Graham Leggett created PROTON-1167: -------------------------------------- Summary: Qpid-proton: SIGSEGV crash when a queue becomes full Key: PROTON-1167 URL: https://issues.apache.org/jira/browse/PROTON-1167 Project: Qpid Proton Issue Type: Bug Components: proton-c Affects Versions: 0.12.0 Environment: CentOS7 (latest) qpid-proton-c-0.12.0-1.el7.x86_64
Reporter: Graham Leggett When qpid is asked to create a default queue as follows: {code} qpid-config add queue foo {code} And if an attempt is made to fill this queue to overflow with 1MB messages until we run out of space, qpid crashes as follows: {code} 2016-03-29 22:18:59 [Network] debug qpid.127.0.0.1:5672-127.0.0.1:43002 decoded 65536 bytes from 65536 2016-03-29 22:18:59 [Network] debug qpid.127.0.0.1:5672-127.0.0.1:43002 decoded 1016 bytes from 1016 2016-03-29 22:18:59 [Broker] debug received delivery: \xE4\x03\x00\x00\x00\x00\x00\x00 2016-03-29 22:18:59 [Broker] debug Message received: 1049552 bytes 2016-03-29 22:18:59 [System] debug Exception constructed: Maximum depth exceeded on foo: current=[count: 125, size: 103905496], max=[size: 104857600] (/builddir/build/BUILD/qpid-cpp-0.34/src/qpid/broker/Queue.cpp:1633) 2016-03-29 22:18:59 [Network] debug qpid.127.0.0.1:5672-127.0.0.1:43002 encoded 249 bytes from 65536 2016-03-29 22:18:59 [Network] debug qpid.127.0.0.1:5672-127.0.0.1:43002 decoded 51 bytes from 51 2016-03-29 22:18:59 [Broker] debug received delivery: \xE4\x03\x00\x00\x00\x00\x00\x00 2016-03-29 22:18:59 [Broker] debug Message received: 0 bytes 2016-03-29 22:18:59 [Broker] debug clean(): 125 messages remain; head is now 0 2016-03-29 22:18:59 [Broker] debug Message 0x69b2e0 published, state is 1 (head is now 0) 2016-03-29 22:18:59 [Broker] debug Message 126 enqueued on foo Program received signal SIGSEGV, Segmentation fault. pni_process_tpwork_receiver (settle=<synthetic pointer>, delivery=0x698550, transport=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2147 2147 if ((int16_t) ssn->state.local_channel >= 0 && !delivery->remote.settled && delivery->state.init) { Missing separate debuginfos, use: debuginfo-install boost-program-options-1.53.0-25.el7.x86_64 keyutils-libs-1.5.8-3.el7.x86_64 krb5-libs-1.13.2-10.el7.x86_64 libaio-0.3.109-13.el7.x86_64 libcom_err-1.42.9-7.el7.x86_64 libdb4-cxx-4.8.30-13.el7.x86_64 libselinux-2.2.2-6.el7.x86_64 libuuid-2.23.2-26.el7.x86_64 nss-softokn-freebl-3.16.2.3-13.el7_1.x86_64 pcre-8.32-15.el7.x86_64 xz-libs-5.1.2-12alpha.el7.x86_64 zlib-1.2.7-15.el7.x86_64 (gdb) bt #0 pni_process_tpwork_receiver (settle=<synthetic pointer>, delivery=0x698550, transport=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2147 #1 pni_process_tpwork (transport=transport@entry=0x7fffec01c710, endpoint=<optimized out>) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2181 #2 0x00007ffff3a898c1 in pni_process_tpwork (endpoint=<optimized out>, transport=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2164 #3 pni_phase (phase=<optimized out>, transport=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2381 #4 pni_process (transport=<optimized out>) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2399 #5 pn_output_write_amqp (transport=<optimized out>, layer=<optimized out>, bytes=0x7fffec00bf80 "", available=16384) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2550 #6 0x00007ffff3a8aacc in transport_produce (transport=transport@entry=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2603 #7 pn_transport_pending (transport=transport@entry=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2882 #8 0x00007ffff3a8acd7 in pn_transport_output (transport=0x7fffec01c710, bytes=0x7fffec02f280 "", size=65536) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2630 #9 0x00007ffff3d046ee in qpid::broker::amqp::Connection::encode (this=0x7fffec007780, buffer=0x7fffec02f280 "", size=65536) at /usr/src/debug/qpid-cpp-0.34/src/qpid/broker/amqp/Connection.cpp:233 #10 0x00007ffff749b3c4 in qpid::sys::AsynchIOHandler::idle (this=0x7fffec01ca30) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/AsynchIOHandler.cpp:221 #11 0x00007ffff74125a6 in operator() (a0=..., this=0x7fffec000d78) at /usr/include/boost/function/function_template.hpp:767 #12 qpid::sys::posix::AsynchIO::writeable (this=0x7fffec000b80, h=...) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/posix/AsynchIO.cpp:582 #13 0x00007ffff749dce1 in operator() (a0=..., this=<optimized out>) at /usr/include/boost/function/function_template.hpp:767 #14 qpid::sys::DispatchHandle::processEvent (this=0x7fffec000b88, type=qpid::sys::Poller::WRITABLE) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/DispatchHandle.cpp:283 #15 0x00007ffff743ac4e in process (this=<synthetic pointer>, this=<synthetic pointer>) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/Poller.h:131 #16 qpid::sys::Poller::run (this=0x659960) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/epoll/EpollPoller.cpp:522 #17 0x00007ffff79d54c8 in qpid::broker::Broker::run (this=0x65ca60) at /usr/src/debug/qpid-cpp-0.34/src/qpid/broker/Broker.cpp:530 #18 0x0000000000405dda in qpid::broker::QpiddBroker::execute (this=this@entry=0x7fffffffe11e, options=<optimized out>) at /usr/src/debug/qpid-cpp-0.34/src/posix/QpiddBroker.cpp:240 #19 0x0000000000409d04 in qpid::broker::run_broker (argc=1, argv=0x7fffffffe4b8, hidden=<optimized out>) at /usr/src/debug/qpid-cpp-0.34/src/qpidd.cpp:108 #20 0x00007ffff64e8b15 in __libc_start_main (main=0x404ce0 <main(int, char**)>, argc=1, ubp_av=0x7fffffffe4b8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe4a8) at libc-start.c:274 #21 0x0000000000404f51 in _start () (gdb) bt full #0 pni_process_tpwork_receiver (settle=<synthetic pointer>, delivery=0x698550, transport=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2147 link = 0x6987d0 ssn = 0xf10 #1 pni_process_tpwork (transport=transport@entry=0x7fffec01c710, endpoint=<optimized out>) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2181 tp_next = 0x0 settle = false link = <optimized out> dm = 0xfc0 conn = <optimized out> delivery = 0x698550 #2 0x00007ffff3a898c1 in pni_process_tpwork (endpoint=<optimized out>, transport=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2164 No locals. #3 pni_phase (phase=<optimized out>, transport=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2381 next = 0x0 conn = <optimized out> endpoint = <optimized out> #4 pni_process (transport=<optimized out>) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2399 err = 0 #5 pn_output_write_amqp (transport=<optimized out>, layer=<optimized out>, bytes=0x7fffec00bf80 "", available=16384) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2550 No locals. #6 0x00007ffff3a8aacc in transport_produce (transport=transport@entry=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2603 n = <optimized out> space = <optimized out> #7 pn_transport_pending (transport=transport@entry=0x7fffec01c710) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2882 No locals. #8 0x00007ffff3a8acd7 in pn_transport_output (transport=0x7fffec01c710, bytes=0x7fffec02f280 "", size=65536) at /usr/src/debug/qpid-proton-0.12.0/proton-c/src/transport/transport.c:2630 available = <optimized out> #9 0x00007ffff3d046ee in qpid::broker::amqp::Connection::encode (this=0x7fffec007780, buffer=0x7fffec02f280 "", size=65536) at /usr/src/debug/qpid-cpp-0.34/src/qpid/broker/amqp/Connection.cpp:233 __PRETTY_FUNCTION__ = "virtual size_t qpid::broker::amqp::Connection::encode(char*, size_t)" n = <optimized out> #10 0x00007ffff749b3c4 in qpid::sys::AsynchIOHandler::idle (this=0x7fffec01ca30) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/AsynchIOHandler.cpp:221 encoded = <optimized out> buff = 0x7fffec01c910 __PRETTY_FUNCTION__ = "void qpid::sys::AsynchIOHandler::idle(qpid::sys::AsynchIO&)" #11 0x00007ffff74125a6 in operator() (a0=..., this=0x7fffec000d78) at /usr/include/boost/function/function_template.hpp:767 No locals. ---Type <return> to continue, or q <return> to quit--- #12 qpid::sys::posix::AsynchIO::writeable (this=0x7fffec000b80, h=...) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/posix/AsynchIO.cpp:582 writeStartTime = {timepoint = 6055794320274} total = 0 writeCalls = 0 __PRETTY_FUNCTION__ = "void qpid::sys::posix::AsynchIO::writeable(qpid::sys::DispatchHandle&)" #13 0x00007ffff749dce1 in operator() (a0=..., this=<optimized out>) at /usr/include/boost/function/function_template.hpp:767 No locals. #14 qpid::sys::DispatchHandle::processEvent (this=0x7fffec000b88, type=qpid::sys::Poller::WRITABLE) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/DispatchHandle.cpp:283 __PRETTY_FUNCTION__ = "virtual void qpid::sys::DispatchHandle::processEvent(qpid::sys::Poller::EventType)" #15 0x00007ffff743ac4e in process (this=<synthetic pointer>, this=<synthetic pointer>) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/Poller.h:131 No locals. #16 qpid::sys::Poller::run (this=0x659960) at /usr/src/debug/qpid-cpp-0.34/src/qpid/sys/epoll/EpollPoller.cpp:522 ss = {__val = {18446744067267100671, 18446744073709551615 <repeats 15 times>}} __PRETTY_FUNCTION__ = "virtual void qpid::sys::Poller::run()" #17 0x00007ffff79d54c8 in qpid::broker::Broker::run (this=0x65ca60) at /usr/src/debug/qpid-cpp-0.34/src/qpid/broker/Broker.cpp:530 d = {<qpid::sys::Runnable> = {_vptr.Runnable = 0x7ffff7760b30 <vtable for qpid::sys::Dispatcher+16>}, poller = { px = 0x659960, pn = {pi_ = 0x65d4a0}}} numIOThreads = 2 t = std::vector of length 1, capacity 1 = {{impl = {px = 0x673d40, pn = {pi_ = 0x674300}}}} __PRETTY_FUNCTION__ = "virtual void qpid::broker::Broker::run()" #18 0x0000000000405dda in qpid::broker::QpiddBroker::execute (this=this@entry=0x7fffffffe11e, options=<optimized out>) at /usr/src/debug/qpid-cpp-0.34/src/posix/QpiddBroker.cpp:240 brokerPtr = {px = 0x65ca60} __PRETTY_FUNCTION__ = "int qpid::broker::QpiddBroker::execute(qpid::broker::QpiddOptions*)" #19 0x0000000000409d04 in qpid::broker::run_broker (argc=1, argv=0x7fffffffe4b8, hidden=<optimized out>) at /usr/src/debug/qpid-cpp-0.34/src/qpidd.cpp:108 bootOptions = {<qpid::Options> = {poOptions = {px = 0x6355f0, pn = {pi_ = 0x635660}}}, common = {<qpid::Options> = { poOptions = {px = 0x635700, pn = {pi_ = 0x635770}}}, help = false, version = false, config = "/etc/qpid/qpidd.conf", clientConfig = "/etc/qpid/qpidc.conf"}, module = {<qpid::Options> = { poOptions = {px = 0x636010, pn = {pi_ = 0x636080}}}, loadDir = "/usr/lib64/qpid/daemon", load = std::vector of length 0, capacity 0, noLoad = false}, log = {<qpid::Options> = {poOptions = { px = 0x6366d0, pn = {pi_ = 0x636740}}}, argv0 = "/usr/sbin/qpidd", name = "Logging options", selectors = std::vector of length 1, capacity 1 = {"debug"}, deselectors = std::vector of length 0, capacity 0, time = true, level = true, thread = false, source = false, function = false, hiresTs = false, category = true, trace = false, prefix = "", sinkOptions = {_M_ptr = 0x636760}}} defaultPath = "/usr/lib64/qpid/daemon" helpArgSeen = false broker = {<No data fields>} __PRETTY_FUNCTION__ = "int qpid::broker::run_broker(int, char**, bool)" #20 0x00007ffff64e8b15 in __libc_start_main (main=0x404ce0 <main(int, char**)>, argc=1, ubp_av=0x7fffffffe4b8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe4a8) at libc-start.c:274 result = <optimized out> ---Type <return> to continue, or q <return> to quit--- unwind_buf = {cancel_jmp_buf = {{jmp_buf = {0, -1649862660308191144, 4214568, 140737488348336, 0, 0, 1649862660174788696, 1649846041567836248}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x40c020 <__libc_csu_init>, 0x7fffffffe4b8}, data = {prev = 0x0, cleanup = 0x0, canceltype = 4243488}}} not_first_call = <optimized out> #21 0x0000000000404f51 in _start () No symbol table info available. {code} -- This message was sent by Atlassian JIRA (v6.3.4#6332)