[mp2] Segfaults in mpxs_Apache2__RequestRec_rflush

Damian Lukowski <[email protected]>
Newsgroups gmane.comp.apache.mod-perl
Message-ID <[email protected]> 
Hi,

we are encountering occasional connection disruptions caused by segmentation
faults in xs/Apache2/RequestIO/Apache2__RequestIO.h Our application is a
PerlResponseHandler based on Catalyst::View::Mason on Debian Wheezy. The
segfault seems to always happen in mpxs_Apache2__RequestRec_rflush().
Sometimes we have NULL dereference, sometimes dangling pointers:

> (gdb) bt
> #0  0x00007fd145345728 in mpxs_Apache2__RequestRec_rflush (my_perl=0x7fd1520b3950, items=1, mark=0x7fd1542ed2a0, sp=0x7fd1542ed298)
>     at /libapache2-mod-perl2-2.0.7/xs/Apache2/RequestIO/Apache2__RequestIO.h:177
> #1  0x00007fd14534724d in XS_Apache2__RequestRec_rflush (my_perl=0x7fd1520b3950, cv=0x7fd1552432b8) at RequestIO.xs:201
> #2  0x00007fd14aa24266 in Perl_pp_entersub (my_perl=0x7fd1520b3950) at pp_hot.c:3046
> #3  0x00007fd14aa1bf52 in Perl_runops_standard (my_perl=0x7fd1520b3950) at run.c:41
> #4  0x00007fd14a9babc6 in Perl_call_sv (my_perl=my_perl@entry=0x7fd1520b3950, sv=sv@entry=0x7fd1541a71d0, flags=flags@entry=45) at perl.c:2647
> #5  0x00007fd14aa296df in S_curse (check_refcnt=1 '\001', sv=0x7fd155cc70d0, my_perl=0x7fd1520b3950) at sv.c:6342
> #6  Perl_sv_clear (my_perl=my_perl@entry=0x7fd1520b3950, orig_sv=orig_sv@entry=0x7fd156306b18) at sv.c:6073
> #7  0x00007fd14aa29f3f in Perl_sv_free2 (my_perl=my_perl@entry=0x7fd1520b3950, sv=sv@entry=0x7fd156306b18) at sv.c:6474
> #8  0x00007fd14aa15aff in Perl_hv_free_ent (my_perl=my_perl@entry=0x7fd1520b3950, hv=hv@entry=0x7fd156311498, entry=entry@entry=0x7fd156315908) at hv.c:1468
> #9  0x00007fd14aa15fcb in S_hfreeentries (my_perl=my_perl@entry=0x7fd1520b3950, hv=hv@entry=0x7fd156311498) at hv.c:1786
> #10 0x00007fd14aa19081 in Perl_hv_undef_flags (my_perl=my_perl@entry=0x7fd1520b3950, hv=hv@entry=0x7fd156311498, flags=flags@entry=2) at hv.c:1873
> #11 0x00007fd14aa29acf in Perl_sv_clear (my_perl=my_perl@entry=0x7fd1520b3950, orig_sv=orig_sv@entry=0x7fd156311498) at sv.c:6125
> #12 0x00007fd14aa29f3f in Perl_sv_free2 (my_perl=my_perl@entry=0x7fd1520b3950, sv=0x7fd156311498) at sv.c:6474
> #13 0x00007fd14aa4c31b in Perl_free_tmps (my_perl=my_perl@entry=0x7fd1520b3950) at scope.c:167
> #14 0x00007fd14aa1cb49 in Perl_pp_unstack (my_perl=0x7fd1520b3950) at pp_hot.c:221
> #15 0x00007fd14aa1bf52 in Perl_runops_standard (my_perl=0x7fd1520b3950) at run.c:41
> #16 0x00007fd14a9babc6 in Perl_call_sv (my_perl=0x7fd1520b3950, sv=0x7fd152db6318, flags=10) at perl.c:2647
> #17 0x00007fd14a4c69b5 in modperl_callback (my_perl=0x7fd1520b3950, handler=0x7fd14fe062e0, p=0x7fd14fc64028, r=0x7fd14fc640a0, s=0x7fd14fe14810, args=0x7fd156306ff8)
>     at modperl_callback.c:101
> #18 0x00007fd14a4c740b in modperl_callback_run_handlers (idx=6, type=4, r=0x7fd14fc640a0, c=0x0, s=0x7fd14fe14810, pconf=0x0, plog=0x0, ptemp=0x0, run_mode=MP_HOOK_RUN_FIRST)
>     at modperl_callback.c:262
> #19 0x00007fd14a4c79c1 in modperl_callback_per_dir (idx=6, r=0x7fd14fc640a0, run_mode=MP_HOOK_RUN_FIRST) at modperl_callback.c:369
> #20 0x00007fd14a4c0079 in modperl_response_handler_run (r=0x7fd14fc640a0) at mod_perl.c:1000
> #21 0x00007fd14a4c03d9 in modperl_response_handler_cgi (r=0x7fd14fc640a0) at mod_perl.c:1099
> #22 0x00007fd14fe8ec90 in ap_run_handler (r=0x7fd14fc640a0) at config.c:159
> #23 0x00007fd14fe8f0db in ap_invoke_handler (r=r@entry=0x7fd14fc640a0) at config.c:377
> #24 0x00007fd14fe9f208 in ap_process_request (r=r@entry=0x7fd14fc640a0) at http_request.c:282
> #25 0x00007fd14fe9c0c8 in ap_process_http_connection (c=0x7fd14fc81290) at http_core.c:190
> #26 0x00007fd14fe95650 in ap_run_process_connection (c=0x7fd14fc81290) at connection.c:43
> #27 0x00007fd14fe95a38 in ap_process_connection (c=c@entry=0x7fd14fc81290, csd=<optimized out>) at connection.c:190
> #28 0x00007fd14fea3dbe in child_main (child_num_arg=child_num_arg@entry=0) at prefork.c:667
> #29 0x00007fd14fea4512 in make_child (slot=0, s=0x7fd14fdea818) at prefork.c:768
> #30 make_child (s=0x7fd14fdea818, slot=0) at prefork.c:696
> #31 0x00007fd14fea5076 in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:903
> #32 ap_mpm_run (_pconf=_pconf@entry=0x7fd14fe34028, plog=<optimized out>, s=s@entry=0x7fd14fdea818) at prefork.c:1107
> #33 0x00007fd14fe79896 in main (argc=3, argv=0x7fff0fa46788) at main.c:755
> (gdb) frame 0
> #0  0x00007fd145345728 in mpxs_Apache2__RequestRec_rflush (my_perl=0x7fd1520b3950, items=1, mark=0x7fd1542ed2a0, sp=0x7fd1542ed298)
>     at /libapache2-mod-perl2-2.0.7/xs/Apache2/RequestIO/Apache2__RequestIO.h:177
> 177	    MP_CHECK_WBUCKET_INIT("$r->rflush");
> (gdb) list
> 172	    /* this also magically assings to r ;-) */
> 173	    mpxs_usage_va_1(r, "$r->rflush()");
> 174	
> 175	    rcfg = modperl_config_req_get(r);
> 176	
> 177	    MP_CHECK_WBUCKET_INIT("$r->rflush");
> 178	    MP_TRACE_o(MP_FUNC, "%d bytes [%s]",
> 179	               rcfg->wbucket->outcnt,
> 180	               apr_pstrmemdup(rcfg->wbucket->pool, rcfg->wbucket->outbuf,
> 181	                              rcfg->wbucket->outcnt));
> (gdb) p rcfg->wbucket
> Cannot access memory at address 0xc54b77eb434f4e66

Other example:


> (gdb) bt
> #0  0x00007fb700952728 in mpxs_Apache2__RequestRec_rflush (my_perl=0x7fb70f64f440, items=1, mark=0x7fb70c0b5d50, sp=0x7fb70c0b5d48)
>     at /libapache2-mod-perl2-2.0.7/xs/Apache2/RequestIO/Apache2__RequestIO.h:177
> #1  0x00007fb70095424d in XS_Apache2__RequestRec_rflush (my_perl=0x7fb70f64f440, cv=0x7fb70c046328) at RequestIO.xs:201
> #2  0x00007fb705e2b266 in Perl_pp_entersub (my_perl=0x7fb70f64f440) at pp_hot.c:3046
> #3  0x00007fb705e22f52 in Perl_runops_standard (my_perl=0x7fb70f64f440) at run.c:41
> #4  0x00007fb705dc1bc6 in Perl_call_sv (my_perl=my_perl@entry=0x7fb70f64f440, sv=sv@entry=0x7fb70e702d50, flags=flags@entry=45) at perl.c:2647
> #5  0x00007fb705e306df in S_curse (check_refcnt=1 '\001', sv=0x7fb7101483b8, my_perl=0x7fb70f64f440) at sv.c:6342
> #6  Perl_sv_clear (my_perl=my_perl@entry=0x7fb70f64f440, orig_sv=orig_sv@entry=0x7fb71016ffb0) at sv.c:6073
> #7  0x00007fb705e30f3f in Perl_sv_free2 (my_perl=my_perl@entry=0x7fb70f64f440, sv=sv@entry=0x7fb71016ffb0) at sv.c:6474
> #8  0x00007fb705e1caff in Perl_hv_free_ent (my_perl=my_perl@entry=0x7fb70f64f440, hv=hv@entry=0x7fb710142d40, entry=entry@entry=0x7fb710143b18) at hv.c:1468
> #9  0x00007fb705e1cfcb in S_hfreeentries (my_perl=my_perl@entry=0x7fb70f64f440, hv=hv@entry=0x7fb710142d40) at hv.c:1786
> #10 0x00007fb705e20081 in Perl_hv_undef_flags (my_perl=my_perl@entry=0x7fb70f64f440, hv=hv@entry=0x7fb710142d40, flags=flags@entry=2) at hv.c:1873
> #11 0x00007fb705e30acf in Perl_sv_clear (my_perl=my_perl@entry=0x7fb70f64f440, orig_sv=orig_sv@entry=0x7fb710142d40) at sv.c:6125
> #12 0x00007fb705e30f3f in Perl_sv_free2 (my_perl=my_perl@entry=0x7fb70f64f440, sv=0x7fb710142d40) at sv.c:6474
> #13 0x00007fb705e5331b in Perl_free_tmps (my_perl=my_perl@entry=0x7fb70f64f440) at scope.c:167
> #14 0x00007fb705e23b49 in Perl_pp_unstack (my_perl=0x7fb70f64f440) at pp_hot.c:221
> #15 0x00007fb705e22f52 in Perl_runops_standard (my_perl=0x7fb70f64f440) at run.c:41
> #16 0x00007fb705dc1bc6 in Perl_call_sv (my_perl=0x7fb70f64f440, sv=0x7fb70cffeb08, flags=10) at perl.c:2647
> #17 0x00007fb7061009b5 in modperl_callback (my_perl=0x7fb70f64f440, handler=0x7fb70b21c2e0, p=0x7fb70b089028, r=0x7fb70b0890a0, s=0x7fb70b224810, args=0x7fb7101706b8)
>     at modperl_callback.c:101
> #18 0x00007fb70610140b in modperl_callback_run_handlers (idx=6, type=4, r=0x7fb70b0890a0, c=0x0, s=0x7fb70b224810, pconf=0x0, plog=0x0, ptemp=0x0, run_mode=MP_HOOK_RUN_FIRST)
>     at modperl_callback.c:262
> #19 0x00007fb7061019c1 in modperl_callback_per_dir (idx=6, r=0x7fb70b0890a0, run_mode=MP_HOOK_RUN_FIRST) at modperl_callback.c:369
> #20 0x00007fb7060fa079 in modperl_response_handler_run (r=0x7fb70b0890a0) at mod_perl.c:1000
> #21 0x00007fb7060fa3d9 in modperl_response_handler_cgi (r=0x7fb70b0890a0) at mod_perl.c:1099
> #22 0x00007fb70b2a0c90 in ap_run_handler (r=0x7fb70b0890a0) at config.c:159
> #23 0x00007fb70b2a10db in ap_invoke_handler (r=r@entry=0x7fb70b0890a0) at config.c:377
> #24 0x00007fb70b2b1208 in ap_process_request (r=r@entry=0x7fb70b0890a0) at http_request.c:282
> #25 0x00007fb70b2ae0c8 in ap_process_http_connection (c=0x7fb70b093290) at http_core.c:190
> #26 0x00007fb70b2a7650 in ap_run_process_connection (c=0x7fb70b093290) at connection.c:43
> #27 0x00007fb70b2a7a38 in ap_process_connection (c=c@entry=0x7fb70b093290, csd=<optimized out>) at connection.c:190
> #28 0x00007fb70b2b5dbe in child_main (child_num_arg=child_num_arg@entry=9) at prefork.c:667
> #29 0x00007fb70b2b6512 in make_child (slot=9, s=0x7fb70b240818) at prefork.c:768
> #30 make_child (s=0x7fb70b240818, slot=9) at prefork.c:696
> #31 0x00007fb70b2b7076 in perform_idle_server_maintenance (p=<optimized out>) at prefork.c:903
> #32 ap_mpm_run (_pconf=_pconf@entry=0x7fb70b246028, plog=<optimized out>, s=s@entry=0x7fb70b240818) at prefork.c:1107
> #33 0x00007fb70b28b896 in main (argc=3, argv=0x7fff5df54748) at main.c:755
> (gdb) frame 0
> #0  0x00007fb700952728 in mpxs_Apache2__RequestRec_rflush (my_perl=0x7fb70f64f440, items=1, mark=0x7fb70c0b5d50, sp=0x7fb70c0b5d48)
>     at /libapache2-mod-perl2-2.0.7/xs/Apache2/RequestIO/Apache2__RequestIO.h:177
> 177	    MP_CHECK_WBUCKET_INIT("$r->rflush");
> (gdb) list
> 172	    /* this also magically assings to r ;-) */
> 173	    mpxs_usage_va_1(r, "$r->rflush()");
> 174	
> 175	    rcfg = modperl_config_req_get(r);
> 176	
> 177	    MP_CHECK_WBUCKET_INIT("$r->rflush");
> 178	    MP_TRACE_o(MP_FUNC, "%d bytes [%s]",
> 179	               rcfg->wbucket->outcnt,
> 180	               apr_pstrmemdup(rcfg->wbucket->pool, rcfg->wbucket->outbuf,
> 181	                              rcfg->wbucket->outcnt));
> (gdb) p rcfg
> $2 = (modperl_config_req_t *) 0x0

I have no idea how to debug this further and would appreciate your help.

Best regards
 Damian
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.