mserver rpc_check_channels() crash

Issue #353 resolved
dd1 created an issue

in agmini I see an mserver crash in rpc_check_channels() line 16405 sa->close(). it looks like “sa” points to a deleted object. also _server_acceptions contains only one element and it is NULL, so definitely object pointed to be “sa” was deleted. mserver is single threaded so not clear how this could have happened. K.O.

Comments (4)

  1. dd1 reporter

    also rpc-check_channels() is missing a null pointer check after sa = _server_acceptions[idx]; this is not the cause of this crash, “sa” is not NULL. K.O.

  2. dd1 reporter

    Rebuild doxygen call graphs, look at call graph for rpc_server_loop() (mserver main loop), call graph for rpc_check_channels(), see the bug. sa->close() after cm_disconnect_experiment() will always crash because cm_disconnect_experiment() closes and deletes all connection objects. K.O.

  3. dd1 reporter

    rpc_check_channels() probable should not call cm_disconnect_experiment() in the “if (rpc_is_mserver)” path. we return RPC_NET_ERROR, rpc_server_loop() exits and mserver.cxx will clean up stuff. K.O.

  4. Log in to comment