#389 ASan crash - linkdead character rejoining

Closed
opened 2 years ago by image · 2 comments
image commented 2 years ago

need more protection in the LD code

    #1 0x555555f0e77e in Client::UpdateCharacterInstances() ../WorldServer/client.cpp:4231
    #2 0x555555f0e7f4 in Client::Save() ../WorldServer/client.cpp:4210
    #3 0x555555f0ea40 in Client::Disconnect(bool) ../WorldServer/client.cpp:3643
    #4 0x555555a057d7 in ZoneServer::ClientProcess() ../WorldServer/zoneserver.cpp:3217
    #5 0x555555a11d3f in ZoneServer::Process() ../WorldServer/zoneserver.cpp:1399
    #6 0x555555a1d4ba in ZoneLoop(void*) ../WorldServer/zoneserver.cpp:6875
    #7 0x7ffff6fbbfa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486
    #8 0x7ffff68264ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce)

0x61f00005b6b8 is located 1592 bytes inside of 2976-byte region [0x61f00005b080,0x61f00005bc20)
freed by thread T0 here:
    #0 0x7ffff72df128 in operator delete(void*, unsigned long) (/lib/x86_64-linux-gnu/libasan.so.5+0xec128)
    #1 0x555555aaf9ff in HandleDeletes<Client*>::CheckDeletes(bool) (/home/eq2emu_server/server/eq2world+0x55b9ff)
    #2 0x555555aaffb1 in MutexList<Client*>::update(bool) (/home/eq2emu_server/server/eq2world+0x55bfb1)
    #3 0x5555559a85e4 in MutexList<Client*>::Remove(Client*, bool, unsigned int) ../WorldServer/MutexList.h:203
    #4 0x5555559a85e4 in ZoneServer::RemoveClientImmediately(Client*) ../WorldServer/zoneserver.cpp:3159
    #5 0x555555f9bc34 in Client::HandleNewLogin(unsigned int, unsigned int) ../WorldServer/client.cpp:9837
    #6 0x555555fa030c in Client::HandlePacket(EQApplicationPacket*) ../WorldServer/client.cpp:1061
    #7 0x555555fc097c in Client::Process(bool) ../WorldServer/client.cpp:3002
    #8 0x555555fc3772 in ClientList::Process() ../WorldServer/client.cpp:3297
    #9 0x555555c6418e in main ../WorldServer/net.cpp:458
    #10 0x7ffff675109a in __libc_start_main ../csu/libc-start.c:308
need more protection in the LD code ``` #1 0x555555f0e77e in Client::UpdateCharacterInstances() ../WorldServer/client.cpp:4231 #2 0x555555f0e7f4 in Client::Save() ../WorldServer/client.cpp:4210 #3 0x555555f0ea40 in Client::Disconnect(bool) ../WorldServer/client.cpp:3643 #4 0x555555a057d7 in ZoneServer::ClientProcess() ../WorldServer/zoneserver.cpp:3217 #5 0x555555a11d3f in ZoneServer::Process() ../WorldServer/zoneserver.cpp:1399 #6 0x555555a1d4ba in ZoneLoop(void*) ../WorldServer/zoneserver.cpp:6875 #7 0x7ffff6fbbfa2 in start_thread /build/glibc-vjB4T1/glibc-2.28/nptl/pthread_create.c:486 #8 0x7ffff68264ce in clone (/lib/x86_64-linux-gnu/libc.so.6+0xf94ce) 0x61f00005b6b8 is located 1592 bytes inside of 2976-byte region [0x61f00005b080,0x61f00005bc20) freed by thread T0 here: #0 0x7ffff72df128 in operator delete(void*, unsigned long) (/lib/x86_64-linux-gnu/libasan.so.5+0xec128) #1 0x555555aaf9ff in HandleDeletes<Client*>::CheckDeletes(bool) (/home/eq2emu_server/server/eq2world+0x55b9ff) #2 0x555555aaffb1 in MutexList<Client*>::update(bool) (/home/eq2emu_server/server/eq2world+0x55bfb1) #3 0x5555559a85e4 in MutexList<Client*>::Remove(Client*, bool, unsigned int) ../WorldServer/MutexList.h:203 #4 0x5555559a85e4 in ZoneServer::RemoveClientImmediately(Client*) ../WorldServer/zoneserver.cpp:3159 #5 0x555555f9bc34 in Client::HandleNewLogin(unsigned int, unsigned int) ../WorldServer/client.cpp:9837 #6 0x555555fa030c in Client::HandlePacket(EQApplicationPacket*) ../WorldServer/client.cpp:1061 #7 0x555555fc097c in Client::Process(bool) ../WorldServer/client.cpp:3002 #8 0x555555fc3772 in ClientList::Process() ../WorldServer/client.cpp:3297 #9 0x555555c6418e in main ../WorldServer/net.cpp:458 #10 0x7ffff675109a in __libc_start_main ../csu/libc-start.c:308 ```
image commented 2 years ago
Collaborator

our MutexLists are flawed and don't protect memory space.. connected_clients needs to be purged

our MutexLists are flawed and don't protect memory space.. connected_clients needs to be purged
image commented 1 year ago
Collaborator

This was resolved by fcc409dacc

when we removed the usage of: connected_clients.Remove(client, true);

connected_clients is now used in a limited fashion to transition the client from an initializing EQStream to a connected client (and client processing). It also handles the final deletion of memory when the client is completely purged.

This was resolved by https://git.eq2emu.com/devn00b/EQ2EMu/commit/fcc409dacc8a2255bb834108e9f24eaa0dfb352e when we removed the usage of: connected_clients.Remove(client, true); connected_clients is now used in a limited fashion to transition the client from an initializing EQStream to a connected client (and client processing). It also handles the final deletion of memory when the client is completely purged.
Sign in to join this conversation.
Loading...
Cancel
Save
There is no content yet.