket_alloc which is returning the same storage as returned by
apr_brigade_create().

Here is the callback.

core_input_filter(ap_filter_t *, apr_bucket_brigade *, int, int, __int64) line
3635 + 65 bytes
ap_get_brigade(ap_filter_t *, apr_bucket_brigade *, int, int, __int64) line 514
+ 32 bytes
ap_http_filter(ap_filter_t *, apr_bucket_brigade *, int, int, __int64) line 1017
+ 32 bytes
ap_get_brigade(ap_filter_t *, apr_bucket_brigade *, int, int, __int64) line 514
+ 32 bytes
net_time_filter(ap_filter_t *, apr_bucket_brigade *, int, int, __int64) line
3431
ap_get_brigade(ap_filter_t *, apr_bucket_brigade *, int, int, __int64) line 514
+ 32 bytes
ap_proxy_http_process_response(apr_pool_t *, request_rec *, proxy_http_conn_t *,
conn_rec *, proxy_conn_rec *, proxy_server_conf *, char *) line 1027 + 37 bytes
ap_proxy_http_handler(request_rec *, proxy_server_conf *, char *, const char *,
unsigned short) line 1219 + 33 bytes
proxy_run_scheme_handler(request_rec *, proxy_server_conf *, char *, const char
*, unsigned short) line 1146 + 95 bytes
proxy_handler(request_rec *) line 461 + 21 bytes
ap_run_handler(request_rec *) line 195 + 78 bytes
ap_invoke_handler(request_rec *) line 401 + 9 bytes
ap_process_request(request_rec *) line 288 + 9 bytes
ap_process_http_connection(conn_rec *) line 293 + 9 bytes
ap_run_process_connection(conn_rec *) line 85 + 78 bytes
ap_process_connection(conn_rec *, void *) line 209
worker_main(long) line 707
_threadstartex(void *) line 212 + 13 bytes
KERNEL32! 77e96523()


Bill

Re: segfault in 2.1 head

["Paul J. Reder" <re...@remulak.net>]

Hmmm, I was just doing some proxy testing late last week and early
this week with a head build as recent as 12/16 or so and wasn't
seeing any problems. I might not have been hitting exactly what
you were, Bill, but I was doing some ProxyPass and ProxyPassReverse
work with virtual hosts across two different server machines...

That might help narrow down when things headed south (or it might
be a red-herring...). I hope it helps though.

Cliff Woolley wrote:

> On Thu, 19 Dec 2002, Bill Stoddard wrote:
> 
> 
>>Hitting a segfault running traffic through proxy gateway
>>(ProxyPass/ProxyPassReverse) while reading the response from the
>>backend. The backend page has a few dozen components. Last time I
>>checked, we do not have this problem in 2.0 HEAD.
>>
> 
> That *probably* means a bucket got destroyed and then reused anyway.  But
> I'll have to look more closely at it to be sure, which I'll do when I get
> back from Monticello late tonight.
> 
> (Can you put the corefile and matching binary somewhere that I can get to
> it, if it's for some OS I happen to have access to?  Might save me a bit
> of time, which I'm short on at the moment.)
> 
> --Cliff
> 
> 


-- 
Paul J. Reder
-----------------------------------------------------------
"The strength of the Constitution lies entirely in the determination of each
citizen to defend it.  Only if every single citizen feels duty bound to do
his share in this defense are the constitutional rights secure."
-- Albert Einstein

Re: segfault in 2.1 head

[Cliff Woolley <jw...@virginia.edu>]

On Thu, 19 Dec 2002, Bill Stoddard wrote:

> Hitting a segfault running traffic through proxy gateway
> (ProxyPass/ProxyPassReverse) while reading the response from the
> backend. The backend page has a few dozen components. Last time I
> checked, we do not have this problem in 2.0 HEAD.

That *probably* means a bucket got destroyed and then reused anyway.  But
I'll have to look more closely at it to be sure, which I'll do when I get
back from Monticello late tonight.

(Can you put the corefile and matching binary somewhere that I can get to
it, if it's for some OS I happen to have access to?  Might save me a bit
of time, which I'm short on at the moment.)

--Cliff