pcp
[Top] [All Lists]

Re: Double free() bug in interp.c

To: Nathan Scott <nathans@xxxxxxxxxx>
Subject: Re: Double free() bug in interp.c
From: Ken McDonell <kenj@xxxxxxxxxxxxxxxx>
Date: Sat, 18 May 2013 07:09:29 +1000
Cc: PCP Mailing List <pcp@xxxxxxxxxxx>
Delivered-to: pcp@xxxxxxxxxxx
In-reply-to: <951154100.4430537.1368775958655.JavaMail.root@xxxxxxxxxx>
References: <951154100.4430537.1368775958655.JavaMail.root@xxxxxxxxxx>
User-agent: Mozilla/5.0 (X11; Linux i686; rv:17.0) Gecko/20130510 Thunderbird/17.0.6
On 17/05/13 17:32, Nathan Scott wrote:
Hi Ken,

Keen to pick your brain on some of the things I've been looking
into today with regards to Fedora/EPEL bug #958745 (as mentioned
on IRC - https://bugzilla.redhat.com/show_bug.cgi?id=958745).


The buffer pinning is supposed to be a reference counter, so 2 values in the same pmResult pointing into the same PDU buffer is both expected and very common, so I'd be surprised if there is a core error in this area.

What pmchart does that most others do not is ...

.. as a result of pressing Stop in the UI.  That issues
a pmSetMode(), which calls __pmLogResetInterp() and I suspect the
two calls to __pmUnpinPDUBuf() in there to be problematic.

This is the bit of your analysis I'm not sure on, yet ...

In our case, we have two metrics - so two hash entries, both are
fetched via a single __pmLogRead and in a single pmResult.  The
hash table thus has two hash entries (keyed by PMID) which point
at the same pdubuf.  When we walk the hash table we end up doing
two unpins on the one pdubuf, which drops its reference count to
zero and ultimately exposes us to a subsequent pmFreeResult call
which gets confused.

I need to dig deeper ... I tried to create a qa test outside pmchart to expose the problem, but have not been able to do this as yet. I'll keep plugging away and let you know if I learn anything more.

<Prev in Thread] Current Thread [Next in Thread>