Re: free(): double free detected in tcache 2

On 26/02/2020 21:05, Graham Cobb wrote:
>> Difficult to know what caused this without more info
>>
>> How did you upgrade from 2.6.6 to 2.6.8?
>> - was it through distro package upgrade?
>> - did you grab the source code and compiled dar yourself?
>>
>> both way are valid, the impact are different on libraries dar relies on:
>> - in the first case you may have also upgraded some libraries
>> - in the second case you have not
> 
> Debian package upgrade. And, yes, it did install a new version of
> libgcc-s1 (10-20200211-1), which could either have a bug or be exposing
> a previously unknown dar bug. There is a newer version of libgcc-s1 in
> testing today so I will install that one for tonight's run. There is no
> Debian bug report for this, however.
> 
>>> I will try to reproduce it, but are there any additional options 
>>> you suggest I turn on to get any more information about the problem
>>> (assuming it recurs)?
>>
>> I would recompile dar activating debugging information
>> export CXXFLAGS=-g
>> export LDFLAGS=-g
>> export CFLAGS=-g
>> ./configure --prefix=... etc.
>> make
>> make uninstall (if you want to remove the old installed dar/libdar
>> binaries)
>> make install (and not "make install-strip" which would remove all
>> symbols including debugging ones)
> 
> I'm not going to be able to build dar this evening. For tonight's run I
> have enabled core dumps and I might add -va as well to see if there is
> any hints from what dar was doing.
> 
>> If you have already a core file, I could try to have a look at it with
>> gdb, not sure I can get much of it without debugging symbols... but it
>> worth trying
> 
> I will see if I get anything tonight.

It crashed again last night. I had turned on -v, here is the log:

############
DARsystem: ### Thu, 27 Feb 2020 02:20:01 +0000 ###
DARsystem: Current backup information (Size in 1024 bytes blocks.):
DARsystem: ..DARsystemFull: 36509724.
DARsystem: ..DARsystemDiff: 3198896:
DARsystem: ....DARsystemDiff01: 3198896.
############
DARsystem: Preparing to Create DARsystemDiff02.
############
DARsystem: creating DARsystemDiff02. Please wait.
###
No terminal found for user interaction. All questions will be assumed a
negative answer (less destructive choice), which most of the time will
abort the program.
No user target found on command line
Opening archive DARsystemDiff01 ...
Opening the archive using the multi-slice abstraction layer...
free(): double free detected in tcache 2
sh: line 1: 419867 Aborted                 (core dumped)

As you can see, the last message was "Opening the archive using the
multi-slice abstraction layer..."

I asked gdb for a backtrace and got this...

#0  __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
#1  0x00007f152f655535 in __GI_abort () at abort.c:79
#2  0x00007f152f6abdc8 in __libc_message (action=action@entry=do_abort,
fmt=fmt@entry=0x7f152f7b6aae "%s\n")
    at ../sysdeps/posix/libc_fatal.c:181
#3  0x00007f152f6b249a in malloc_printerr (str=str@entry=0x7f152f7b8768
"free(): double free detected in tcache 2")
    at malloc.c:5361
#4  0x00007f152f6b3e5d in _int_free (av=0x7f152f7e9c40 <main_arena>,
p=0x559fd8a95de0, have_lock=<optimized out>)
    at malloc.c:4215
#5  0x0000559fd838a831 in std::deque<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::allocator<std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > >
>::_M_destroy_data_aux(std::_Deque_iterator<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> >&, std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >*>,
std::_Deque_iterator<std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> >&, std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> >*>) ()
#6  0x00007f152fbb1dd0 in
libdar::etage::etage(libdar::user_interaction&, char const*,
libdar::datetime const&, libdar::datetime const&, bool, bool) () from
/usr/lib/x86_64-linux-gnu/libdar64.so.6000
#7  0x00007f152fba8999 in libdar::entrepot_local::read_dir_reset() const
() from /usr/lib/x86_64-linux-gnu/libdar64.so.6000
#8  0x00007f152fc1f24e in
libdar::sar_tools_get_higher_number_in_dir(libdar::entrepot&,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&, libdar::limitint<unsigned long> const&,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&, libdar::limitint<unsigned long>&) ()
   from /usr/lib/x86_64-linux-gnu/libdar64.so.6000
#9  0x00007f152fc1e4f0 in libdar::sar::open_last_file(bool) () from
/usr/lib/x86_64-linux-gnu/libdar64.so.6000
#10 0x00007f152fc1ea00 in libdar::sar::skip_to_eof() () from
/usr/lib/x86_64-linux-gnu/libdar64.so.6000
#11 0x00007f152fc1ee9f in
libdar::sar::sar(std::shared_ptr<libdar::user_interaction> const&,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&, std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&,
std::shared_ptr<libdar::entrepot> const&, bool,
libdar::limitint<unsigned long> const&, bool,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&) () from
/usr/lib/x86_64-linux-gnu/libdar64.so.6000
#12 0x00007f152fc07aeb in
libdar::macro_tools_open_archive(std::shared_ptr<libdar::user_interaction>
const&, std::shared_ptr<libdar::entrepot> const&,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&, libdar::limitint<--Type <RET> for more, q
to quit, c to continue without paging--c
unsigned long> const&, std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&,
libdar::crypto_algo, libdar::secu_string const&, unsigned int,
libdar::pile&, libdar::header_version&, std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&, std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&,
libdar::limitint<unsigned long>&, bool, bool, bool, bool,
std::__cxx11::list<libdar::signator, std::allocator<libdar::signator>
>&, libdar::slice_layout&, bool, bool) () from
/usr/lib/x86_64-linux-gnu/libdar64.so.6000
#13 0x00007f152fbe7e92 in
libdar::archive::i_archive::i_archive(std::shared_ptr<libdar::user_interaction>
const&, libdar::path const&, std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&, libdar::archive_options_read const&) ()
from /usr/lib/x86_64-linux-gnu/libdar64.so.6000
#14 0x00007f152fb58d3b in
libdar::archive::archive(std::shared_ptr<libdar::user_interaction>
const&, libdar::path const&, std::__cxx11::basic_string<char,
std::char_traits<char>, std::allocator<char> > const&,
std::__cxx11::basic_string<char, std::char_traits<char>,
std::allocator<char> > const&, libdar::archive_options_read const&) ()
from /usr/lib/x86_64-linux-gnu/libdar64.so.6000
#15 0x0000559fd8394069 in ?? ()
#16 0x0000559fd839d097 in ?? ()
#17 0x0000559fd8371971 in ?? ()
#18 0x00007f152f656bbb in __libc_start_main (main=0x559fd8371930,
argc=246, argv=0x7ffc901fbec8, init=<optimized out>, fini=<optimized
out>, rtld_fini=<optimized out>, stack_end=0x7ffc901fbeb8) at
../csu/libc-start.c:308
#19 0x0000559fd8371aea in ?? ()

That is hard to read due to email wrapping. The last call inside libdar
(#6) claims to be: libdar::etage::etage. Apparently that called (#7)
std::deque, which did the free.

In case it is at all useful, I have made the core file (and the
corresponding dar image) available at http://cobb.uk.net/denis.tgz
(https won't work).

I will let you know when I have been able to try with a debugging image.
In the meantime, you might find you could reproduce with a vm running
the most recent debian testing.

Regards
Graham