From mboxrd@z Thu Jan 1 00:00:00 1970 From: ludo@gnu.org (Ludovic =?UTF-8?Q?Court=C3=A8s?=) Subject: bug#26976: On Hydra, offload crashes while trying to build linux-libre source Date: Fri, 19 May 2017 00:00:24 +0200 Message-ID: <87h90h966f.fsf@gnu.org> References: <87h90japz0.fsf@netris.org> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="=-=-=" Return-path: Received: from eggs.gnu.org ([2001:4830:134:3::10]:37451) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1dBTTn-0004ro-4r for bug-guix@gnu.org; Thu, 18 May 2017 18:01:08 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1dBTTi-0000C5-HQ for bug-guix@gnu.org; Thu, 18 May 2017 18:01:07 -0400 Received: from debbugs.gnu.org ([208.118.235.43]:51327) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1dBTTh-0000Bz-Sy for bug-guix@gnu.org; Thu, 18 May 2017 18:01:02 -0400 Sender: "Debbugs-submit" Resent-Message-ID: In-Reply-To: <87h90japz0.fsf@netris.org> (Mark H. Weaver's message of "Wed, 17 May 2017 21:55:15 -0400") List-Id: Bug reports for GNU Guix List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: bug-guix-bounces+gcggb-bug-guix=m.gmane.org@gnu.org Sender: "bug-Guix" To: Mark H Weaver Cc: Artyom Poptsov , 26976@debbugs.gnu.org --=-=-= Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Hi Mark, (Cc: Artyom. Artyom, this is about what looks like a bug in Guile-SSH when used with Guile 2.2; see .) Mark H Weaver skribis: > *** Error in `/gnu/store/5zx29y44nrqj0s8h3jlvlj82k8hj4dxs-guile-2.2.2/bin= /guile': realloc(): invalid next size: 0x00000000024617d0 *** > =3D=3D=3D=3D=3D=3D=3D Backtrace: =3D=3D=3D=3D=3D=3D=3D=3D=3D > /gnu/store/rmjlycdgiq8pfy5hfi42qhw3k7p6kdav-glibc-2.25/lib/libc.so.6(+0x7= 0fd5)[0x7f77e8343fd5] > /gnu/store/rmjlycdgiq8pfy5hfi42qhw3k7p6kdav-glibc-2.25/lib/libc.so.6(+0x7= 73a6)[0x7f77e834a3a6] > /gnu/store/rmjlycdgiq8pfy5hfi42qhw3k7p6kdav-glibc-2.25/lib/libc.so.6(+0x7= a3a9)[0x7f77e834d3a9] > /gnu/store/rmjlycdgiq8pfy5hfi42qhw3k7p6kdav-glibc-2.25/lib/libc.so.6(real= loc+0x156)[0x7f77e834e6e6] > /gnu/store/vlc43y485v80sgq7iw60hzy4pw5r52d2-libssh-0.7.4/lib/libssh.so.4(= +0xdc6b)[0x7f77e2e24c6b] > /gnu/store/vlc43y485v80sgq7iw60hzy4pw5r52d2-libssh-0.7.4/lib/libssh.so.4(= +0xddce)[0x7f77e2e24dce] > /gnu/store/vlc43y485v80sgq7iw60hzy4pw5r52d2-libssh-0.7.4/lib/libssh.so.4(= +0xe50a)[0x7f77e2e2550a] > /gnu/store/vlc43y485v80sgq7iw60hzy4pw5r52d2-libssh-0.7.4/lib/libssh.so.4(= +0xe7b2)[0x7f77e2e257b2] > /gnu/store/vlc43y485v80sgq7iw60hzy4pw5r52d2-libssh-0.7.4/lib/libssh.so.4(= ssh_channel_close+0x47)[0x7f77e2e27f87] > /gnu/store/avy681pwf979kbwiv9k75c5h7jdink2c-guile2.2-ssh-0.11.0/lib/libgu= ile-ssh.so.11(+0xa597)[0x7f77e3290597] > /gnu/store/5zx29y44nrqj0s8h3jlvlj82k8hj4dxs-guile-2.2.2/lib/libguile-2.2.= so.1(+0x83785)[0x7f77e9f00785] This looks like a double-free and =E2=80=98ssh_channel_close=E2=80=99 has o= nly one call site, which is =E2=80=98ptob_close=E2=80=99, the =E2=80=98close=E2=80=99 fu= nction for the channel port type in Guile-SSH. I=E2=80=99m quite confident that the attached patch fixes the problem. How= ever, I haven=E2=80=99t found a scenario in Guile 2.2 where the =E2=80=98close=E2= =80=99 method could be called more than once, and I cannot reproduce the bug on my machine. Thoughts? I suggest applying it to the =E2=80=98guile-ssh=E2=80=99 package in Guix. Thanks, Ludo=E2=80=99. --=-=-= Content-Type: text/x-patch Content-Disposition: inline diff --git a/libguile-ssh/channel-type.c b/libguile-ssh/channel-type.c index 3dd641f..0839854 100644 --- a/libguile-ssh/channel-type.c +++ b/libguile-ssh/channel-type.c @@ -229,10 +229,11 @@ ptob_close (SCM channel) ssh_channel_free (ch->ssh_channel); } + SCM_SETSTREAM (channel, NULL); + #if USING_GUILE_BEFORE_2_2 scm_gc_free (pt->write_buf, pt->write_buf_size, "port write buffer"); scm_gc_free (pt->read_buf, pt->read_buf_size, "port read buffer"); - SCM_SETSTREAM (channel, NULL); return 0; #endif diff --git a/libguile-ssh/sftp-file-type.c b/libguile-ssh/sftp-file-type.c index 8879924..f87cf03 100644 --- a/libguile-ssh/sftp-file-type.c +++ b/libguile-ssh/sftp-file-type.c @@ -224,10 +224,11 @@ ptob_close (SCM sftp_file) sftp_close (fd->file); } + SCM_SETSTREAM (sftp_file, NULL); + #if USING_GUILE_BEFORE_2_2 scm_gc_free (pt->write_buf, pt->write_buf_size, "port write buffer"); scm_gc_free (pt->read_buf, pt->read_buf_size, "port read buffer"); - SCM_SETSTREAM (sftp_file, NULL); return 1; #endif --=-=-=--