asalkeld/libqb — Issue #30: segfault in timerlist_del
Author: asalkeld
Created: 2012-03-08 11:00:59+00:00
State: open

Program terminated with signal 11, Segmentation fault.
\#0 0x00007f2648ed924d in timerlist_del (timerlist=0x13f4038, _timer_handle=0x0) at loop_timerlist.c:131
131 memset(timer->handle_addr, 0, sizeof(struct timerlist_timer *));

Thread 1 (Thread 0x7f2649774740 (LWP 813)):
\#0 0x00007f2648ed924d in timerlist_del (timerlist=0x13f4038, _timer_handle=0x0) at loop_timerlist.c:131
timer = 0x0
\#1 0x00007f2648ed9ae8 in qb_loop_timer_del (lp=0x13f3f40, th=8313862168751636481) at loop_timerlist.c:446
s = 0x13f4020
t = 0x13f48f0
res = 0
l = 0x13f3f40
__func__ = "qb_loop_timer_del"
\#2 0x00007f264934a712 in reset_token_retransmit_timeout (instance=0x7f2645a90010) at totemsrp.c:1402
No locals.
\#3 0x00007f264935028e in message_handler_orf_token (instance=0x7f2645a90010, msg=0x144f390, msg_len=70, endian_conversion_needed=0) at totemsrp.c:3699
token_storage = "\000\000\"\377\300\250z\356\272\254#\000%:\004\000\272\254#\000\000\000\000\000\300\250zd\002\000\300\250zd", '\000' "\344, ", '\000' "\344, \000\000\000\000\000\000\000\344", '\000' , "\017\016\001\000T\005\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\000\001\002\003\004\005\006"...

token_storage = "\000\000\"\377\300\250z\356\272\254#\000%:\004\000\272\254#\000\000\000\000\000\300\250zd\002\000\300\250zd", '\000' "\344, ", '\000' "\344, \000\000\000\000\000\000\000\344", '\000' , "\017\016\001\000T\005\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\000\001\002\003\004\005\006\a\b\t\n\v\f\r\016\017\020\021\022\023\024\025\026\027\030\031\032\033\034\035\036\037 !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\177\200\201\202\203\204\205\206\207\210\211\212\213\214\215\216\217\220\221\222\223\224\225\226\227\230\231\232\233\234\235\236\237\240\241\242\243\244\245\246\247\250\251\252\253\254\255\256\257\260\261\262\263\264\265\266\267\270\271\272\273\274\275\276\277\300\301\302\303\304\305\306\307\310\311\312\313\314\315\316\317\320\321\322\323\324\325\326\327\330\331\332\333\334\335\336\337\340\341\342\343\344\345\346\347\350\351\352\353\354\355\356\357\360\361\362\363\364\365\366\367\370\371\372\373\374\375\376\377\000\001\002\003\004\005\006"...
token_convert = "\360\067-S\377\177", '\000' , "0\002\032\000l\000\002\000h\000\001", '\000' , "\001\000\000\000\001\000\000\000\001\000\000\000\001\000\000\000\001", '\000' "\300, \001\n\000\b\000\001\000\020\000\000\200\024\000\005\000\377\377\000\000\207\001\000\000\367G\000\000\350\003\000\000x\000\002\000\000\000\000\000@\000\000\000\334\005\000\000\001\000\000\000\001\000\000\000\001\000\000\000\001\000\000\000\003\000\000\000\240\017\000\000\350\003\000\000\000\000\000\000\200:\t\000\200Q\001\000\003\000\000\000X\002\000\000\020\000\000\000\000\000\000\000\001\000\000\000\001\000\000\000\001\000\000\000`\352", '\000' , "\001\000\000\000\000\000\000\000\374\000\003\000\037\000\000\000\000\000\000\000\b", '\000' ...
token = 0x7fff532d37f0
forward_token = 1
transmits_allowed = 17
mcasted_retransmit = 0
mcasted_regular = 0
last_aru = 2337978
__FUNCTION__ = "message_handler_orf_token"
\#4 0x00007f26493529c8 in main_deliver_fn (context=0x7f2645a90010, msg=0x144f390, msg_len=70) at totemsrp.c:4452
instance = 0x7f2645a90010
message_header = 0x144f390
__FUNCTION__ = "main_deliver_fn"
\#5 0x00007f2649344d75 in none_token_recv (rrp_instance=0x144dfa0, iface_no=0, context=0x7f2645a90010, msg=0x144f390, msg_len=70, token_seq=277028) at totemrrp.c:694
No locals.
\#6 0x00007f264934710e in rrp_deliver_fn (context=0x144e4d0, msg=0x144f390, msg_len=70) at totemrrp.c:1781
token_seqid = 277028
token_is = 1
deliver_fn_context = 0x144e4d0
rrp_instance = 0x144dfa0
hdr = 0x144f390
tmp_msg = {type = 0 '\000', encapsulated = 0 '\000', endian_detector = 0, ring_number = 0, nodeid_activator = 0}
activate_msg = {type = 0 '\000', encapsulated = 0 '\000', endian_detector = 0, ring_number = 0, nodeid_activator = 0}
__FUNCTION__ = "rrp_deliver_fn"

\#7 0x00007f264933f1ae in net_deliver_fn (fd=10, revents=1, data=0x144ed00) at totemudp.c:1174
instance = 0x144ed00
msg_recv = {msg_name = 0x7fff532d3f50, msg_namelen = 16, msg_iov = 0x14541b0, msg_iovlen = 1, msg_control = 0x0, msg_controllen = 0, msg_flags = 0}
iovec = 0x14541b0
system_from = {ss_family = 2, __ss_align = 0, __ss_padding = "D\225\355H&\177\000\000@\241?\001\000\000\000\000\220I?\001\000\000\000\000P[G\001\002\000\000\000\320?-S\377\177\000\000\232q\355H&\177\000\000\260?-S\377\177\000\000\200@-S\377\177\000\000\002\000\000\000Q\334\260t\320\230?\001\000\000\000\000\320?-S\377\177\000\000\000\242?\001\000\000\000\000\t\000\000\000\002\000\000\000Q\334\260t\000\000\000"}
bytes_received = 70
res = 0
msg_offset = 0x144f390 ""
size_delv = 70
message_type = 0x144f390 ""
__FUNCTION__ = "net_deliver_fn"
\#8 0x00007f2648ed729a in _poll_dispatch_and_take_back_ (item=0x13fa200, p=QB_LOOP_MED) at loop_poll.c:196
pe = 0x13fa200
res = 0
__PRETTY_FUNCTION__ = "_poll_dispatch_and_take_back_"
__func__ = "_poll_dispatch_and_take_back_"
\#9 0x00007f2648ed6985 in qb_loop_run_level (level=0x13f3f78) at loop.c:45
job = 0x13fa200
iter = 0x13fa200
processed = 0
\#10 0x00007f2648ed6f60 in qb_loop_run (lp=0x13f3f40) at loop.c:206
p = 1
p_stop = 1
rc = 0
remaining_todo = 0
job_todo = 0
timer_todo = 1
ms_timeout = 0
l = 0x13f3f40
__func__ = "qb_loop_run"

\#11 0x000000000041d7f1 in main (argc=2, argv=0x7fff532d54f8, envp=0x7fff532d5510) at main.c:1270
error_string = 0x6c51c0 "Successfully read main configuration file '/etc/corosync/corosync.conf'."
totem_config = {version = 2, interfaces = 0x1402aa0, interface_count = 1, node_id = 0, clear_node_high_bit = 0, private_key = '\000' , private_key_len = 128, token_timeout = 1000, token_retransmit_timeout = 238, token_hold_timeout = 180, token_retransmits_before_loss_const = 4, join_timeout = 50, send_join_timeout = 0, consensus_timeout = 1200, merge_timeout = 200, downcheck_timeout = 1000, fail_to_recv_const = 2500, seqno_unchanged_const = 30, rrp_token_expired_timeout = 238, rrp_problem_count_timeout = 2000, rrp_problem_count_threshold = 10, rrp_problem_count_mcast_threshold = 100, rrp_autorecovery_check_timeout = 1000, rrp_mode = "none", '\000' , totem_logging_configuration = {log_printf = 0x41cbea <_logsys_log_printf>, log_level_security = 4, log_level_error = 3, log_level_warning = 4, log_level_notice = 5, log_level_debug = 7, log_subsys_id = 16}, secauth = 0, net_mtu = 1374, threads = 0, heartbeat_failures_allowed = 0, max_network_delay = 50, window_size = 50, max_messages = 17, vsf_type = 0x42d6fe "none", broadcast_use = 0, crypto_type = TOTEM_CRYPTO_SOBER, crypto_accept = TOTEM_CRYPTO_ACCEPT_OLD, crypto_crypt_type = 0, crypto_sign_type = 0, transport_number = TOTEM_TRANSPORT_UDP, miss_count_const = 5}
res = 0
ch = -1
background = 0
setprio = 0
stat_out = {st_dev = 64769, st_ino = 10695, st_nlink = 2, st_mode = 16877, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, st_size = 4096, st_blksize = 4096, st_blocks = 8, st_atim = {tv_sec = 1331026037, tv_nsec = 0}, st_mtim = {tv_sec = 1331026037, tv_nsec = 0}, st_ctim = {tv_sec = 1331200211, tv_nsec = 154000001}, __unused = {0, 0, 0}}
corosync_lib_dir = "/var/lib/corosync", '\000' , "/dev/shm/qb-corosync-blackbox-data\000r", '\000' "\253, \327VI&\177", '\000' , "p\001\000\000\000\000\000da\001\000\000\000\000\000da\001", '\000' , "\005\000\000\000\000\000\000\000\000`!\000\000\000\000\000\000p!\000\000\000\000\000`f!\000\000\000\000\000hf!\000\000\000\000\000\000`\001\000\000\000\000\000\003", '\000' "\260, \200wI&\177\000\000/\000\000\000\000\000\000\000\024oWI&\177\000\000\n\000\000\000\000\000\000\000"...
flock_err = COROSYNC_DONE_EXIT
totem_config_warnings = 0
__func__ = "main"