[2.3.2] makehistory segfaults due to cnfs problems

Torsten Hilbrich email at myrkr.in-berlin.de
Wed Feb 20 17:14:56 UTC 2002



Hello everyone,

after having some problems with the overview in version 2.3.2 from INN 
(Debian Version 2.3.2-3) I deciced to rebuild the overview database. Just
to be sure I shutdown inn completly, removed the whole directory tree of
overview (leaving just overview) and removed history (including the index
and hash files) as well just to be sure to have clean entries.

I run "makehistory -O -F" and soon run into a segfault.  Using a debug 
version of makehistory I noticed that the error occured in free, called
from cnfs.c line 1523 (function cnfs_next):

	    /* In the case we return art->data = NULL, we
             * must not free an already stale pointer.
               -mibsoft at mibsoftware.com
	     */
	    if (priv.base) {
	        DISPOSE(priv.base);  <================= RIGHT HERE
		priv.base = 0;
	    }
	}
	cycbuff = priv.cycbuff;
    }

Here are some information from a debug session (gdb
expire/makehistory):

(gdb) run -O -F
Program received signal SIGSEGV, Segmentation fault.
0x40179c00 in free () from /lib/libc.so.6

(gdb) bt
#0  0x40179c00 in free () from /lib/libc.so.6
#1  0x08052b90 in cnfs_next (article=0x807c480, amount=RETR_HEAD)
    at cnfs.c:1523
#2  0x0804d4c3 in SMnext (article=0x807c480, amount=RETR_HEAD)
    at interface.c:812
#3  0x0804bf23 in main (argc=3, argv=0xbffffd84) at makehistory.c:970
#4  0x401246cf in __libc_start_main () from /lib/libc.so.6

(gdb) up 
#1  0x08052b90 in cnfs_next (article=0x807c480, amount=RETR_HEAD)
    at cnfs.c:1523
1523                    DISPOSE(priv.base);

(gdb) print priv.base
$1 = 0x40014bd8 ""

(gdb) print priv
$2 = {base = 0x40014bd8 "", len = -1073742644, cycbuff = 0x807c3b8, 
  offset = 181824000, rollover = 0}

(gdb) print* priv.base
$2 = 0 '\000'

(gdb) print* priv.cycbuff
$1 = {name = "ONE", '\000' <repeats 12 times>, 
  path = "/var/spool/news/buffers/one", '\000' <repeats 36 times>, 
  len = 402653184, free = 181823488, updated = 1014223333, fd = 7, 
  cyclenum = 2, magicver = 3, bitfield = 0x404e4000 "CBuf3", 
  minartoffset = 114688, needflush = 0, next = 0x0, currentbuff = 1, 
  metaname = '\001' <repeats 16 times>, order = 0}

The priv.len doesn't look very pleasing to me.




By commenting out the DISPOSE line I was able to rebuild both the history
file and the overview database.

Here is the output of cnfsstat:

Class AREA  for groups matching "*"
 Buffer ONE, size:   384 MBytes, position:   173 MBytes  1.45 cycles
  Newest: 2002-02-20 17:42:13,    0 days,  0:25:26 ago


My storage configuration is:

--------------------------------------------------------------
#/etc/news/storage.conf
# allow local.comp.risks to stay forever
method tradspool {
	class: 3
	newsgroups: local.comp.risks
}

# store everything else in cnfs
method cnfs {
	class: 2
	newsgroups: *
	options: AREA
}

# ... just in case something slips through
method tradspool {
        class: 1
        newsgroups: *
}
--------------------------------------------------------------

The overview configuration is here:

--------------------------------------------------------------
#/etc/news/buffindexed.conf
0:/var/news/spool/overview/OV1:1536000
1:/var/news/spool/overview/OV2:1536000
--------------------------------------------------------------

Here is the buffers configuration:
--------------------------------------------------------------
#/etc/news/cycbuff.conf
cycbuff:ONE:/var/spool/news/buffers/one:393216
metacycbuff:AREA:ONE
--------------------------------------------------------------



The libraries used by inn2 are:

libdb3          3.2.9
libperl         5.6.1
GNU libc        2.2.5

OS: Debian GNU/Linux, Kernel 2.4.17
Filesystem: SGI XFS


I have made a copy of all the files in /var/lib/news, /var/spool/news,
and /etc/news/ and will be able to reproduce this error if you need
additional information.  This tar.gz archive is about 140 MB, it would
be no problem to provide these files if you want to debug by yourself
;-)

Please tell me if you need further information.

        Torsten



More information about the inn-bugs mailing list