Process Crash Occurs Using Tuxedo tpfree() API With A Pointer That Is Already Released Implicitly By tprealloc()

(Doc ID 2139893.1)

Last updated on AUGUST 25, 2017

Applies to:

Oracle Tuxedo - Version 12.1.3 and later
Information in this document applies to any platform.

Symptoms

On Tuxedo 12.1.3: If request Tuxedo buffer is reallocated in another thread, Tuxedo crashes after trying to call Tuxedo API  tpfree() the original request buffer which is implicitly freed by Tuxedo API tprealloc().

Tuxedo tprealloc() happened in a different thread, reallocated bufffer is freed (0x0x1cb6ad8) but it also tries to free original buffer that was reallocated (0x0x1cb14b8) and then crashes (Tuxed ubb configuration group/serverid TMS_GROUP/400)

Tuxedo ULOG, with Tuxedo tracing turned on, contains-

134839.830.mymachine!MULTI.8691.405169920.2: TRACE:at: { tpservice({"DOREALLOC_M", 0x0, 0x0x1cb14b8, 4096, 0, 0, {1458733712, 0, 56}})
134839.834.mymachine!MULTI.8691.396777216.-2: TRACE:tr: trace("*:ulog:dye")
134839.834.mymachine!MULTI.8691.396777216.-2: TRACE:tr: dye
134839.835.mymachine!MULTI.8691.396777216.-2: TRACE:at: { tprealloc(0x0x1cb14b8, 16384)
134839.835.mymachine!MULTI.8691.396777216.-2: TRACE:at: } tprealloc = 0x0x1cb6ad8
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:at: { tpreturn(2, 0, 0x0x1cb6ad8, 0, 0x0)
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:ia: { tpfree(0x0x1cb6ad8)
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:ia: } tpfree
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:at: } tpreturn [long jump]
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:at: } tpservice
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:at: { tpfree(0x0x1cb14b8)
134854.549.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: { tpservice({"..TMSYSPOST", 0x4, 0x0x1d026b8, 740, 0, 2147483648, {1458733712, 0, 56}})
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: { tptypes(0x0x1d026b8, 0x0x7fff6f055b80, 0x0x7fff6f055b60)
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: } tptypes = 4096
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: { tpreturn(2, 0, 0x0x1d026b8, 4096, 0x0)
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: } tpreturn [long jump]
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: } tpservice
134857.437.mymachine!BBL.6580.1499189696.0: LIBTUX_CAT:541: WARN: Server TMS_GROUP/400 terminated


Stack trace of core:

(gdb) bt
#0 0x00007f781ea83cfb in _tmfmsg_free () from /mytux1213dir/lib/libtux.so
#1 0x00007f781ea02ff4 in _tpfree_internal () from /mytux1213dir/lib/libtux.so
#2 0x00007f781ea03236 in tpfree () from /mytux1213dir/lib/libtux.so
#3 0x00007f781ea735aa in _tmsvrthrmain () from /mytux1213dir/lib/libtux.so
#4 0x00007f781d879dc5 in start_thread () from /lib64/libpthread.so.0
#5 0x00007f781d5aa17d in clone () from /lib64/libc.so.6




Changes

 

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms