Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1360209 - dleyna-renderer: Crashes when trying to access invalid GHashTables (dlr_upnp_t->server_udn_map, dlr_upnp_t->server_uc_map)
Summary: dleyna-renderer: Crashes when trying to access invalid GHashTables (dlr_upnp_...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: dleyna-renderer
Version: 24
Hardware: x86_64
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Debarshi Ray
QA Contact: Fedora Extras Quality Assurance
URL: https://retrace.fedoraproject.org/faf...
Whiteboard: abrt_hash:7a61ed58add666aabc4d7507176...
: 1215332 1220876 1258636 1287072 1319000 1331404 1359750 (view as bug list)
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-07-26 08:57 UTC by Maël Lavault
Modified: 2020-12-02 00:48 UTC (History)
6 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-09-26 00:20:40 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)
File: backtrace (18.10 KB, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: cgroup (259 bytes, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: core_backtrace (3.59 KB, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: dso_list (4.56 KB, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: environ (988 bytes, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: limits (1.29 KB, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: maps (22.53 KB, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: mountinfo (3.69 KB, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: namespaces (102 bytes, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: open_fds (865 bytes, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: proc_pid_status (1.11 KB, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
File: var_log_messages (28 bytes, text/plain)
2016-07-26 08:57 UTC, Maël Lavault 		no flags Details
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1205574 0 unspecified CLOSED dleyna-server: Crashes when trying to access invalid GHashTables (dls_upnp_t->device_udn_map, dls_upnp_t->device_uc_map) 2022-05-16 11:32:56 UTC

Internal Links: 1205574

Description Maël Lavault 2016-07-26 08:57:10 UTC 
Version-Release number of selected component:
dleyna-renderer-0.5.0-4.fc24

Additional info:
reporter:       libreport-2.7.2
backtrace_rating: 4
cmdline:        /usr/libexec/dleyna-renderer-service
crash_function: g_hash_table_lookup_node
executable:     /usr/libexec/dleyna-renderer-service
global_pid:     19171
kernel:         4.6.4-301.fc24.x86_64
pkg_fingerprint: 73BD E983 81B4 6521
pkg_vendor:     Fedora Project
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #4 g_hash_table_lookup_node at ghash.c:373
 #5 g_hash_table_insert_internal at ghash.c:1227
 #6 prv_device_chain_end at upnp.c:85
 #7 prv_free_cb at libdleyna/core/task-processor.c:103
 #8 g_hash_table_remove_all_nodes at ghash.c:548
 #10 g_hash_table_unref at ghash.c:1097
 #11 dleyna_task_processor_free at libdleyna/core/task-processor.c:136
 #12 prv_context_free at libdleyna/core/main-loop.c:108
 #13 dleyna_main_loop_start at libdleyna/core/main-loop.c:167
 #15 _start

Potential duplicate: bug 1220876
Comment 1 Maël Lavault 2016-07-26 08:57:15 UTC 
Created attachment 1184105 [details]
File: backtrace
Comment 2 Maël Lavault 2016-07-26 08:57:16 UTC 
Created attachment 1184106 [details]
File: cgroup
Comment 3 Maël Lavault 2016-07-26 08:57:17 UTC 
Created attachment 1184107 [details]
File: core_backtrace
Comment 4 Maël Lavault 2016-07-26 08:57:18 UTC 
Created attachment 1184108 [details]
File: dso_list
Comment 5 Maël Lavault 2016-07-26 08:57:20 UTC 
Created attachment 1184109 [details]
File: environ
Comment 6 Maël Lavault 2016-07-26 08:57:21 UTC 
Created attachment 1184110 [details]
File: limits
Comment 7 Maël Lavault 2016-07-26 08:57:23 UTC 
Created attachment 1184112 [details]
File: maps
Comment 8 Maël Lavault 2016-07-26 08:57:24 UTC 
Created attachment 1184113 [details]
File: mountinfo
Comment 9 Maël Lavault 2016-07-26 08:57:25 UTC 
Created attachment 1184114 [details]
File: namespaces
Comment 10 Maël Lavault 2016-07-26 08:57:27 UTC 
Created attachment 1184115 [details]
File: open_fds
Comment 11 Maël Lavault 2016-07-26 08:57:28 UTC 
Created attachment 1184117 [details]
File: proc_pid_status
Comment 12 Maël Lavault 2016-07-26 08:57:30 UTC 
Created attachment 1184118 [details]
File: var_log_messages
Comment 13 Debarshi Ray 2016-09-15 08:28:56 UTC 
*** Bug 1220876 has been marked as a duplicate of this bug. ***
Comment 14 Debarshi Ray 2016-09-15 08:29:04 UTC 
*** Bug 1319000 has been marked as a duplicate of this bug. ***
Comment 15 Debarshi Ray 2016-09-15 08:36:16 UTC 
In frame #2, we are hitting this assertion:
hash_table->ref_count > 0

Thread 1 (Thread 0x7ff4a581c880 (LWP 19171)):
#0  0x00007ff4a32f56f5 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:54
        resultvar = 0
        pid = 19171
        selftid = 19171
#1  0x00007ff4a32f72fa in __GI_abort () at abort.c:89
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x0, sa_sigaction = 0x0}, sa_mask = {__val = {0, 94, 94689405002016, 95, 140688698862752, 140688696272048, 140735615381008, 94689411297920, 140688686850732, 94689405002016, 140688690240256, 95, 140688698862752, 140688696272048, 94689405002016, 95}}, sa_flags = -1544852320, sa_restorer = 0x7ff4a3c3e4b0 <__func__.10228>}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007ff4a3c17f05 in g_assertion_message (domain=domain@entry=0x7ff4a3c3988e "GLib", file=file@entry=0x7ff4a3c3e212 "ghash.c", line=line@entry=373, func=func@entry=0x7ff4a3c3e4b0 <__func__.10228> "g_hash_table_lookup_node", message=message@entry=0x561e98bec300 "assertion failed: (hash_table->ref_count > 0)") at gtestutils.c:2429
        lstr = "373\000\377\177\000\000\000I,\215\317\347mvPAU\230\036V\000\000\370\341\303\243\364\177\000"
        s = 0x561e98596120 ""
#3  0x00007ff4a3c17f9a in g_assertion_message_expr (domain=domain@entry=0x7ff4a3c3988e "GLib", file=file@entry=0x7ff4a3c3e212 "ghash.c", line=line@entry=373, func=func@entry=0x7ff4a3c3e4b0 <__func__.10228> "g_hash_table_lookup_node", expr=expr@entry=0x7ff4a3c3e1f8 "hash_table->ref_count > 0") at gtestutils.c:2452
        s = 0x561e98bec300 "assertion failed: (hash_table->ref_count > 0)"
#4  0x00007ff4a3be0f36 in g_hash_table_lookup_node (hash_return=<synthetic pointer>, key=0x561e98ca21c0, hash_table=0x561e985899e0) at ghash.c:373
        hash_table = 0x561e985899e0
        key = 0x561e98ca21c0
        hash_return = <synthetic pointer>
        node_hash = <optimized out>
        hash_value = <optimized out>
        have_tombstone = 0
        step = 0
        node_index = <optimized out>
        first_tombstone = 0
#5  g_hash_table_insert_internal (hash_table=0x561e985899e0, key=0x561e98ca21c0, value=0x561e98a581f0, keep_new_key=0) at ghash.c:1227
        key_hash = <optimized out>
#6  0x00007ff4a541f4fb in prv_device_chain_end (cancelled=<optimized out>, data=0x561e98e3acb0) at upnp.c:85
        device = 0x561e98a581f0
        priv_t = 0x561e98e3acb0
#7  0x00007ff4a520c690 in prv_free_cb (data=0x561e98b97280) at libdleyna/core/task-processor.c:103
        task_queue = 0x561e98b97280
Comment 16 Debarshi Ray 2016-09-15 08:37:18 UTC 
*** Bug 1258636 has been marked as a duplicate of this bug. ***
Comment 17 Debarshi Ray 2016-09-15 08:52:01 UTC 
*** Bug 1331404 has been marked as a duplicate of this bug. ***
Comment 18 Debarshi Ray 2016-09-15 08:52:03 UTC 
*** Bug 1215332 has been marked as a duplicate of this bug. ***
Comment 19 Debarshi Ray 2016-09-15 08:53:40 UTC 
*** Bug 1359750 has been marked as a duplicate of this bug. ***
Comment 20 Debarshi Ray 2016-09-15 15:37:03 UTC 
*** Bug 1287072 has been marked as a duplicate of this bug. ***
Comment 21 Debarshi Ray 2016-09-16 07:14:04 UTC 
This is caused by dleyna_task_processor_t->on_quit_cb being run while there are still queues present in the processor. Filed as https://github.com/01org/dleyna-core/pull/49
Comment 22 Debarshi Ray 2016-09-16 15:24:54 UTC 
Similar dleyna-server bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1205574
Comment 23 Fedora Update System 2016-09-22 09:55:42 UTC 
dleyna-core-0.5.0-4.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-8b47d28f07
Comment 24 Fedora Update System 2016-09-23 06:54:20 UTC 
dleyna-core-0.5.0-3.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-d3927e6a71
Comment 25 Fedora Update System 2016-09-23 08:01:37 UTC 
dleyna-core-0.5.0-4.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-603b9f4445
Comment 26 Fedora Update System 2016-09-26 00:20:40 UTC 
dleyna-core-0.5.0-4.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 27 Fedora Update System 2016-09-27 00:34:30 UTC 
dleyna-core-0.5.0-4.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report.
Comment 28 Fedora Update System 2016-10-03 20:19:58 UTC 
dleyna-core-0.5.0-3.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 29 Debarshi Ray 2020-12-02 00:48:37 UTC 
*** Bug 1215332 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.