if_nameindex()/if_freenameindex() allocator inconsistency on Solaris 10 (amd64) ?

[Xavier Roche]

Hi folks!,

There seem to be a problem with if_nameindex()/if_freenameindex() when
loading libumem: the pointer allocated by if_nameindex() can not be
free's by if_freenameindex()

Executing the following test case either with:
LD_PRELOAD=libumem.so.1
or with
-lumem

Is causing an abort inside the free function:

Program received signal SIGABRT, Aborted.
[Switching to Thread 1 (LWP 1)]
0xfee2bb95 in _lwp_kill () from /lib/libc.so.1
(gdb) where
#0 0xfee2bb95 in _lwp_kill () from /lib/libc.so.1
#1 0xfee26a24 in thr_kill () from /lib/libc.so.1
#2 0xfedd2d8b in raise () from /lib/libc.so.1
#3 0xfeeb6069 in umem_do_abort () from /lib/libumem.so.1
#4 0xfeeb6199 in umem_err_recoverable () from /lib/libumem.so.1
#5 0xfeeb7e66 in process_free () from /lib/libumem.so.1
#6 0xfeeb7f0b in free () from /lib/libumem.so.1
#7 0xfeef6e4f in if_freenameindex () from /lib/libsocket.so.1
#8 0x08050921 in main ()

(tested with Sun cc and gcc)

Test case:
----------

#include <stdio.h>
#include <stdlib.h>
#include <net/if.h>

#undef if_nameindex
#undef if_freenameindex

int main(void) {
struct if_nameindex *interfaceList = if_nameindex();
struct if_nameindex *ptr;
for (ptr = interfaceList; ptr && ptr->if_name; ++ptr)
printf("%s\n", ptr->if_name);

if_freenameindex(interfaceList);

return EXIT_SUCCESS;
}

(This problem was also reproduced with a fresh build of Qt, which is
using the same logic)

Is this a known issue/incompatibility ?

Any insightful comment is welcome :)

[Xavier Roche]

int main(void) {
struct if_nameindex *const interfaceList = if_nameindex();

struct if_nameindex *ptr;
for (ptr = interfaceList; ptr && ptr->if_name; ++ptr)
printf("%s\n", ptr->if_name);

if_freenameindex(interfaceList);

return EXIT_SUCCESS;
}

A possible workaround is to do the following:
#define if_freenameindex free

Which suggests an allocator issue ..

[Ian Collins]

> for (ptr = interfaceList; ptr&& ptr->if_name; ++ptr)

> printf("%s\n", ptr->if_name);
>
> if_freenameindex(interfaceList);
>
> return EXIT_SUCCESS;
> }
>
> A possible workaround is to do the following:
> #define if_freenameindex free
>
> Which suggests an allocator issue ..
>
> (This problem was also reproduced with a fresh build of Qt, which is
> using the same logic)
>
> Is this a known issue/incompatibility ?

I tried your test case on S11 Express and it worked without error:

leonardo> c99 /tmp/x.c -lsocket -lumem
leonardo> ./a.out
lo0
igb0
vboxnet0

It does crash in Solaris 10, so it looks like a known, fixed, problem.

--
Ian Collins

[Xavier Roche]

Le 15/09/2011 21:35, Ian Collins a écrit :
> I tried your test case on S11 Express and it worked without error:

> It does crash in Solaris 10, so it looks like a known, fixed, problem.

Thanks for the feedback -- it appears to crash on a Solaris 10 machine
with 144489-17 patch (June 2011), and I can't seem to find any recent
patch with umem fixes..

[Ian Collins]

The version of libumem in 11 Express is dated Nov 18, so the fix would
be quite old.

--
Ian Collins

[Xavier Roche]

On 09/15/2011 10:08 PM, Ian Collins wrote:
> The version of libumem in 11 Express is dated Nov 18, so the fix would
> be quite old.

I suspect a problem in libsocket.so.1 (/lib/amd64/libsocket.so.1),
actually. My version is Sep 22, 2010.

A possible scenario would be that libsocket.so.1's if_nameindex() is
somehow using directly libc's allocator, rather than malloc (?)

[Ian Collins]

Newer in 11 Express: Nov 18 2010 /lib/amd64/libsocket.so.1

--
Ian Collins

[Ian Collins]

On 09/16/11 08:48 PM, Xavier Roche wrote:

That looks like a good guess, I tried mtmalloc with your code:

c99 /tmp/x.c -lsocket -lmtmalloc -g

./a.out
lo0
vnic0
Segmentation Fault (core dumped)

--
Ian Collins

[Xavier Roche]

Le 16/09/2011 21:33, Ian Collins a écrit :
> That looks like a good guess, I tried mtmalloc with your code:
> c99 /tmp/x.c -lsocket -lmtmalloc -g

> Segmentation Fault (core dumped)

Ah, darn.

Does anyone know how to report the issue to Sun^WOracle ? (I am supposed
to have access to Solaris patches and support through Oracle, but the
support renewal has been stuck in some bureaucratic issues for six
months now)

On the meantime, I reported the issue on the OpenSolaris side
(<https://defect.opensolaris.org/bz/show_bug.cgi?id=18940>), but there
does not seem to be any activity recently ...

And for Qt fans (this was the original issue), I posted a workaround for
Solaris
<http://lists.qt.nokia.com/pipermail/qt-interest/2011-September/035896.html>

[Ian Collins]

On 09/17/11 09:22 PM, Xavier Roche wrote:
> Le 16/09/2011 21:33, Ian Collins a écrit :
>> That looks like a good guess, I tried mtmalloc with your code:
>> c99 /tmp/x.c -lsocket -lmtmalloc -g
>> Segmentation Fault (core dumped)
>
> Ah, darn.
>
> Does anyone know how to report the issue to Sun^WOracle ? (I am supposed
> to have access to Solaris patches and support through Oracle, but the
> support renewal has been stuck in some bureaucratic issues for six
> months now)

Try update 10 in a VM and see if it has been fixed.

--
Ian Collins

[Xavier Roche]

Le 17/09/2011 12:30, Ian Collins a écrit :
> Try update 10 in a VM and see if it has been fixed.

Still buggy in patch 147441-01 (2011-09-05)

[Xavier Roche]

On 09/15/2011 08:14 PM, Xavier Roche wrote:
> There seem to be a problem with if_nameindex()/if_freenameindex() when
> loading libumem: the pointer allocated by if_nameindex() can not be
> free's by if_freenameindex()

In progress on the Oracle side (Oracle internal CR 6893022) according to
the opensolaris team, and fixed in Open Solaris 11.