From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <david@tethera.net>
Received: from localhost (localhost [127.0.0.1])
 by arlo.cworth.org (Postfix) with ESMTP id 9A6E16DE17EE
 for <notmuch@notmuchmail.org>; Mon, 18 Jan 2016 04:25:11 -0800 (PST)
X-Virus-Scanned: Debian amavisd-new at cworth.org
X-Spam-Flag: NO
X-Spam-Score: -0.309
X-Spam-Level: 
X-Spam-Status: No, score=-0.309 tagged_above=-999 required=5 tests=[AWL=0.242, 
 RP_MATCHES_RCVD=-0.55, SPF_PASS=-0.001] autolearn=disabled
Received: from arlo.cworth.org ([127.0.0.1])
 by localhost (arlo.cworth.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id kXW4jvx62y_V for <notmuch@notmuchmail.org>;
 Mon, 18 Jan 2016 04:25:07 -0800 (PST)
Received: from fethera.tethera.net (fethera.tethera.net [198.245.60.197])
 by arlo.cworth.org (Postfix) with ESMTPS id 166956DE17DC
 for <notmuch@notmuchmail.org>; Mon, 18 Jan 2016 04:25:06 -0800 (PST)
Received: from remotemail by fethera.tethera.net with local (Exim 4.84)
 (envelope-from <david@tethera.net>)
 id 1aL8rB-0004AY-4E; Mon, 18 Jan 2016 07:24:25 -0500
Received: (nullmailer pid 29568 invoked by uid 1000);
 Mon, 18 Jan 2016 12:25:00 -0000
From: David Bremner <david@tethera.net>
To: Gaute Hope <eg@gaute.vetsj.com>, notmuch@notmuchmail.org
Subject: Re: talloc_abort in notmuch_thread_get_tags () when db has been
 modified
In-Reply-To: <1453106256-astroid-0-0ubhau8qws-26019@strange>
References: <1453106256-astroid-0-0ubhau8qws-26019@strange>
User-Agent: Notmuch/0.21+26~g9404723 (http://notmuchmail.org) Emacs/24.5.1
 (x86_64-pc-linux-gnu)
Date: Mon, 18 Jan 2016 08:25:00 -0400
Message-ID: <87k2n72hyb.fsf@zancas.localnet>
MIME-Version: 1.0
Content-Type: text/plain
X-BeenThere: notmuch@notmuchmail.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: "Use and development of the notmuch mail system."
 <notmuch.notmuchmail.org>
List-Unsubscribe: <https://notmuchmail.org/mailman/options/notmuch>,
 <mailto:notmuch-request@notmuchmail.org?subject=unsubscribe>
List-Archive: <http://notmuchmail.org/pipermail/notmuch/>
List-Post: <mailto:notmuch@notmuchmail.org>
List-Help: <mailto:notmuch-request@notmuchmail.org?subject=help>
List-Subscribe: <https://notmuchmail.org/mailman/listinfo/notmuch>,
 <mailto:notmuch-request@notmuchmail.org?subject=subscribe>
X-List-Received-Date: Mon, 18 Jan 2016 12:25:11 -0000

Gaute Hope <eg@gaute.vetsj.com> writes:

> Hi,
>
> a user of astroid [0] ran into a issue [1] (full trace at issue) where
> reading a long query causes a talloc_abort in notmuch_thread_get_tags
> (). 'notmuch new' is running at the same time, and most likely a thread
> in the query has been modified since the query was done. Note that a
> notmuch_thread_get_authors () call returns NULL without causing a full
> crash. The code causing the crash is:
>
> ```
>     for (tags = notmuch_thread_get_tags (nm_thread);
>          notmuch_tags_valid (tags);
>          notmuch_tags_move_to_next (tags))
>     {
>       tag = notmuch_tags_get (tags); // tag belongs to tags
>     }
>
>     // or db.cc:508 in astroid/src.
> ```
>

The most likely cause of such a crash looks to me like nm_thread is NULL
or corrupted when passed in to get_tags. It's used without checking as a
talloc context, and that call to talloc never returns.