curl / Mailing Lists / curl-library / Single Mail
Buy commercial curl support. We help you work out your issues, debug your libcurl applications, use the API, port to new platforms, add new features and more. With a team lead by the curl founder Daniel himself.

Re: crash in Curl_getaddrinfo_ex using libcurl 8.11.1

From: Vadim Grinshpun via curl-library <curl-library_at_lists.haxx.se>
Date: Mon, 24 Mar 2025 17:09:59 -0400

On 3/22/25 4:46 AM, Dimitry Andric wrote:
> On 22 Mar 2025, at 01:38, Vadim Grinshpun via curl-library<curl-library_at_lists.haxx.se> wrote:
>> A program that has been happily using libcurl for years
>> started crashing when we upgraded libcurl from 8.10.1 to 8.11.1.
>>
>> I was hoping the good folks here might be able
>> to point me in the right direction; the crash is within a libcurl getaddrinfo call.
>> A sample gdb stack trace is at the end of the email.
>>
>> - the OS is Ubuntu 22.04.5 LTS.
>> - there were no code changes in the program, just dependency updates
>> - the program is multi-threaded
>>
>> Based on the fact that 'getaddrinfo' is mentioned in the stack trace, I wonder if this is somehow related
>> to a PR that was merged into 8.11.0:https://urldefense.com/v3/__https://github.com/curl/curl/pull/15475__;!!GjvTz_vk!QrCf9SwlKrT6Fzuvea2B4WPjxNlTijbGctSjR6q9D1hVnmI8ANyj08qFnrd7FHoTidEuIx8UodJW_JejhOz5-g-j$
>>
>> Thanks for any help! And let me know if any other information would be useful.
>>
>> -Vadim
>> <original trace snipped out>
> In my experience, this indicates that some other thread is accidentally
> closing the file descriptor that getaddrinfo uses internally to
> enumerate the interfaces. Typically, because of a double-close of an
> unrelated file descriptor.
>
> Maybe you can install the libc6-dbg package, to get some more
> information about the functions marked with "??" in the stack trace?
> That would make it easier to determine whether a close-race is the cause
> of the crash.
>
> -Dimitry
Thanks. I've done that, the updated backtrace is below.

I've also checked what the other threads are doing,
and it looks like two are in the middle of calling getaddrinfo_thread()
at the time of the crash, I'm including backtraces for those as well
(see below).
Thanks!
-Vadim


Thread 1 (Thread 0x7fa1babfe640 (LWP 2669555)):
[custom signal handler bits removed for brevity]
#7  __pthread_kill_implementation (no_tid=0, signo=6,
threadid=140332599600704) at ./nptl/pthread_kill.c:44
#8  __pthread_kill_internal (signo=6, threadid=140332599600704) at
./nptl/pthread_kill.c:78
#9  __GI___pthread_kill (threadid=140332599600704, signo=signo_at_entry=6)
at ./nptl/pthread_kill.c:89
#10 0x00007fa1bf442476 in __GI_raise (sig=sig_at_entry=6) at
../sysdeps/posix/raise.c:26
#11 0x00007fa1bf4287f3 in __GI_abort () at ./stdlib/abort.c:79
#12 0x00007fa1bf48945c in __libc_message (action=do_abort,
fmt=0x7fa1bf5db7ad "%s", fmt=0x7fa1bf5db7ad "%s", action=do_abort) at
../sysdeps/posix/libc_fatal.c:155
#13 0x00007fa1bf489770 in __GI___libc_fatal (message=<optimized out>) at
../sysdeps/posix/libc_fatal.c:164
#14 0x00007fa1bf5446af in __GI___netlink_assert_response
(fd=fd_at_entry=23, result=result_at_entry=-1) at
../sysdeps/unix/sysv/linux/netlink_assert_response.c:103
#15 0x00007fa1bf543e1e in make_request (pid=<optimized out>, fd=23) at
../sysdeps/unix/sysv/linux/check_pf.c:171
#16 __check_pf (seen_ipv4=seen_ipv4_at_entry=0x7fa1babf95a6,
seen_ipv6=seen_ipv6_at_entry=0x7fa1babf95a7,
in6ai=in6ai_at_entry=0x7fa1babf95b8,
in6ailen=in6ailen_at_entry=0x7fa1babf95c0) at
../sysdeps/unix/sysv/linux/check_pf.c:329
#17 0x00007fa1bf50bd71 in __GI_getaddrinfo (name=<optimized out>,
service=<optimized out>, service_at_entry=0x7fa1babf9cfc "443",
hints=<optimized out>, hints_at_entry=0x7fa1bb4331d0,
pai=pai_at_entry=0x7fa1babf9ca0) at ../sysdeps/posix/getaddrinfo.c:2446
#18 0x00005581876e73d8 in Curl_getaddrinfo_ex (nodename=<optimized out>,
servname=servname_at_entry=0x7fa1babf9cfc "443",
hints=hints_at_entry=0x7fa1bb4331d0, result=result_at_entry=0x7fa1bb4331c8) at
curl_addrinfo.c:121
#19 0x00005581876d873d in getaddrinfo_thread
(arg=arg_at_entry=0x7fa1bb433198) at asyn-thread.c:311
#20 0x00005581876e7aff in curl_thread_create_thunk (arg=<optimized out>)
at curl_threads.c:59
#21 0x00007fa1bf494b43 in start_thread (arg=<optimized out>) at
./nptl/pthread_create.c:442
#22 0x00007fa1bf526990 in clone3 () at
../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 6 (Thread 0x7fa1b73ff640 (LWP 2669556)):
#0  futex_wait (private=0, expected=2, futex_word=0x7fa1bf623040 <lock>)
at ../sysdeps/nptl/futex-internal.h:146
#1  __GI___lll_lock_wait_private (futex=futex_at_entry=0x7fa1bf623040
<lock>) at ./nptl/lowlevellock.c:34
#2  0x00007fa1bf543d84 in __check_pf
(seen_ipv4=seen_ipv4_at_entry=0x7fa1b73fa5a6,
seen_ipv6=seen_ipv6_at_entry=0x7fa1b73fa5a7,
in6ai=in6ai_at_entry=0x7fa1b73fa5b8,
in6ailen=in6ailen_at_entry=0x7fa1b73fa5c0) at
../sysdeps/unix/sysv/linux/check_pf.c:307
#3  0x00007fa1bf50bd71 in __GI_getaddrinfo (name=<optimized out>,
service=<optimized out>, service_at_entry=0x7fa1b73facfc "8482",
hints=<optimized out>, hints_at_entry=0x7fa1bb433450,
pai=pai_at_entry=0x7fa1b73faca0) at ../sysdeps/posix/getaddrinfo.c:2446
#4  0x00005581876e73d8 in Curl_getaddrinfo_ex (nodename=<optimized out>,
servname=servname_at_entry=0x7fa1b73facfc "8482",
hints=hints_at_entry=0x7fa1bb433450, result=result_at_entry=0x7fa1bb433448) at
curl_addrinfo.c:121
#5  0x00005581876d873d in getaddrinfo_thread
(arg=arg_at_entry=0x7fa1bb433418) at asyn-thread.c:311
#6  0x00005581876e7aff in curl_thread_create_thunk (arg=<optimized out>)
at curl_threads.c:59
#7  0x00007fa1bf494b43 in start_thread (arg=<optimized out>) at
./nptl/pthread_create.c:442
#8  0x00007fa1bf526990 in clone3 () at
../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

Thread 7 (Thread 0x7fa1b6bfe640 (LWP 2669558)):
#0  0x00007fa1bf518d0f in __GI___poll (fds=fds_at_entry=0x7fa1b6bf8338,
nfds=nfds_at_entry=1, timeout=5000, timeout_at_entry=<error reading variable:
That operation is not available on integers of more than 8 bytes.>) at
../sysdeps/unix/sysv/linux/poll.c:29
#1  0x00007fa1bf54f265 in send_dg (ansp2_malloced=<optimized out>,
resplen2=<optimized out>, anssizp2=<optimized out>, ansp2=<optimized
out>, anscp=<optimized out>, gotsomewhere=<synthetic pointer>,
v_circuit=<synthetic pointer>, ns=<optimized out>,
terrno=0x7fa1b6bf82f8, anssizp=0x7fa1b6bf8430, ansp=0x7fa1b6bf82e8,
buflen2=<optimized out>, buf2=<optimized out>, buflen=<optimized out>,
buf=<optimized out>, statp=0x7fa1b6bfecf8) at ./resolv/res_send.c:998
#2  __GI___res_context_send (ctx=ctx_at_entry=0x7fa1b9619060,
buf=buf_at_entry=0x7fa1b6bf8460 "\243f\001", buflen=buflen_at_entry=57,
buf2=buf2_at_entry=0x7fa1b6bf849c "\247c\001", buflen2=buflen2_at_entry=57,
ans=<optimized out>, ans_at_entry=0x7fa1b6bf8c50
"\240\220\277\260\241\177", anssiz=<optimized out>, ansp=<optimized
out>, ansp2=<optimized out>, nansp2=<optimized out>, resplen2=<optimized
out>, ansp2_malloced=<optimized out>) at ./resolv/res_send.c:382
#3  0x00007fa1bf54d2ad in __GI___res_context_query
(ctx=ctx_at_entry=0x7fa1b9619060, name=name_at_entry=0x7fa1bb48bab0
"kb-staging.rt.bocc.gibraltar.akadns.net", class=class_at_entry=1,
type=type_at_entry=439963904, answer=answer_at_entry=0x7fa1b6bf8c50
"\240\220\277\260\241\177", anslen=anslen_at_entry=2048, answerp=<optimized
out>, answerp2=<optimized out>, nanswerp2=<optimized out>,
resplen2=<optimized out>, answerp2_malloced=<optimized out>) at
./resolv/res_query.c:216
#4  0x00007fa1bf54ddc1 in __res_context_querydomain
(answerp2_malloced=0x7fa1b6bf9498, resplen2=0x7fa1b6bf9494,
nanswerp2=0x7fa1b6bf9490, answerp2=0x7fa1b6bf94a8,
answerp=0x7fa1b6bf94a0, anslen=2048, answer=0x7fa1b6bf8c50
"\240\220\277\260\241\177", type=439963904, class=1, domain=0x0,
name=0x7fa1bb48bab0 "kb-staging.rt.bocc.gibraltar.akadns.net",
ctx=0x7fa1b9619060) at ./resolv/res_query.c:625
#5  __GI___res_context_search (ctx=ctx_at_entry=0x7fa1b9619060,
name=name_at_entry=0x7fa1bb48bab0
"kb-staging.rt.bocc.gibraltar.akadns.net", class=class_at_entry=1,
type=type_at_entry=439963904, answer=answer_at_entry=0x7fa1b6bf8c50
"\240\220\277\260\241\177", anslen=anslen_at_entry=2048, answerp=<optimized
out>, answerp2=<optimized out>, nanswerp2=<optimized out>,
resplen2=<optimized out>, answerp2_malloced=<optimized out>) at
./resolv/res_query.c:381
#6  0x00007fa1bf5466d1 in __GI__nss_dns_gethostbyname4_r
(name=name_at_entry=0x7fa1bb48bab0
"kb-staging.rt.bocc.gibraltar.akadns.net", pat=pat_at_entry=0x7fa1b6bf95e0,
buffer=<optimized out>, buflen=<optimized out>, errnop=0x7fa1b6bfa4a0,
herrnop=herrnop_at_entry=0x7fa1b6bfa504, ttlp=<optimized out>) at
nss_dns/dns-host.c:373
#7  0x00007fa1bf50c9e3 in get_nss_addresses (res=0x7fa1b6bf95e0,
tmpbuf=0x7fa1b6bf9730, req=<optimized out>, name=<optimized out>) at
../sysdeps/posix/getaddrinfo.c:646
#8  gaih_inet (tmpbuf=0x7fa1b6bf9730, naddrs=<synthetic pointer>,
pai=0x7fa1b6bf95b0, req=<optimized out>, service=<optimized out>,
name=<optimized out>) at ../sysdeps/posix/getaddrinfo.c:1179
#9  __GI_getaddrinfo (name=<optimized out>, service=<optimized out>,
service_at_entry=0x7fa1b6bf9cfc "443", hints=<optimized out>,
hints_at_entry=0x7fa1bb433590, pai=pai_at_entry=0x7fa1b6bf9ca0) at
../sysdeps/posix/getaddrinfo.c:2397
#10 0x00005581876e73d8 in Curl_getaddrinfo_ex (nodename=<optimized out>,
servname=servname_at_entry=0x7fa1b6bf9cfc "443",
hints=hints_at_entry=0x7fa1bb433590, result=result_at_entry=0x7fa1bb433588) at
curl_addrinfo.c:121
#11 0x00005581876d873d in getaddrinfo_thread
(arg=arg_at_entry=0x7fa1bb433558) at asyn-thread.c:311
#12 0x00005581876e7aff in curl_thread_create_thunk (arg=<optimized out>)
at curl_threads.c:59
#13 0x00007fa1bf494b43 in start_thread (arg=<optimized out>) at
./nptl/pthread_create.c:442
#14 0x00007fa1bf526990 in clone3 () at
../sysdeps/unix/sysv/linux/x86_64/clone3.S:81




-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-library
Etiquette:   https://curl.se/mail/etiquette.html
Received on 2025-03-24