[Libevent-users] segfault when adding deferred callback

[Joachim Bauch <jojo@xxxxxxxxxxx>]

Hi,

just got a segfault in one of my threads while a deferred callback tried 
to scheduled another callback:

Thread 56 (Thread 0x40b55950 (LWP 30440)):
#0  0x000000000042a157 in event_deferred_cb_schedule (queue=0xa677e8, 
cb=0x9a5368) at event.c:1755
#1  0x0000000000432c24 in _bufferevent_run_eventcb (bufev=0x9a51c0, 
what=32) at bufferevent.c:203
#2  0x0000000000425661 in be_openssl_eventcb (bev_base=0x9a3b70, 
what=17, ctx=0x9a51c0)
    at bufferevent_openssl.c:741
#3  0x0000000000432a4d in bufferevent_run_deferred_callbacks 
(_=0x9a3d18, arg=0x9a3b70)
    at bufferevent.c:145
#4  0x00000000004286ba in event_process_deferred_callbacks 
(queue=0x6ddfe8, breakptr=0x6ddfbc)
    at event.c:952
#5  0x00000000004287b7 in event_process_active (base=0x6ddde0) at 
event.c:989
#6  0x0000000000428ce1 in event_base_loop (base=0x6ddde0, flags=0) at 
event.c:1156
#7  0x00000000004287e3 in event_base_dispatch (event_base=0x6ddde0) at 
event.c:1005
#8  0x000000000040b981 in Reactor::thread_func (userdata=0x6bb3d0) at 
reactor.cpp:126
#9  0x00007f53827923f7 in start_thread () from /lib/libpthread.so.0
#10 0x00007f5381d67b4d in clone () from /lib/libc.so.6
#11 0x0000000000000000 in ?? ()


Other currently active threads were

Thread 69 (Thread 0x40c6f950 (LWP 30453)):
#0  0x00007f5382799384 in __lll_robust_lock_wait () from 
/lib/libpthread.so.0
#1  0x00007f5382794b3e in _L_robust_lock_432 () from /lib/libpthread.so.0
#2  0x00007f5382794604 in pthread_mutex_lock () from /lib/libpthread.so.0
#3  0x0000000000426774 in evthread_posix_lock (mode=5, 
_lock=0x7f5381fedf10) at evthread_pthread.c:66
#4  0x000000000042a113 in event_deferred_cb_schedule 
(queue=0x7f5381fedf28, cb=0x6e7ef8) at event.c:1752
#5  0x0000000000432c24 in _bufferevent_run_eventcb (bufev=0x6e7d50, 
what=32) at bufferevent.c:203
#6  0x0000000000425661 in be_openssl_eventcb (bev_base=0x8c28c0, 
what=17, ctx=0x6e7d50)
    at bufferevent_openssl.c:741
#7  0x0000000000432a4d in bufferevent_run_deferred_callbacks 
(_=0x8c2a68, arg=0x8c28c0)
    at bufferevent.c:145
#8  0x00000000004286ba in event_process_deferred_callbacks 
(queue=0x6e9788, breakptr=0x6e975c)
    at event.c:952
#9  0x00000000004287b7 in event_process_active (base=0x6e9580) at 
event.c:989
#10 0x0000000000428ce1 in event_base_loop (base=0x6e9580, flags=0) at 
event.c:1156
#11 0x00000000004287e3 in event_base_dispatch (event_base=0x6e9580) at 
event.c:1005
#12 0x000000000040b981 in Reactor::thread_func (userdata=0x6bb5d8) at 
reactor.cpp:126
#13 0x00007f53827923f7 in start_thread () from /lib/libpthread.so.0
#14 0x00007f5381d67b4d in clone () from /lib/libc.so.6
#15 0x0000000000000000 in ?? ()

Thread 29 (Thread 0x41252950 (LWP 30413)):
#0  0x00007f5382e90dca in bn_mul_add_words () from 
/usr/lib/libcrypto.so.0.9.8
#1  0x00007f5382e92930 in BN_from_montgomery () from 
/usr/lib/libcrypto.so.0.9.8
#2  0x00007f5382e92c69 in BN_mod_mul_montgomery () from 
/usr/lib/libcrypto.so.0.9.8
#3  0x00007f5382e8895f in BN_mod_exp_mont_consttime () from 
/usr/lib/libcrypto.so.0.9.8
#4  0x00007f5382ea2955 in ?? () from /usr/lib/libcrypto.so.0.9.8
#5  0x00007f5382ea3e8b in ?? () from /usr/lib/libcrypto.so.0.9.8
#6  0x00007f5382bc99f7 in ssl3_get_client_key_exchange () from 
/usr/lib/libssl.so.0.9.8
#7  0x00007f5382bcbd57 in ssl3_accept () from /usr/lib/libssl.so.0.9.8
#8  0x0000000000425937 in do_handshake (bev_ssl=0x7f537c12b8c0) at 
bufferevent_openssl.c:814
#9  0x0000000000425a4f in be_openssl_handshakecb (bev_base=0xa840e0, 
ctx=0x7f537c12b8c0)
    at bufferevent_openssl.c:854
#10 0x0000000000432977 in bufferevent_run_deferred_callbacks 
(_=0xa84288, arg=0xa840e0)
    at bufferevent.c:133
#11 0x00000000004286ba in event_process_deferred_callbacks 
(queue=0x6c8688, breakptr=0x6c865c)
    at event.c:952
#12 0x00000000004287b7 in event_process_active (base=0x6c8480) at 
event.c:989
#13 0x0000000000428ce1 in event_base_loop (base=0x6c8480, flags=0) at 
event.c:1156
#14 0x00000000004287e3 in event_base_dispatch (event_base=0x6c8480) at 
event.c:1005
#15 0x000000000040b981 in Reactor::thread_func (userdata=0x6baf98) at 
reactor.cpp:126
#16 0x00007f53827923f7 in start_thread () from /lib/libpthread.so.0
#17 0x00007f5381d67b4d in clone () from /lib/libc.so.6
#18 0x0000000000000000 in ?? ()


Unfortunately this only happens under high load with multiple clients
connecting and transferring data simultaneously, so I don't have an
easy way to reproduce.
Is this a bug in libevent, or is there anything I need to take care
of when having a pool of threads that handle IO events for different
sockets through bufferevents. Two sockets (one using a SSL bufferevent
with an underlying regular be) are connected as a proxy but might be
handled by different threads.

Best regards,
  Joachim
***********************************************************************
To unsubscribe, send an e-mail to majordomo@xxxxxxxxxxxxx with
unsubscribe libevent-users    in the body.