"Double free or corruption" when closing ddcui

[VorpalBlade]

When I close ddcui (by clicking the close button on the window border) after having switched to the "Features" view I get one of these errors in the terminal (which one varies from run to run):

double free or corruption (!prev)
double free or corruption (out)
free(): double free detected in tcache 2

Analysing the core dump in gdb gives me the following stack (it seems I don't have debug symbols for ddcui itself, but I'm willing to try to rebuild it if you have issues reproducing the issue):

(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
#1  0x00007faf0309a363 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89
#2  0x00007faf0303e7d0 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007faf03025681 in __GI_abort () at abort.c:77
#4  0x00007faf03026700 in __libc_message_impl (vma_name=vma_name@entry=0x7faf031b4891 "glibc: fatal", fmt=fmt@entry=0x7faf031b7e92 "%s\n") at ../sysdeps/posix/libc_fatal.c:138
#5  0x00007faf030a47cc in __libc_message_wrapper (vmaname=0x7faf031b4891 "glibc: fatal", fmt=0x7faf031b7e92 "%s\n") at ../include/stdio.h:203
#6  malloc_printerr (str=str@entry=0x7faf031ba888 "double free or corruption (out)") at malloc.c:5341
#7  0x00007faf030a6240 in _int_free_merge_chunk (av=0x7faf03213ac0 <main_arena>, p=0x7faec4003dc0, size=224) at malloc.c:4420
#8  0x00007faf030a6344 in _int_free_chunk (av=0x7faf03213ac0 <main_arena>, p=<optimized out>, size=<optimized out>, have_lock=<optimized out>, have_lock@entry=0) at malloc.c:4368
#9  0x00007faf030a9156 in __GI___libc_free (mem=<optimized out>) at malloc.c:3374
#10 0x00007faf04a2aacb in free_ddca_feature_metadata (metadata=0x7faec4003830) at base/feature_metadata.c:648
#11 ddca_free_feature_metadata (metadata=0x7faec4003830) at libmain/api_metadata.c:672
#12 0x0000557ee53f3070 in ?? ()
#13 0x0000557ee5401a6b in ?? ()
#14 0x0000557ee5401d95 in ?? ()
#15 0x00007faf039dfdba in QObjectPrivate::deleteChildren (this=this@entry=0x557eec847dc0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2279
#16 0x00007faf04d4dca1 in QWidget::~QWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1581
#17 0x0000557ee5400bc7 in ?? ()
#18 0x00007faf039dfdba in QObjectPrivate::deleteChildren (this=this@entry=0x557eec7c2460) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2279
#19 0x00007faf04d4dca1 in QWidget::~QWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1581
#20 0x0000557ee5400d28 in ?? ()
#21 0x00007faf039dfdba in QObjectPrivate::deleteChildren (this=this@entry=0x557eeccb57a0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2279
#22 0x00007faf04d4dca1 in QWidget::~QWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1581
#23 0x00007faf04d4de25 in QWidget::~QWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1608
#24 0x00007faf039dfdba in QObjectPrivate::deleteChildren (this=this@entry=0x557eecc020e0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2279
#25 0x00007faf04d4dca1 in QWidget::~QWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1581
#26 0x0000557ee5400f3a in ?? ()
#27 0x00007faf039dfdba in QObjectPrivate::deleteChildren (this=this@entry=0x557eec877e80) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2279
#28 0x00007faf04d4dca1 in QWidget::~QWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1581
#29 0x00007faf04dcb639 in QFrame::~QFrame (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:236
#30 QFrame::~QFrame (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:236
#31 0x00007faf039dfdba in QObjectPrivate::deleteChildren (this=this@entry=0x557eeccee8e0) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2279
#32 0x00007faf04d4dca1 in QWidget::~QWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1581
#33 0x00007faf04f6cb39 in QFrame::~QFrame (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qframe.cpp:236
#34 QStackedWidget::~QStackedWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qstackedwidget.cpp:127
#35 QStackedWidget::~QStackedWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/widgets/qstackedwidget.cpp:127
#36 0x00007faf039dfdba in QObjectPrivate::deleteChildren (this=this@entry=0x557eeccfa190) at /usr/src/debug/qt6-base/qtbase/src/corelib/kernel/qobject.cpp:2279
#37 0x00007faf04d4dca1 in QWidget::~QWidget (this=<optimized out>, this=<optimized out>) at /usr/src/debug/qt6-base/qtbase/src/widgets/kernel/qwidget.cpp:1581
#38 0x0000557ee53e41b2 in ?? ()
#39 0x00007faf03027741 in __libc_start_call_main (main=main@entry=0x557ee53e2720, argc=argc@entry=1, argv=argv@entry=0x7ffc7db2b5c8) at ../sysdeps/nptl/libc_start_call_main.h:59
#40 0x00007faf03027879 in __libc_start_main_impl (main=0x557ee53e2720, argc=1, argv=0x7ffc7db2b5c8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, 
    stack_end=0x7ffc7db2b5b8) at ../csu/libc-start.c:360
#41 0x0000557ee53e6275 in ?? ()

Steps to reproduce

1. Launch ddcui
2. Switch to the "Features" view
3. Close ddcui

Versions

• ddcui 0.6.0
• ddcutil 2.2.7
• Arch Linux (rolling release)
• glibc 2.43
• Qt 6.11
• KDE Plasma 6.6.5 (Wayland session)
• ddcui was built with GCC 14.2.

[VorpalBlade]

I can reproduce this on the latest 0.6.1-dev (commit 19eec99)

[VorpalBlade]

Testing with valgrind I find a bunch of reported issues (that may or may not be related).

When switching to the Features view:

==28955== Thread 8 QThread:
==28955== Mismatched new/delete size value: 4
==28955==    at 0x4975979: operator delete(void*, unsigned long) (vg_replace_malloc.c:1181)
==28955==    by 0x40635AB: VcpThread::run() (vcpthread.cpp:610)
==28955==    by 0x612B4FA: QThreadPrivate::start(void*) (qthread_unix.cpp:466)
==28955==    by 0x69181B8: start_thread (pthread_create.c:454)
==28955==    by 0x699D043: clone (clone.S:100)
==28955==  Address 0x28979570 is 0 bytes inside a block of size 8 alloc'd
==28955==    at 0x4972093: operator new(unsigned long) (vg_replace_malloc.c:487)
==28955==    by 0x40564DB: FeatureBaseModel::setFeatureList(DDCA_Feature_List) (feature_base_model.cpp:364)
==28955==    by 0x409E2F8: MainWindow::loadMonitorFeatures(Monitor*) (mainwindow.cpp:1223)
==28955==    by 0x409DC2B: MainWindow::on_actionFeaturesScrollArea_triggered() (mainwindow.cpp:1163)
==28955==    by 0x4027193: MainWindow::qt_static_metacall(QObject*, QMetaObject::Call, int, void**) (moc_mainwindow.cpp:239)
==28955==    by 0x402775C: MainWindow::qt_metacall(QMetaObject::Call, int, void**) (moc_mainwindow.cpp:304)
==28955==    by 0x5FA3B5C: void doActivate<false>(QObject*, int, void**) (qobject.cpp:4398)
==28955==    by 0x5A487AD: UnknownInlinedFun (qobjectdefs.h:320)
==28955==    by 0x5A487AD: UnknownInlinedFun (moc_qaction.cpp:374)
==28955==    by 0x5A487AD: QAction::activate(QAction::ActionEvent) (qaction.cpp:1106)
==28955==    by 0x4D02A2F: QMenuPrivate::activateCausedStack(QList<QPointer<QWidget> > const&, QAction*, QAction::ActionEvent, bool) (qmenu.cpp:1413)
==28955==    by 0x4D0545E: QMenuPrivate::activateAction(QAction*, QAction::ActionEvent, bool) (qmenu.cpp:1495)
==28955==    by 0x4B3AE5D: QWidget::event(QEvent*) (qwidget.cpp:9029)
==28955==    by 0x4ADB11E: QApplicationPrivate::notify_helper(QObject*, QEvent*) (qapplication.cpp:3276)

This looks like object slicing because VcpRequest doesn't have a virtual destructor, and it is being deleted via its base pointer.

EDIT: Filed #75 to fix this, but it is unfortunately not the cause of the segfault.

---

When closing the program I get a bunch of errors (hundreds), though the first one is:

==28955== Invalid read of size 4
==28955==    at 0x53787B9: ddca_free_feature_metadata (api_metadata.c:669)
==28955==    by 0x4067A22: ValueBaseWidget::~ValueBaseWidget() (value_base_widget.cpp:85)
==28955==    by 0x407ABC9: ValueStdWidget::~ValueStdWidget() (value_std_widget.cpp:105)
==28955==    by 0x407ABEB: ValueStdWidget::~ValueStdWidget() (value_std_widget.cpp:105)
==28955==    by 0x4077E66: ValueStackedWidget::~ValueStackedWidget() (value_stacked_widget.cpp:181)
==28955==    by 0x4077F41: ValueStackedWidget::~ValueStackedWidget() (value_stacked_widget.cpp:189)
==28955==    by 0x5F92DB9: QObjectPrivate::deleteChildren() (qobject.cpp:2279)
==28955==    by 0x4B24CA0: QWidget::~QWidget() (qwidget.cpp:1581)
==28955==    by 0x407C81D: FeatureWidget::~FeatureWidget() (feature_widget.cpp:160)
==28955==    by 0x407C83F: FeatureWidget::~FeatureWidget() (feature_widget.cpp:160)
==28955==    by 0x5F92DB9: QObjectPrivate::deleteChildren() (qobject.cpp:2279)
==28955==    by 0x4B24CA0: QWidget::~QWidget() (qwidget.cpp:1581)
==28955==  Address 0x2898ee40 is 0 bytes inside a block of size 48 free'd
==28955==    at 0x49749EF: free (vg_replace_malloc.c:989)
==28955==    by 0x5378B14: UnknownInlinedFun (feature_metadata.c:652)
==28955==    by 0x5378B14: ddca_free_feature_metadata (api_metadata.c:672)
==28955==    by 0x4059B32: FeatureValue::delete_finfo() (feature_value.cpp:149)
==28955==    by 0x4055382: FeatureBaseModel::~FeatureBaseModel() (feature_base_model.cpp:76)
==28955==    by 0x40554BD: FeatureBaseModel::~FeatureBaseModel() (feature_base_model.cpp:84)
==28955==    by 0x40A9BCE: Monitor::~Monitor() (monitor.cpp:79)
==28955==    by 0x40A9CB5: Monitor::~Monitor() (monitor.cpp:86)
==28955==    by 0x4098FCE: MainWindow::freeMonitors() (mainwindow.cpp:326)
==28955==    by 0x409BE4E: MainWindow::~MainWindow() (mainwindow.cpp:768)
==28955==    by 0x40969B2: main (main.cpp:505)
==28955==  Block was alloc'd at
==28955==    at 0x4978D13: calloc (vg_replace_malloc.c:1675)
==28955==    by 0x53494D0: dfm_to_ddca_feature_metadata (feature_metadata.c:613)
==28955==    by 0x537FDC7: ddca_get_feature_metadata_by_dh (api_metadata.c:620)
==28955==    by 0x4062A75: VcpThread::getvcp(unsigned char, bool) (vcpthread.cpp:412)
==28955==    by 0x406344A: VcpThread::run() (vcpthread.cpp:577)
==28955==    by 0x612B4FA: QThreadPrivate::start(void*) (qthread_unix.cpp:466)
==28955==    by 0x69181B8: start_thread (pthread_create.c:454)
==28955==    by 0x699D043: clone (clone.S:100)

The first "invalid free error" is:

==28955== Invalid free() / delete / delete[] / realloc()
==28955==    at 0x49749EF: free (vg_replace_malloc.c:989)
==28955==    by 0x5378AF1: UnknownInlinedFun (feature_metadata.c:342)
==28955==    by 0x5378AF1: UnknownInlinedFun (feature_metadata.c:332)
==28955==    by 0x5378AF1: UnknownInlinedFun (feature_metadata.c:650)
==28955==    by 0x5378AF1: ddca_free_feature_metadata (api_metadata.c:672)
==28955==    by 0x4067A22: ValueBaseWidget::~ValueBaseWidget() (value_base_widget.cpp:85)
==28955==    by 0x407ABC9: ValueStdWidget::~ValueStdWidget() (value_std_widget.cpp:105)
==28955==    by 0x407ABEB: ValueStdWidget::~ValueStdWidget() (value_std_widget.cpp:105)
==28955==    by 0x4077E66: ValueStackedWidget::~ValueStackedWidget() (value_stacked_widget.cpp:181)
==28955==    by 0x4077F41: ValueStackedWidget::~ValueStackedWidget() (value_stacked_widget.cpp:189)
==28955==    by 0x5F92DB9: QObjectPrivate::deleteChildren() (qobject.cpp:2279)
==28955==    by 0x4B24CA0: QWidget::~QWidget() (qwidget.cpp:1581)
==28955==    by 0x407C81D: FeatureWidget::~FeatureWidget() (feature_widget.cpp:160)
==28955==    by 0x407C83F: FeatureWidget::~FeatureWidget() (feature_widget.cpp:160)
==28955==    by 0x5F92DB9: QObjectPrivate::deleteChildren() (qobject.cpp:2279)
==28955==  Address 0x2898f050 is 0 bytes inside a block of size 22 free'd
==28955==    at 0x49749EF: free (vg_replace_malloc.c:989)
==28955==    by 0x5378AF1: UnknownInlinedFun (feature_metadata.c:342)
==28955==    by 0x5378AF1: UnknownInlinedFun (feature_metadata.c:332)
==28955==    by 0x5378AF1: UnknownInlinedFun (feature_metadata.c:650)
==28955==    by 0x5378AF1: ddca_free_feature_metadata (api_metadata.c:672)
==28955==    by 0x4059B32: FeatureValue::delete_finfo() (feature_value.cpp:149)
==28955==    by 0x4055382: FeatureBaseModel::~FeatureBaseModel() (feature_base_model.cpp:76)
==28955==    by 0x40554BD: FeatureBaseModel::~FeatureBaseModel() (feature_base_model.cpp:84)
==28955==    by 0x40A9BCE: Monitor::~Monitor() (monitor.cpp:79)
==28955==    by 0x40A9CB5: Monitor::~Monitor() (monitor.cpp:86)
==28955==    by 0x4098FCE: MainWindow::freeMonitors() (mainwindow.cpp:326)
==28955==    by 0x409BE4E: MainWindow::~MainWindow() (mainwindow.cpp:768)
==28955==    by 0x40969B2: main (main.cpp:505)
==28955==  Block was alloc'd at
==28955==    at 0x49718A8: malloc (vg_replace_malloc.c:446)
==28955==    by 0x51E295A: g_malloc (gmem.c:100)
==28955==    by 0x5202E0B: g_strdup (gstrfuncs.c:323)
==28955==    by 0x5348C70: UnknownInlinedFun (gstrfuncs.h:321)
==28955==    by 0x5348C70: copy_sl_value_table (feature_metadata.c:313)
==28955==    by 0x5349545: dfm_to_ddca_feature_metadata (feature_metadata.c:625)
==28955==    by 0x537FDC7: ddca_get_feature_metadata_by_dh (api_metadata.c:620)
==28955==    by 0x4062A75: VcpThread::getvcp(unsigned char, bool) (vcpthread.cpp:412)
==28955==    by 0x406344A: VcpThread::run() (vcpthread.cpp:577)
==28955==    by 0x612B4FA: QThreadPrivate::start(void*) (qthread_unix.cpp:466)
==28955==    by 0x69181B8: start_thread (pthread_create.c:454)
==28955==    by 0x699D043: clone (clone.S:100)

[rockowitz]

This looks like a double free that I just resolved in branch 0.7.0. Let me know if that's the case.