[Varnish] #144: Varnishd core dumps because of bus error

[Varnish]

#144: Varnishd core dumps because of bus error
----------------------+-----------------------------------------------------
 Reporter:  anders    |       Owner:  phk                      
     Type:  defect    |      Status:  new                      
 Priority:  high      |   Milestone:                           
Component:  varnishd  |     Version:  1.1                      
 Severity:  major     |    Keywords:  varnishd core dump sig 10
----------------------+-----------------------------------------------------
 I am running Varnish 1.1 (from ports, with patches by des committed july
 25th) in FreeBSD 6.2-RELEASE/amd64, on Intel hardware. I am using varnishd
 with a broad (20 GB sm_balloc) data set here, and that my graphs shows
 upto 1.43 million hashes/objects.

 Per phk's request, I have set some malloc parameters:

 lrwxr-xr-x  1 root  wheel  2 Aug  7 08:57 malloc.conf -> AJ

 Varnish crashed signal 10:

 Aug  7 12:01:21 cache10 kernel: pid 57690 (varnishd), uid 0: exited on
 signal 10 (core dumped)

 On the console:

 Child not responding to ping
 (..)
 Cache child died pid=57690 status=0x8a

 My VCL:

 {{{
 backend default {
              set backend.host = "192.168.0.3";
              set backend.port = "80";
         }
 acl purge {
         "192.168.0.4"/32;
 }
 sub vcl_recv {
         if ((req.http.host ~ "^(cache.finn.no|finn.no|www.finn.no)$") ||
 (req.http.host == "banner.finn.no" && req.url ~
 "^/(jsp2|finn/gojsp|daily|board|auximg/papirfly|finn/cacheable|crossdomain.xml)"))
 {
                 if (req.request == "GET" || req.request == "HEAD") {
                         lookup;
                 } elsif (req.request == "PURGE") {
                         if (!client.ip ~ purge) {
                                 error 405 "Not allowed.";
                         }
                         lookup;
                 } else {
                         pipe;
                 }
         } else {
                 error 403 "Access denied. Contact cacheadmin at finn.no if
 you have problems.";
         }
 }
 sub vcl_miss {
         if (req.request == "PURGE") {
                 error 404 "Not in cache.";
         } else {
                 fetch;
         }
 }
 sub vcl_hit {
         if (req.request == "PURGE") {
                 set obj.ttl = 0s;
                 error 200 "Purged.";
         } else {
                 deliver;
         }
 }
 sub vcl_fetch {
         if (obj.ttl < 86400s) {
                 set obj.ttl = 604800s;
         }
         if (obj.http.Cookie) {
                 remove obj.http.Cookie;
         }
         if (obj.http.Set-Cookie) {
                 remove obj.http.Set-Cookie;
         }
         insert;
 }
 }}}

 Back-trace of the core-dump:

 {{{
 root at cache10:/usr/local/varnish/cache10.finn.no# gdb -c
 varnishd_2007-08-07_12-00-01.core -s /usr/local/sbin/varnishd
 GNU gdb 6.1.1 [FreeBSD]
 Copyright 2004 Free Software Foundation, Inc.
 GDB is free software, covered by the GNU General Public License, and you
 are
 welcome to change it and/or distribute copies of it under certain
 conditions.
 Type "show copying" to see the conditions.
 There is absolutely no warranty for GDB.  Type "show warranty" for
 details.
 This GDB was configured as "amd64-marcel-freebsd"...
 Core was generated by `varnishd'.
 Program terminated with signal 10, Bus error.
 #0  0x0000000000408850 in vbe_sock_conn (ai=0xd0d0d0d0d0d0d0d0)
     at cache_backend.c:158
 158             s = socket(ai->ai_family, ai->ai_socktype,
 ai->ai_protocol);
 (gdb) bt
 #0  0x0000000000408850 in vbe_sock_conn (ai=0xd0d0d0d0d0d0d0d0)
     at cache_backend.c:158
 #1  0x00000000004088fc in vbe_conn_try (bp=0xaf4d00, pai=0x7ffff8bc4868)
     at cache_backend.c:176
 #2  0x0000000000408ad4 in vbe_connect (sp=0x38de008, bp=0xaf4d00)
     at cache_backend.c:224
 #3  0x0000000000408ef3 in vbe_nextfd (sp=0x38de008) at cache_backend.c:295
 #4  0x0000000000409132 in VBE_GetFd (sp=0x38de008) at cache_backend.c:332
 #5  0x000000000040c700 in Fetch (sp=0x38de008) at cache_fetch.c:278
 #6  0x0000000000409e34 in cnt_fetch (sp=0x38de008) at cache_center.c:290
 #7  0x000000000040addd in CNT_Session (sp=0x38de008) at steps.h:40
 #8  0x00000000004124b8 in wrk_do_one (w=0x7ffff8bc4ad0) at
 cache_pool.c:193
 #9  0x00000000004129b3 in wrk_thread (priv=0x856300) at cache_pool.c:247
 #10 0x000000080088655b in ?? ()
 #11 0x0000000000000000 in ?? ()
 #12 0x00007ffff3199fd8 in ?? ()
 #13 0x0000000039bbb800 in ?? ()
 #14 0x0000000000000000 in ?? ()
 #15 0x000000000053be00 in ?? ()
 #16 0x00007ffff89c7000 in ?? ()
 Cannot access memory at address 0x7ffff8bc7000
 }}}

 Varnish is compiled with -g (CFLAGS= -g), and not stripped (STRIP=).

-- 
Ticket URL: <http://varnish.projects.linpro.no/ticket/144>
Varnish <http://varnish.projects.linpro.no/>
The Varnish HTTP Accelerator