Curl segfault in curl_multi_perform

From: Richard W.M. Jones via curl-library <curl-library_at_lists.haxx.se>
Date: Sun, 30 Jul 2023 19:26:58 +0100

Version: libcurl-8.2.1-1.fc39.x86_64

Any thoughts on the segfault below? This is most likely a bug in my
program, but I can't quite see exactly where. It only happens when I
crank the number of threads adding easy handles to >= 128.

'stream' is NULL.

Program terminated with signal SIGSEGV, Segmentation fault.

warning: Section `.reg-xstate/157722' in core file too small.
#0 stream_recv (cf=cf_at_entry=0x7fe0542a7260, data=data_at_entry=0x7fdd78001010,
    buf=buf_at_entry=0x7fe05423ce80 "", len=len_at_entry=16384,
    err=err_at_entry=0x7fe062a52824) at ../../lib/http2.c:1742
1742 if(!Curl_bufq_is_empty(&stream->recvbuf)) {
[Current thread is 1 (Thread 0x7fe062a536c0 (LWP 157722))]
(gdb) bt
#0 stream_recv (cf=cf_at_entry=0x7fe0542a7260, data=data_at_entry=0x7fdd78001010,
    buf=buf_at_entry=0x7fe05423ce80 "", len=len_at_entry=16384,
    err=err_at_entry=0x7fe062a52824) at ../../lib/http2.c:1742
#1 0x00007fe0632f58db in cf_h2_recv (cf=0x7fe0542a7260, data=0x7fdd78001010,
    buf=0x7fe05423ce80 "", len=16384, err=0x7fe062a52824)
    at ../../lib/http2.c:1844
#2 0x00007fe06331036e in Curl_read (data=<optimized out>,
    sockfd=<optimized out>, buf=<optimized out>,
    sizerequested=<optimized out>, n=0x7fe062a528d8) at ../../lib/sendf.c:415
#3 0x00007fe0633214f1 in readwrite_data (comeback=<optimized out>,
    done=<optimized out>, didwhat=<synthetic pointer>, k=0x7fdd780010f0,
    conn=0x7fe054240e90, data=0x7fdd78001010) at ../../lib/transfer.c:463
#4 Curl_readwrite (conn=0x7fe054240e90, data=0x7fdd78001010,
    done=<optimized out>, comeback=<optimized out>)
    at ../../lib/transfer.c:1118
#5 0x00007fe063308220 in multi_runsingle (multi=multi_at_entry=0x5581652ed530,
    nowp=nowp_at_entry=0x7fe062a52a50, data=data_at_entry=0x7fdd78001010)
    at ../../lib/multi.c:2459
#6 0x00007fe06330b405 in curl_multi_perform (multi=0x5581652ed530,
    running_handles=running_handles_at_entry=0x7fe062a52b70)
    at ../../lib/multi.c:2756
#7 0x00007fe063f44490 in process_multi_handle ()
    at /home/rjones/d/nbdkit/plugins/curl/pool.c:286
#8 pool_worker (vp=<optimized out>)
    at /home/rjones/d/nbdkit/plugins/curl/pool.c:243
#9 0x00007fe06388e887 in start_thread (arg=<optimized out>)
    at pthread_create.c:444
#10 0x00007fe06391592c in clone3 ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

The program is:

https://gitlab.com/rwmjones/nbdkit/-/blob/2023-curl-multi/plugins/curl/pool.c?ref_type=heads

There is only one thread running the multi handle, so I don't think
it's a corruption or locking problem. I think I'm checking the return
value of every curl call, and no errors are printed, so I don't think
curl is returning an error before the crash happens, unless I've
missed something.

Rich.

-- 
Richard Jones, Virtualization Group, Red Hat http://people.redhat.com/~rjones
Read my programming and virtualization blog: http://rwmj.wordpress.com
virt-top is 'top' for virtual machines.  Tiny program with many
powerful monitoring features, net stats, disk stats, logging, etc.
http://people.redhat.com/~rjones/virt-top
-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library
Etiquette:   https://curl.se/mail/etiquette.html

Received on 2023-07-30