deregistering handle with poller crash with segmentation fault 11 on macOS

[fbucek]

Crash with segmentation fault 11 when running and closing http-proxy from actix-example actix/examples#261

Step to reproduce on macOS ( no crashes on ubuntu 18.04 )

git clone https://github.com/actix/examples.git
cd examples/http-proxy
cargo run localhost 8080 google.com 80
-> ctrl+c

When enabled logging in main.rs

    std::env::set_var("RUST_LOG", "trace");
    env_logger::init();

2020-02-27T12:45:24Z INFO  actix_server::builder] Starting 12 workers
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z INFO  actix_server::builder] Starting "actix-web-service-[::1]:8090" service on [::1]:8090
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(100); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(18446744073709551615); interests=Readable
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(0); interests=Readable | Writable | Error | Hup
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(1); interests=Readable | Writable | Error | Hup
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(2); interests=Readable | Writable | Error | Hup
[2020-02-27T12:45:24Z TRACE mio::poll] registering with poller
[2020-02-27T12:45:24Z TRACE mio::sys::unix::kqueue] registering; token=Token(3); interests=Readable | Writable | Error | Hup
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
[2020-02-27T12:45:24Z TRACE actix_server::worker] Service "actix-web-service-[::1]:8090" is available
^C[2020-02-27T12:45:30Z INFO  actix_server::builder] SIGINT received, exiting
[2020-02-27T12:45:30Z TRACE mio::poll] deregistering handle with poller
[2020-02-27T12:45:30Z TRACE mio::poll] deregistering handle with poller
[2020-02-27T12:45:30Z TRACE mio::poll] deregistering handle with poller
[2020-02-27T12:45:30Z TRACE mio::poll] deregistering handle with poller
[2020-02-27T12:45:30Z TRACE mio::poll] deregistering handle with poller
Segmentation fault: 11

Process 46044 launched: 'http-proxy' (x86_64)
Process 46044 stopped
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
    frame #0: 0x00007fff66d48bce libsystem_kernel.dylib`kevent + 10
libsystem_kernel.dylib`kevent:
->  0x7fff66d48bce <+10>: jae    0x7fff66d48bd8            ; <+20>
    0x7fff66d48bd0 <+12>: movq   %rax, %rdi
    0x7fff66d48bd3 <+15>: jmp    0x7fff66d44a89            ; cerror_nocancel
    0x7fff66d48bd8 <+20>: retq   
Target 0: (http-proxy) stopped.
(lldb) thread backtrace
* thread #1, queue = 'com.apple.main-thread', stop reason = signal SIGSTOP
  * frame #0: 0x00007fff66d48bce libsystem_kernel.dylib`kevent + 10
    frame #1: 0x0000000100af0954 http-proxy`mio::sys::unix::kqueue::Selector::select::h593b29fd5a8e70a4(self=&0x102500a30, evts=&0x7ffeefbff1a0, awakener=Token(18446744073709551615), timeout=<unavailable>) at kqueue.rs:88:26
    frame #2: 0x0000000100ae740f http-proxy`mio::poll::Poll::poll2::he9b32556cb864935(self=&0x102500a30, events=&0x7ffeefbff1a0, timeout=Option<core::time::Duration> {

}, interruptible=false) at poll.rs:1178:22
    frame #3: 0x0000000100ae711c http-proxy`mio::poll::Poll::poll1::h1dff1fe24c74b120(self=&0x102500a30, events=&0x7ffeefbff1a0, timeout=Option<core::time::Duration> {

}, interruptible=false) at poll.rs:1139:18
    frame #4: 0x0000000100ae6a82 http-proxy`mio::poll::Poll::poll::hf37275f18a5cd79d(self=&0x102500a30, events=&0x7ffeefbff1a0, timeout=<unavailable>) at poll.rs:1010:8
    frame #5: 0x0000000100a65ae5 http-proxy`tokio::io::driver::Driver::turn::h0776d3777b1f9cdd(self=&0x7ffeefbff1a0, max_wait=Option<core::time::Duration> {

}) at mod.rs:107:14
    frame #6: 0x0000000100a66342 http-proxy`_$LT$tokio..io..driver..Driver$u20$as$u20$tokio..park..Park$GT$::park::h02adf99424a8bd69(self=&0x7ffeefbff1a0) at mod.rs:176:8
    frame #7: 0x0000000100a9abe4 http-proxy`_$LT$tokio..park..either..Either$LT$A$C$B$GT$$u20$as$u20$tokio..park..Park$GT$::park::h95c0b5f0d1480dbb(self=&0x7ffeefbff198) at either.rs:28:28
    frame #8: 0x0000000100a8df49 http-proxy`_$LT$tokio..time..driver..Driver$LT$T$GT$$u20$as$u20$tokio..park..Park$GT$::park::h47b09b41e3fb89f0(self=&0x7ffeefbff170) at mod.rs:261:16
    frame #9: 0x0000000100a9ab54 http-proxy`_$LT$tokio..park..either..Either$LT$A$C$B$GT$$u20$as$u20$tokio..park..Park$GT$::park::h0755b632eb5fedb9(self=&0x7ffeefbff168) at either.rs:28:28
    frame #10: 0x000000010077877b http-proxy`tokio::runtime::basic_scheduler::SchedulerPriv::tick::h9461903028e594e3(self=&0x102500b60, local=&0x7ffeefbff168) at basic_scheduler.rs:187:20
    frame #11: 0x00000001000153a4 http-proxy`tokio::runtime::basic_scheduler::BasicScheduler$LT$P$GT$::block_on::h9f3d588388b84eb1(self=&0x7ffeefbff160, future=GenFuture<tokio::task::local::{{impl}}::run_until::generator-0>(generator-0(&0x7ffeefbff150, GenFuture<http_proxy::main::generator-0>(generator-0 {

})))) at basic_scheduler.rs:142:12
    frame #12: 0x00000001000169ed http-proxy`tokio::runtime::Runtime::block_on::_$u7b$$u7b$closure$u7d$$u7d$::hab33ede4ee2b66e6 at mod.rs:411:33
    frame #13: 0x000000010008ce8d http-proxy`tokio::runtime::context::enter::h6a71bbda7fea6ac9(new=<unavailable>, f=closure-0(&0x7ffeefbfe1d8, GenFuture<tokio::task::local::{{impl}}::run_until::generator-0>(generator-0(&0x7ffeefbff150, GenFuture<http_proxy::main::generator-0>(generator-0 {

}))))) at context.rs:72:4
    frame #14: 0x000000010003341c http-proxy`tokio::runtime::handle::Handle::enter::h17d9ea6c5d7db852(self=&0x7ffeefbff220, f=closure-0(&0x7ffeefbfe1d8, GenFuture<tokio::task::local::{{impl}}::run_until::generator-0>(generator-0(&0x7ffeefbff150, GenFuture<http_proxy::main::generator-0>(generator-0 {

}))))) at handle.rs:34:8
    frame #15: 0x00000001000168c6 http-proxy`tokio::runtime::Runtime::block_on::ha275eb50d5108984(self=&0x7ffeefbff158, future=<unavailable>) at mod.rs:408:8
    frame #16: 0x000000010004ef9e http-proxy`tokio::task::local::LocalSet::block_on::ha980b22e45f039ca(self=&0x7ffeefbff150, rt=&0x7ffeefbff158, future=<unavailable>) at local.rs:321:8
    frame #17: 0x0000000100035d18 http-proxy`actix_rt::runtime::Runtime::block_on::hfc78daa536cde9f9(self=&0x7ffeefbff150, f=<unavailable>) at runtime.rs:89:18
    frame #18: 0x0000000100044534 http-proxy`actix_rt::builder::SystemRunner::block_on::hdb5747669fae9936(self=&0x7ffeefbff150, fut=GenFuture<http_proxy::main::generator-0>(generator-0 {

})) at builder.rs:187:18
    frame #19: 0x000000010003683d http-proxy`http_proxy::main::h3afe62497a00fe79 at main.rs:43
    frame #20: 0x0000000100075746 http-proxy`std::rt::lang_start::_$u7b$$u7b$closure$u7d$$u7d$::he23f145a4a567003 at rt.rs:67:33
    frame #21: 0x0000000100b29078 http-proxy`std::panicking::try::do_call::h77eb563f55a56484 [inlined] std::rt::lang_start_internal::_$u7b$$u7b$closure$u7d$$u7d$::h04f5bc1b8502155f at rt.rs:52:12 [opt]
    frame #22: 0x0000000100b2906c http-proxy`std::panicking::try::do_call::h77eb563f55a56484 at panicking.rs:292 [opt]
    frame #23: 0x0000000100b2d21f http-proxy`__rust_maybe_catch_panic at lib.rs:78:7 [opt]
    frame #24: 0x0000000100b29a4e http-proxy`std::rt::lang_start_internal::h3d261fac4b6382f2 [inlined] std::panicking::try::h989c79f60ffdf02a at panicking.rs:270:12 [opt]
    frame #25: 0x0000000100b29a1b http-proxy`std::rt::lang_start_internal::h3d261fac4b6382f2 [inlined] std::panic::catch_unwind::hd3f56528916c87b0 at panic.rs:394 [opt]
    frame #26: 0x0000000100b29a1b http-proxy`std::rt::lang_start_internal::h3d261fac4b6382f2 at rt.rs:51 [opt]
    frame #27: 0x0000000100075722 http-proxy`std::rt::lang_start::h1bc54f14185927ef(main=&0x1000367c0, argc=5, argv=&0x7ffeefbff820) at rt.rs:67:4
    frame #28: 0x00000001000368a2 http-proxy`main + 34
    frame #29: 0x00007fff66c037fd libdyld.dylib`start + 1

[Thomasdezeeuw]

What Mio version is this using?

[fbucek]

Latest one:
Compiling mio v0.6.21
Compiling mio-uds v0.6.7

[Thomasdezeeuw]

@fbucek latests one is 0.7.0-alpha.1, but yes non-alpha its v0.6.21.

[Thomasdezeeuw]

I don't think is this a problem in Mio. The line at which it fails is a system call to kevent, see:

mio/src/sys/unix/kqueue.rs

Line 88 in cd0423c

let cnt = cvt(libc::kevent(self.kq,

In the backtrace it shows that all arguments are pointer to something, i.e. not null:

    frame #1: 0x0000000100af0954 http-proxy`mio::sys::unix::kqueue::Selector::select::h593b29fd5a8e70a4(self=&0x102500a30, evts=&0x7ffeefbff1a0, awakener=Token(18446744073709551615), timeout=<unavailable>) at kqueue.rs:88:26

So either invalid arguments are supplied, or (more likely) another thread is dereferencing a null pointer causing the segfault.

I'm leaving this open in case you have a smaller example that shows Mio is at fault.

P.S. Mio doesn't handle signals, but doesn't crash on them either as I've had a bit of experience with them creating mio-signals.

[Thomasdezeeuw]

@fbucek any luck creating a smaller reproducible example?

[fbucek]

@Thomasdezeeuw unfortunatelly no.

[Thomasdezeeuw]

Since we haven't been able reproduce the issue I'm going to close this.