double free when call transapi_revert_callbacks_recursive() revert xml tree #97
Comments
|
I found in xmlFreeNodeList it will call xmlFreeNodeList(cur->children) to free the children. is it correct? |
|
xmlFreeNodeList() is libxml2 function, try to trace the problem in libnetconf. From the log I see that the last step inside libnetconf is in transapi.c:50. The problem is that the current master has only |
|
hi, map to current master, transapi.c:39 to xmlFreeNode(tree->node); since the order is TRANSAPI_CLBCKS_LEAF_TO_ROOT, according to current code, it will revert own, then revert child. when revert own, ti will call xmlFreeNode, in this function, it also free children, so when try to revert child, cause the double free. static void transapi_revert_xml_tree(const struct transapi_callbacks_info info, struct xmldiff_tree tree) Thanks, |
|
hi, when the order is TRANSAPI_CLBCKS_ROOT_TO_LEAF, there is problem for reverting the xml tree. can we just ignore the order, no matter what the order is, just revert the children first, then own? Thanks |
|
Hi Jin, ignoring the order may break transAPI modules, they can rely on the order they define. You're using a model different than ietf-ip with ietf-interfaces and I was not able to reproduce it with our cfginterfaces module. Could you please provide a valgrind output with the bug occurring? It may be enough, but perhaps also the name of the augment model you're using with ietf-interfaces? Thanks. Regards, |
|
Hi, Thanks for your response, could you please let me know how to get the valgrind output? Thanks, |
|
Hi Jin, you will need the valgrind utility, which is available as a package on every distribution (or almost). Then please run Regards, |
|
hi, I run # valgrind -v 3, but the issue is not happened . if I start netopeer-server without valgrind, there still is probelm. anyway I put the valgrind output here. thanks for your support netopeer-server[17585]: ERROR :[transapi_apply_callbacks_recursive_own][transapi.c:325] Callback for path /B:interfaces/B:interface/B:type failed (-1). |
1 similar comment
|
hi, I run # valgrind -v 3, but the issue is not happened . if I start netopeer-server without valgrind, there still is probelm. anyway I put the valgrind output here. thanks for your support netopeer-server[17585]: ERROR :[transapi_apply_callbacks_recursive_own][transapi.c:325] Callback for path /B:interfaces/B:interface/B:type failed (-1). |
|
Hi, I check valgrind log, there are "Invalid free() / delete / delete[]", seems it is probelm. Thanks, |
|
Hi Jin, yes, those invalid frees are the problem and the output may be enough for me to find the bug. However, I honestly cannot do anything when I'm guessing the lines (since you use some customized transapi.c). So I am afraid I cannot help you unless you use the stock libnetconf from our master branch. Regards, |
|
Hi, I found the problem and fix it. thanks for your support Jin |
|
Could you please share more details where the problem was? I guess it was in your specific code, right? |
|
just missing below condition for reverting the children when the order is TRANSAPI_CLBCKS_ROOT_TO_LEAF because it is done when revert own. |
|
And where is this condition supposed to be? In your source code or in libnetconf? If it is libnetconf bug, could you please share the patch for other users? Thanks. |
|
it is not libnetconf bug, I think there is no the problem in libnetconf master branch: |
|
ok, thanks |
Hi,
I found when transapi apply call back fail and try to revert the xml diff tree, it will cause the double free.
my case the order is TRANSAPI_CLBCKS_ROOT_TO_LEAF.
netopeer-server[4812]: Transapi revert XML tree (/B:interfaces/B:interface/D:l3-interface/D:ip, proposed operation 9).
*** glibc detected *** /usr/bin/netopeer-server: double free or corruption (!prev): 0x000000000384ce20 ***
======= Backtrace: =========
/lib/libc.so.6(+0x78cc6)[0x2aaaac009cc6]
/lib/libc.so.6(cfree+0x73)[0x2aaaac010303]
/usr/lib64/libxml2.so.2(xmlFreeNodeList+0x221)[0x2aaaaad24d71]
/usr/lib64/libxml2.so.2(xmlFreeNodeList+0x6d)[0x2aaaaad24bbd]
db) bt
#0 0x00002aaaabfc4c35 in *__GI_raise (sig=) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1 0x00002aaaabfc8780 in *__GI_abort () at abort.c:92
#2 0x00002aaaabfffc0b in __libc_message (do_abort=, fmt=) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189
#3 0x00002aaaac009cc6 in malloc_printerr (action=3, str=0x2aaaac0e1868 "double free or corruption (!prev)", ptr=)
#4 0x00002aaaac010303 in *__GI___libc_free (mem=) at malloc.c:3738
#5 0x00002aaaaad24d71 in xmlFreeNodeList__internal_alias (cur=0x384cda0) at tree.c:3623
#6 0x00002aaaaad24bbd in xmlFreeNodeList__internal_alias (cur=0x384cd00) at tree.c:3612
#7 0x00002aaaaad24bbd in xmlFreeNodeList__internal_alias (cur=0x384cc60) at tree.c:3612
#8 0x00002aaaaad24bbd in xmlFreeNodeList__internal_alias (cur=0x384cbc0) at tree.c:3612
#9 0x00002aaaaad2564a in xmlFreeNode__internal_alias (cur=0x384cb20) at tree.c:3686
#10 0x00002aaaabd58bf2 in transapi_revert_xml_tree (info=0x7fffffffd080, tree=0x3852ff0) at src/transapi/transapi.c:50
#11 0x00002aaaabd58eb8 in transapi_revert_callbacks_recursive_own (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x3852ff0,
#12 0x00002aaaabd594c8 in transapi_revert_callbacks_recursive (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x3852ff0,
#13 0x00002aaaabd59384 in transapi_revert_callbacks_recursive_children (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x3853300,
#14 0x00002aaaabd59505 in transapi_revert_callbacks_recursive (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x3853300,
#15 0x00002aaaabd59384 in transapi_revert_callbacks_recursive_children (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x9953c0,
#16 0x00002aaaabd59505 in transapi_revert_callbacks_recursive (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x9953c0,
#17 0x00002aaaabd59384 in transapi_revert_callbacks_recursive_children (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x384f980,
#18 0x00002aaaabd59505 in transapi_revert_callbacks_recursive (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x384f980,
#19 0x00002aaaabd5a1b8 in transapi_running_changed (ds=0x262aa10, session=0x8eb080, rpc=0x3152470, old_doc=0x9cd0b0, new_doc=0x2002ef0,
#20 0x00002aaaabd4b032 in ncds_apply_transapi (ds=0x262aa10, session=0x8eb080, rpc=0x3152470, old=0x9cd0b0, erropt=NC_EDIT_ERROPT_NOTSET, reply=0x0)
---Type to continue, or q to quit---
#21 0x00002aaaabd4cf08 in ncds_apply_rpc (id=1714636916, session=0x8eb080, rpc=0x3152470) at src/datastore.c:7163
#22 0x00002aaaabd4d49f in ncds_apply_rpc2all (session=0x8eb080, rpc=0x3152470, ids=0x0) at src/datastore.c:7306
#23 0x0000000000404283 in server_process_rpc (session=0x8eb080, rpc=0x3152470) at src/server_operations.c:564
#24 0x0000000000406949 in process_operation (socket=29) at src/server_comm_socket.c:477
#25 0x0000000000406d79 in comm_loop (conn=0x60a8e0, timeout=500) at src/server_comm_socket.c:598
#26 0x0000000000403e29 in main (argc=1, argv=0x7fffffffe878) at src/server.c:357
and I found when handle the parent(/B:interfaces/B:interface/D:l3-interface) of this node(/B:interfaces/B:interface/D:l3-interface/D:ip), it already free something of the child. could you help check?
do I need change the order to TRANSAPI_CLBCKS_LEAF_TO_ROOT?
Thanks,
Jin
The text was updated successfully, but these errors were encountered: