[Varnish] #1001: Varnish 3.0.1 crashes in http_GetHdr

Varnish varnish-bugs at varnish-cache.org
Thu Sep 1 10:39:46 CEST 2011


#1001: Varnish 3.0.1 crashes in http_GetHdr
----------------------+-----------------------------------------------------
 Reporter:  anders    |        Owner:          
     Type:  defect    |       Status:  reopened
 Priority:  high      |    Milestone:          
Component:  varnishd  |      Version:  3.0.1   
 Severity:  critical  |   Resolution:          
 Keywords:            |  
----------------------+-----------------------------------------------------
Changes (by anders):

  * status:  closed => reopened
  * resolution:  fixed =>


Comment:

 Fix does not fix this, at least not completely. I still get crashes:

 {{{
 Sep  1 08:30:22 cache1 varnishd[9245]: Child (9495) Panic message: Assert
 error in http_GetHdr(), cache_http.c line 266:   Condition(l == strlen(hdr
 + 1)) not true. thread = (cache-worker) ident =
 FreeBSD,8.1-RELEASE-p1,amd64,-smalloc,-smalloc,-hcritbit,kqueue
 }}}

 With gdb attached I get after a while:

 {{{
 [New Thread 8075fe040 (LWP 102099)]
 [New Thread 8075fde80 (LWP 102100)]

 Program received signal SIGSEGV, Segmentation fault.
 [Switching to Thread 806610a00 (LWP 100579)]
 0x00000008008c9e7f in getframeaddr (level=Variable "level" is not
 available.
 ) at execinfo.c:273
 273         case 2: return __builtin_frame_address(3);
 (gdb) bt
 #0  0x00000008008c9e7f in getframeaddr (level=Variable "level" is not
 available.
 ) at execinfo.c:273
 #1  0x00000008008c9ebc in backtrace (buffer=Variable "buffer" is not
 available.
 ) at execinfo.c:53
 #2  0x000000000042d889 in pan_ic (func=0x455e50 "http_GetHdr",
     file=0x455850 "cache_http.c", line=266,
     cond=0x455960 "l == strlen(hdr + 1)", err=Variable "err" is not
 available.
 ) at cache_panic.c:283
 #3  0x0000000000429b3c in http_GetHdr (hp=0x81b09d3e8,
     hdr=0x81ecaefda ".91.37.197", ptr=0x7ffffa1be4c8) at cache_http.c:266
 #4  0x00000000004333df in VRY_Match (sp=0x81b09d008,
     vary=0x81ecaefd8 "80.91.37.197") at cache_vary.c:192
 #5  0x000000000042634b in HSH_Lookup (sp=0x81b09d008, poh=0x7ffffa1be580)
     at cache_hash.c:358
 #6  0x00000000004145c0 in cnt_lookup (sp=0x81b09d008) at
 cache_center.c:1090
 #7  0x0000000000417aef in CNT_Session (sp=0x81b09d008) at steps.h:38
 #8  0x0000000000430261 in wrk_do_cnt_sess (w=0x7ffffa1d1c80, priv=Variable
 "priv" is not available.
 )
     at cache_pool.c:301
 #9  0x000000000042f3fa in wrk_thread_real (qp=0x801213560,
 shm_workspace=Variable "shm_workspace" is not available.
 )
     at cache_pool.c:184
 #10 0x0000000800e61511 in pthread_getprio () from /lib/libthr.so.3
 #11 0x0000000000000000 in ?? ()
 Error accessing memory address 0x7ffffa1d2000: Bad address.
 (gdb) frame 4
 #4  0x00000000004333df in VRY_Match (sp=0x81b09d008,
     vary=0x81ecaefd8 "80.91.37.197") at cache_vary.c:192
 192                             i = http_GetHdr(sp->http, (const
 char*)(vary+2), &h);
 (gdb) print *hp
 No symbol "hp" in current context.
 (gdb) print *sp->http
 $1 = {magic = 1680389577, logtag = HTTP_Rx, ws = 0x81b09d080,
   hd = 0x81b09d410, hdf = 0x81b09d810 "", shd = 64, nhd = 12, status = 0,
   protover = 11 '\v', conds = 0 '\0'}
 (gdb) print *sp
 $2 = {magic = 741317722, fd = 1382, id = 1382, xid = 1286732790, restarts
 = 0,
   esi_level = 0, disable_esi = 0, hash_ignore_busy = 0 '\0',
   hash_always_miss = 0 '\0', wrk = 0x7ffffa1d1c80, sockaddrlen = 16,
   mysockaddrlen = 128, sockaddr = 0x81b09d2e8, mysockaddr = 0x81b09d368,
   mylsock = 0x801222520, addr = 0x81b09dcb8 "161.4.150.7",
   port = 0x81b09dcc8 "15176", client_identity = 0x0, doclose = 0x0,
   http = 0x81b09d3e8, http0 = 0x81b09d850, ws = {{magic = 905626964,
       overflow = 0, id = 0x4533b6 "sess", s = 0x81b09dcb8 "161.4.150.7",
       f = 0x81b09df38 "29", r = 0x81b0adcb8 "", e = 0x81b0adcb8 ""}},
   ws_ses = 0x81b09dcd0 "GET", ws_req = 0x81b09df08 "Accept-Encoding:
 gzip",
   digest = "A�f\201Lw�-p\031/�hq*�\032\210l\202\213^�*Vp\217�xJqO",
   vary_b = 0x81b09df38 "29", vary_l = 0x0, vary_e = 0x81b0adcb8 "", htc =
 {{
       magic = 1041886673, fd = 1382, maxbytes = 32768, maxhdr = 4096,
       ws = 0x81b09d080, rxbuf = {b = 0x81b09dcd0 "GET", e = 0x81b09df01
 ""},
       pipeline = {b = 0x0, e = 0x0}}}, t_open = 1314865981.1631174,
   t_req = 1314865981.1632659, t_resp = nan(0x8000000000000),
   t_end = 1314865981.1631174, exp = {ttl = -1, grace = 21600, keep = -1,
     age = 0, entered = 0}, step = STP_LOOKUP, cur_method = 0, handling =
 3,
   sendbody = 0 '\0', wantbody = 1 '\001', err_code = 0, err_reason = 0x0,
   list = {vtqe_next = 0x0, vtqe_prev = 0x0}, director = 0x801213978,
   vbc = 0x0, obj = 0x0, objcore = 0x0, vcl = 0x80130cf28, hash_objhead =
 0x0,
   mem = 0x81b09d000, workreq = {list = {vtqe_next = 0x0, vtqe_prev = 0x0},
     func = 0x4301a0 <wrk_do_cnt_sess>, priv = 0x81b09d008}, acct_tmp = {
     first = 0, sess = 1, req = 1, pipe = 0, pass = 0, fetch = 0, hdrbytes
 = 0,
     bodybytes = 0}, acct_req = {first = 0, sess = 0, req = 0, pipe = 0,
     pass = 0, fetch = 0, hdrbytes = 0, bodybytes = 0}, acct_ses = {
     first = 1314865981.1631174, sess = 0, req = 0, pipe = 0, pass = 0,
     fetch = 0, hdrbytes = 0, bodybytes = 0}}
 (gdb)
 }}}

 It does seem to run a little longer before crashing however?

-- 
Ticket URL: <http://www.varnish-cache.org/trac/ticket/1001#comment:10>
Varnish <http://varnish-cache.org/>
The Varnish HTTP Accelerator




More information about the varnish-bugs mailing list