Process Crash Occurs Using Tuxedo tpfree() API With A Pointer That Is Already Released Implicitly By tprealloc() (Doc ID 2139893.1)

Last updated on MAY 26, 2016

Applies to:

Oracle Tuxedo - Version 12.1.3 and later
Information in this document applies to any platform.

Symptoms

On Tuxedo 12.1.3 version, if request buffer is reallocated in another thread, Tuxedo crashes after trying to tpfree the original request buffer which is implicitly freed by tprealloc.

ERROR
-----------------------
tprealloc happened in a different thread, reallocated bufffer is freed (0x0x1cb6ad8) but it also tries to free original buffer that was reallocated (0x0x1cb14b8) and then crashes (TMS_GROUP/400)

ULOG contains-

134839.830.mymachine!MULTI.8691.405169920.2: TRACE:at: { tpservice({"DOREALLOC_M", 0x0, 0x0x1cb14b8, 4096, 0, 0, {1458733712, 0, 56}})
134839.834.mymachine!MULTI.8691.396777216.-2: TRACE:tr: trace("*:ulog:dye")
134839.834.mymachine!MULTI.8691.396777216.-2: TRACE:tr: dye
134839.835.mymachine!MULTI.8691.396777216.-2: TRACE:at: { tprealloc(0x0x1cb14b8, 16384)
134839.835.mymachine!MULTI.8691.396777216.-2: TRACE:at: } tprealloc = 0x0x1cb6ad8
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:at: { tpreturn(2, 0, 0x0x1cb6ad8, 0, 0x0)
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:ia: { tpfree(0x0x1cb6ad8)
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:ia: } tpfree
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:at: } tpreturn [long jump]
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:at: } tpservice
134839.836.mymachine!MULTI.8691.405169920.2: TRACE:at: { tpfree(0x0x1cb14b8)
134854.549.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: { tpservice({"..TMSYSPOST", 0x4, 0x0x1d026b8, 740, 0, 2147483648, {1458733712, 0, 56}})
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: { tptypes(0x0x1d026b8, 0x0x7fff6f055b80, 0x0x7fff6f055b60)
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: } tptypes = 4096
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: { tpreturn(2, 0, 0x0x1d026b8, 4096, 0x0)
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: } tpreturn [long jump]
134854.550.mymachine!TMSYSEVT.6584.1411834304.0: TRACE:ia: } tpservice
134857.437.mymachine!BBL.6580.1499189696.0: LIBTUX_CAT:541: WARN: Server TMS_GROUP/400 terminated


Stack trace of core:

(gdb) bt
#0 0x00007f781ea83cfb in _tmfmsg_free () from /mytux1213dir/lib/libtux.so
#1 0x00007f781ea02ff4 in _tpfree_internal () from /mytux1213dir/lib/libtux.so
#2 0x00007f781ea03236 in tpfree () from /mytux1213dir/lib/libtux.so
#3 0x00007f781ea735aa in _tmsvrthrmain () from /mytux1213dir/lib/libtux.so
#4 0x00007f781d879dc5 in start_thread () from /lib64/libpthread.so.0
#5 0x00007f781d5aa17d in clone () from /lib64/libc.so.6


STEPS
-----------------------
The issue can be reproduced at will with the following steps:
1. Build the server with:
buildserver -t -o MULTI -f multi.c -s DOREALLOC -s DOREALLOC_M

2. If DOREALLOC is called it works fine. If DOREALLOC_M is called (that does tprealloc in another thread) it crashes after tpreturn.

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms