#2536 SFCBD core dump in InteropProviderInvokeMethod()

[Akbar Ali]

- Core dump happened in SFCB version - 1.3.14

- When we analyze the sfcbd core dump,

interopProvider.c (version 1.3.14):

1314 // Add indicationFilterName to the indication
1315 Filter *filter = filterId;
1316 CMPIData cd_name = CMGetProperty(filter->fci, "name", &fn_st);

Line 1315 - filter pointer is assigned and it is NULL pointer.

(gdb) p ( Filter *) *filter
$5 = (struct filter *) 0x0

- Same NULL pointer check is even missing in 1.3.15 version.

interopProvider.c( version 1.3.15):

1383 // Add indicationFilterName to the indication
1384 Filter *filter = filterId;
1385 CMPIData cd_name = CMGetProperty(filter->fci, "name", &fn_st);

CORE DUMP trace:

Program terminated with signal 11, Segmentation fault.
#0 0x0f8fa440 in InteropProviderInvokeMethod (mi=0xf90d490, ctx=0x1002a4a8, rslt=0x1002a468, ref=0x1002e62c, methodName=0x1002e6a8 "_deliver", in=0x10032e70, out=0x100220c8)
at interopProvider.c:1316
1316 interopProvider.c: No such file or directory.
in interopProvider.c
(gdb) bt
**NOTE: debug frames are hidden in bt display**
#0 0x0f8fa440 in InteropProviderInvokeMethod (mi=0xf90d490, ctx=0x1002a4a8, rslt=0x1002a468, ref=0x1002e62c, methodName=0x1002e6a8 "_deliver", in=0x10032e70, out=0x100220c8)
at interopProvider.c:1316
#1 0x0ff3ee40 in invokeMethod (hdr=0x1002e5c0, info=0x10023640, requestor=-52) at providerDrv.c:1686
#2 0x0ff489b4 in processProviderInvocationRequestsThread (prms=0x100229c0) at providerDrv.c:2997
#3 0x0fd83aec in start_thread (arg=<value optimized out>) at pthread_create.c:308
#4 0x0fcd28fc in clone () from /opt/mcp/ppcnf/crossroot/lib/libc.so.6

(gdb) p filter->fci
$1 = (CMPIInstance *) 0x0

(gdb) p filterId
$2 = (void *) 0x1002ff28

(gdb) p ( Filter *) *filter
$5 = (struct filter *) 0x0

(gdb) info local
su = (Subscription *) 0x10032e88
ns = 0x100330f8 "root/ibmsd"
ind = (CMPIInstance *) 0x100330d0
it_attr = {__size = "1\002µ81\002·@\000 µ0\000\000\000 \017÷Ñ 1\002µ 1\002µ\220\017ïßÐ\020\003.\210", __align = 822261048}
cd_name = {type = 4098, state = 65320, value = {uint64 = 3531584481733378048, uint32 = 822261088, uint16 = 12546, uint8 = 49 '1', sint64 = 3531584481733378048, sint32 = 822261088, sint16 = 12546,
sint8 = 49 '1', real64 = 1.3235791927537746e-72, real32 = 1.90205895e-09, boolean = 49 '1', char16 = 12546, inst = 0x3102b560, ref = 0x3102b560, args = 0x3102b560, filter = 0x3102b560,
Enum = 0x3102b560, array = 0x3102b560, string = 0x3102b560, chars = 0x3102b560 "", dateTime = 0x3102b560, dataPtr = {ptr = 0x3102b560, length = 0}, Byte = 49 '1', Short = 12546,
Int = 822261088, Long = 3531584481733378048, Float = 1.90205895e-09, Double = 1.3235791927537746e-72}}
i = (HashTableIterator *) 0x3
suName = 0x10033058 "filterid"
filtername = 0x0
hin = (CMPIArgs *) 0x10033098
indo = (CMPIInstance *) 0x100353b4
filterId = (void *) 0x1002ff28
ind_thread = 0
filter = (Filter *) 0x1002ff28
st = {rc = CMPI_RC_OK, msg = 0x0}
fn_st = {rc = CMPI_RC_ERR_FAILED, msg = 0x0}
__func_ = 0xf8fcaac ""
__traceMask = 512
__FUNCTION__ = '\0' <repeats 27 times>

[Chris Buccella]

Please also print ns in the same frame you printed filterId ?

Simply adding a NULL check may prevent the core file but won't fix the main issue (the indication is not being delivered). We need to know what caused filter to be NULL.

Do you have more information about this situation? When was the core found? Were there multiple cores?

[Akbar Ali]

Please check the "info local" output in the comment which has all local variable values in the frame.

ns = 0x100330f8 "root/ibmsd"

[Chris Buccella]

akbalati,

Thanks for pointing that out.

We still need to determine why the filterId is NULL. Can you describe the reproducibility of this crash? When did it happen? Can it be reproduced at-will? Were other core files generated?

[Akbar Ali]

Hi Chris,

Core dump has occurred in indication delivery path and We were not able to reproduce this issue.

This core has happened in sfcb-1.3.14, Can you please verify whether the latest sfcb - 1.3.15 has the fix for these kind of issue?

I have attached indication database files from (/usr/var/lib/sfcb/registration/repository/root/interop) for your reference.

[Akbar Ali]

Indication database files

[Chris Buccella]

The core dump should be avoided based on the change for 3582062