Segfault in UMA shutdown / destructor path #29
Description
After running for a while, a clean shutdown ends with a segfault:
Core was generated by `blockd'.
Program terminated with signal 11, Segmentation fault.
#0 uma_zfree_arg (zone=0x802e58d80, item=0x802505000, udata=0x0) at /home/adrian/git/github/erikarn/libuinet/lib/libuinet/../../sys/vm/uma_core.c:2788
2788 bucket = cache->uc_freebucket;
(gdb) bt
#0 uma_zfree_arg (zone=0x802e58d80, item=0x802505000, udata=0x0) at /home/adrian/git/github/erikarn/libuinet/lib/libuinet/../../sys/vm/uma_core.c:2788
#1 0x000000000049485c in zone_free_item (zone=0x802e57000, item=0x8024f5b00, udata=0x0, skip=, flags=0)
at /home/adrian/git/github/erikarn/libuinet/lib/libuinet/../../sys/vm/uma_core.c:2932
#2 0x0000000000493342 in bucket_drain (zone=0x802e57000, bucket=0x80278f418) at /home/adrian/git/github/erikarn/libuinet/lib/libuinet/../../sys/vm/uma_core.c:660
#3 local_cache_drain (zone=0x802e57000, cache=) at /home/adrian/git/github/erikarn/libuinet/lib/libuinet/../../sys/vm/uma_core.c:670
#4 uma_tls_destructor (arg=0x81c00f000) at /home/adrian/git/github/erikarn/libuinet/lib/libuinet/../../sys/vm/uma_core.c:1653
#5 0x000000080229dd25 in ?? () from /lib/libthr.so.3
#6 0x00000008022a533e in ?? () from /lib/libthr.so.3
#7 0x00000008022a5289 in ?? () from /lib/libthr.so.3
#8 0x00000008022a50fb in pthread_exit () from /lib/libthr.so.3
#9 0x000000080229a4fd in ?? () from /lib/libthr.so.3
#10 0x0000000000000000 in ?? ()
(gdb) frame 0
#0 uma_zfree_arg (zone=0x802e58d80, item=0x802505000, udata=0x0) at /home/adrian/git/github/erikarn/libuinet/lib/libuinet/../../sys/vm/uma_core.c:2788
2788 bucket = cache->uc_freebucket;
(gdb) print cache
$1 =
(gdb) print bucket
$2 =
(gdb) print zone
$3 = (uma_zone_t) 0x802e58d80
(gdb) print *zone
$4 = {uz_name = 0x4b0ff5 "mbuf_cluster", uz_lock = 0x802e598d0, uz_link = {le_next = 0x0, le_prev = 0x802e59908}, uz_full_bucket = {lh_first = 0x0}, uz_free_bucket = {lh_first = 0x0}, uz_kegs = {
lh_first = 0x802e58db8}, uz_klink = {kl_link = {le_next = 0x0, le_prev = 0x802e58db0}, kl_keg = 0x802e598c0}, uz_slab = 0x4963b0 <zone_fetch_slab>, uz_ctor = 0x432540 <mb_ctor_clust>,
uz_dtor = 0x432620 <mb_dtor_clust>, uz_init = 0x0, uz_fini = 0x0, uz_flags = 9224, uz_size = 2048, uz_allocs = 245, uz_frees = 0, uz_fails = 0, uz_sleeps = 0, uz_fills = 0, uz_count = 24,
uz_cacheidx = 2}
(gdb) print uma_tls_key
$5 = 3
(gdb) print uhi_tls_get(uma_tls_key)
You can't do that without a process to debug.
(gdb) frame 4
#4 uma_tls_destructor (arg=0x81c00f000) at /home/adrian/git/github/erikarn/libuinet/lib/libuinet/../../sys/vm/uma_core.c:1653
1653 local_cache_drain(tls->ut_caches[i].uc_zone, &tls->ut_caches[i]);
(gdb)
I'll recompile with -O0 and retry but I bet it's NULL.