On 23 Jun 2014, at 17:02, Phil Mayers <p.mayers@IMPERIAL.AC.UK> wrote:
On 23/06/14 16:55, Arran Cudbard-Bell wrote:
On 23 Jun 2014, at 16:52, Phil Mayers <p.mayers@imperial.ac.uk> wrote:
On 23/06/14 16:45, Phil Mayers wrote:
On 23/06/14 16:29, Arran Cudbard-Bell wrote:
Any better with latest v3.0.x HEAD? Just fixed all the connection pool handle allocation.
Don't think so, immediate bomb-out when hammering it with EAP; just rebuilding after make distclean to be absolutely sure I'm on the latest (it would be nice if git activity updated the version reported in "-v"; seems to only be captured at ./configure time and this makes me paranoid I've not updated the binaries correctly)
Yeah same sort of thing:
One more time... I found another one in the cache module...
Replace: /** Dynamically allocate a new attribute * * Allocates a new attribute and a new dictionary attr if no DA is provided. * * @param[in] ctx for allocated memory, usually a pointer to a RADIUS_PACKET * @param[in] da Specifies the dictionary attribute to build the VP from. * @return a new value pair or NULL if an error occurred. */ VALUE_PAIR *pairalloc(TALLOC_CTX *ctx, DICT_ATTR const *da) { VALUE_PAIR *vp; /* * Caller must specify a da else we don't know what the attribute type is. */ if (!da) { fr_strerror_printf("Invalid arguments"); return NULL; } vp = talloc_zero(ctx, VALUE_PAIR); if (!vp) { fr_strerror_printf("Out of memory"); return NULL; } vp->da = da; vp->op = T_OP_EQ; vp->tag = TAG_ANY; vp->type = VT_NONE; vp->length = da->flags.length; talloc_set_destructor(vp, _pairfree); return vp; } With static fr_cbuff *vp_bt; VALUE_PAIR *pairalloc(TALLOC_CTX *ctx, DICT_ATTR const *da) { VALUE_PAIR *vp; /* * Caller must specify a da else we don't know what the attribute type is. */ if (!da) { fr_strerror_printf("Invalid arguments"); return NULL; } vp = talloc_zero(ctx, VALUE_PAIR); if (!vp) { fr_strerror_printf("Out of memory"); return NULL; } vp->da = da; vp->op = T_OP_EQ; vp->tag = TAG_ANY; vp->type = VT_NONE; vp->length = da->flags.length; talloc_set_destructor(vp, _pairfree); fr_backtrace_attach(vp_bt, vp); return vp; } run with PANIC_ACTION="gdb %e %p" radiusd -f -lstdout When it crashes p the value of the vp to get the pointer address then in gdb call backtrace_print(&vp_bt, <pointer to double freed vp>) Arran Cudbard-Bell <a.cudbardb@freeradius.org> FreeRADIUS Development Team FD31 3077 42EC 7FCD 32FE 5EE2 56CF 27F9 30A8 CAA2