It turns out that the frament to be freed has size 0, which should not
happen -- maybe another invalid memset somewhere.
Can you get:
frame 3
info locals
p *dead_cell
p dead_cell->uac[i]
p dead_cell->uac[i].request.buffer
Daniel
On 23/09/15 10:33, Juha Heinanen wrote:
Daniel-Constantin Mierla writes:
I am investigating. Can you get the following:
frame 0
info locals
p *qm
p *frag
frame 1
info locals
p *f
p *n
below, juha
(gdb) where
#0 0x0000000000641acc in fm_extract_free (qm=0x7f28c8dd4000,
frag=0x7f28c958e4a0) at mem/f_malloc.c:181
#1 0x0000000000643689 in fm_join_frag (qm=0x7f28c8dd4000, f=0x7f28c958e468)
at mem/f_malloc.c:556
#2 0x00000000006445ac in fm_free (qmp=0x7f28c8dd4000, p=0x7f28c958e4a0,
file=0x7f28ce687f1d "tm: h_table.c",
func=0x7f28ce6881bb <__FUNCTION__.9593> "free_cell", line=162)
at mem/f_malloc.c:624
#3 0x00007f28ce5c1c12 in free_cell (dead_cell=0x7f28c95eb6c0) at h_table.c:162
#4 0x00007f28ce64449e in wait_handler (ti=1463515017, wait_tl=0x7f28c95eb740,
data=0x7f28c95eb6c0) at timer.c:648
#5 0x00000000004aaf88 in timer_list_expire (t=1463515017, h=0x7f28c8e21360,
slow_l=0x7f28c8e21e38, slow_mark=153) at timer.c:873
#6 0x00000000004ab3e5 in timer_handler () at timer.c:938
#7 0x00000000004ab853 in timer_main () at timer.c:977
#8 0x000000000052f690 in main_loop () at main.c:1650
#9 0x00000000005354e8 in main (argc=17, argv=0x7ffcfb5ef7a8) at main.c:2566
(gdb) frame 0
#0 0x0000000000641acc in fm_extract_free (qm=0x7f28c8dd4000,
frag=0x7f28c958e4a0) at mem/f_malloc.c:181
181 in mem/f_malloc.c
(gdb) info locals
hash = 0
(gdb) p *qm
$1 = {type = 0, size = 33554432, used = 9897648, real_used = 12086720,
max_real_used = 14388152, ffrags = 458, first_frag = 0x7f28c8ddc478,
last_frag = 0x7f28cadd3fc8, free_bitmap = {16744946372034692092,
1120719044992065561, 9339679536520168981, 14286416929179686995,
5188168829682976772, 72568841176608, 2199023255697, 2305983746702065672,
4400193994756, 1152921504607044097, 9225638267758575627, 6825836904710912,
720584873920708608, 1125904211148800, 2594108569737560064, 207248951816,
289356276595425280, 8, 283673999966208, 0, 1125968626319360,
18014398931009538, 281477258412032, 289360674110316552, 72057600811729160,
9277486150884524064, 549793563782, 72092778410573824, 2314850345907519488,
1152930300699869184, 70368744177674, 9223372036854780096, 2054},
free_hash = {{first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c9522710, no = 2}, {first = 0x7f28c97a0b38, no = 5}, {
first = 0x7f28c952a888, no = 2}, {first = 0x7f28c95227b0, no = 3}, {
first = 0x7f28c970ff08, no = 1}, {first = 0x7f28c95e7eb0, no = 1}, {
first = 0x7f28c952a348, no = 1}, {first = 0x7f28c95b1258, no = 1}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c96e3730, no = 1}, {first = 0x7f28c952f1d8, no = 1}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c97391d8, no = 1}, {first = 0x7f28c955d0b8, no = 1}, {
---Type <return> to continue, or q <return> to quit---
first = 0x7f28c96a6008, no = 6}, {first = 0x0,
no = 0} <repeats 16 times>, {first = 0x7f28c957b590, no = 1}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c9752fd0, no = 1}, {first = 0x7f28c95db260, no = 1}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x7f28c9789cc0, no = 1}, {first = 0x0,
no = 0}, {first = 0x7f28c97a06e0, no = 1}, {first = 0x7f28c96a6140,
no = 3}, {first = 0x7f28c9769bd8, no = 2}, {first = 0x7f28c97a0900,
no = 1}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c95e8280, no = 1}, {first = 0x7f28c9769e08, no = 1}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f28c966cec0,
no = 9}, {first = 0x7f28c9602d30, no = 2}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f28c976a060,
no = 1}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0,
no = 0}, {first = 0x7f28c95eb3a0, no = 14}, {first = 0x7f28c9577ef8,
no = 4}, {first = 0x7f28c97ca3b0, no = 1}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x7f28c95b1788, no = 1}, {
first = 0x7f28c9744960, no = 1}, {first = 0x0, no = 0}, {first = 0x0,
no = 0}, {first = 0x7f28c97a7f98, no = 1}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f28c96c44f0,
no = 2}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0,
no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0,
---Type <return> to continue, or q <return> to quit---
no = 0}, {first = 0x0, no = 0}, {first = 0x7f28c97a7c08, no = 1}, {
first = 0x7f28c96c3870, no = 4}, {first = 0x0, no = 0}, {first = 0x0,
no = 0}, {first = 0x7f28c9605e20, no = 7}, {first = 0x7f28c97921b0,
no = 1}, {first = 0x0, no = 0}, {first = 0x7f28c97e85c0, no = 1}, {
first = 0x7f28c95e84d0, no = 1}, {first = 0x0, no = 0}, {first = 0x0,
no = 0}, {first = 0x0, no = 0}, {first = 0x7f28c9717828, no = 3}, {
first = 0x7f28c95b1390, no = 1}, {first = 0x7f28c96061d0, no = 5}, {
first = 0x7f28c96481a0, no = 2}, {first = 0x7f28c96e2b20, no = 12}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x7f28c9707648, no = 1}, {first = 0x0,
no = 0}, {first = 0x7f28c9734ed0, no = 2}, {first = 0x0, no = 0}, {
first = 0x7f28c9718698, no = 2}, {first = 0x0, no = 0}, {first = 0x0,
no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c97a84c0, no = 1}, {first = 0x7f28c96dade0, no = 3}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f28c97ce2b0,
no = 1}, {first = 0x0, no = 0}, {first = 0x7f28c959cba0, no = 9}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c97bf110, no = 2}, {first = 0x0, no = 0}, {first = 0x0,
no = 0}, {first = 0x7f28c96f8410, no = 1}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c9798e30, no = 1}, {first = 0x7f28c9577370, no = 17}, {
first = 0x7f28c96b56d0, no = 8}, {first = 0x0, no = 0}, {first = 0x0,
---Type <return> to continue, or q <return> to quit---
no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c96ddf70, no = 3}, {first = 0x0, no = 0}, {
first = 0x7f28c97cdb30, no = 3}, {first = 0x0, no = 0}, {
first = 0x7f28c9779298, no = 1}, {first = 0x7f28c975aa68, no = 1}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f28c97e4bd8,
no = 2}, {first = 0x0, no = 0}, {first = 0x7f28c95c05a8, no = 1}, {
first = 0x7f28c9771490, no = 1}, {first = 0x7f28c9633350, no = 1}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f28c9746450,
no = 3}, {first = 0x7f28c96c3c08, no = 1}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x0, no = 0}, {first = 0x0, no = 0}, {first = 0x7f28c96a0710,
no = 3}, {first = 0x7f28c95ead68, no = 10}, {first = 0x7f28c95778b8,
no = 4}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c95e8f40, no = 1}, {first = 0x0, no = 0}, {
first = 0x7f28c9771a60, no = 1}, {first = 0x0, no = 0}, {first = 0x0,
no = 0}, {first = 0x0, no = 0}, {first = 0x0, no = 0}, {
first = 0x7f28c96a3e58, no = 2}, {first = 0x7f28c97bea78, no = 2}, {
first = 0x0, no = 0}...}}
(gdb) p *frag
$2 = {size = 3, u = {nxt_free = 0x7f28c958d833, reserved = 139813153462323},
prv_free = 0x25, file = 0x0,
func = 0x5 <error: Cannot access memory at address 0x5>,
line = 139813153462362, check = 4}
(gdb) frame 1
#1 0x0000000000643689 in fm_join_frag (qm=0x7f28c8dd4000, f=0x7f28c958e468)
at mem/f_malloc.c:556
556 in mem/f_malloc.c
(gdb) info locals
n = 0x7f28c958e4a0
(gdb) p *f
$3 = {size = 0, u = {nxt_free = 0x0, reserved = 0}, prv_free = 0x0,
file = 0x7f28ce687f1d "tm: h_table.c",
func = 0x7f28ce6881bb <__FUNCTION__.9593> "free_cell", line = 162,
check = 139813153462319}
(gdb) p *n
$4 = {size = 3, u = {nxt_free = 0x7f28c958d833, reserved = 139813153462323},
prv_free = 0x25, file = 0x0,
func = 0x5 <error: Cannot access memory at address 0x5>,
line = 139813153462362, check = 4}
(gdb)