[Ns-bugs] [Bug 80] New: valgrind error when finalizing PacketMetadata

[bugzilla-daemon@nsnam-www.ece.gatech.edu]

http://www.nsnam.org/bugzilla/show_bug.cgi?id=80

           Summary: valgrind error when finalizing PacketMetadata
           Product: ns-3
           Version: pre-release
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P1
         Component: simulation core
        AssignedTo: ns-bugs at isi.edu
        ReportedBy: gjcarneiro at gmail.com


A simulation runs flawlessly, but in the end when main is exiting:

==14231== Invalid write of size 8
==14231==    at 0x50858B8:
__gnu_cxx::new_allocator<ns3::PacketMetadata::Data*>::construct(ns3::PacketMetadata::Data**,
ns3::PacketMetadata::Data* const&) (new_allocator.h:104)
==14231==    by 0x5086AD2: std::vector<ns3::PacketMetadata::Data*,
std::allocator<ns3::PacketMetadata::Data*>
>::push_back(ns3::PacketMetadata::Data* const&) (stl_vector.h:606)
==14231==    by 0x5083892:
ns3::PacketMetadata::Recycle(ns3::PacketMetadata::Data*)
(packet-metadata.cc:655)
==14231==    by 0x40959E: ns3::PacketMetadata::~PacketMetadata()
(packet-metadata.h:340)
==14231==    by 0x409681: ns3::Packet::~Packet() (packet.h:75)
==14231==    by 0x50F9725: ns3::UdpSocketTest::~UdpSocketTest()
(udp-socket.cc:352)
==14231==    by 0x50F466B: __tcf_1 (udp-socket.cc:459)
==14231==    by 0x5BE983F: __cxa_finalize (in /lib/libc-2.6.1.so)
==14231==    by 0x4FF4742: (within
/home/gjc/projects/ns-3/ns-3-wmn/build/debug/libns3.so)
==14231==    by 0x513B880: (within
/home/gjc/projects/ns-3/ns-3-wmn/build/debug/libns3.so)
==14231==    by 0x5BE94FF: exit (in /lib/libc-2.6.1.so)
==14231==    by 0x5BD2B4A: (below main) (in /lib/libc-2.6.1.so)
==14231==  Address 0x5f33758 is 8 bytes inside a block of size 64 free'd
==14231==    at 0x4C2162D: operator delete(void*) (vg_replace_malloc.c:336)
==14231==    by 0x50866EE:
__gnu_cxx::new_allocator<ns3::PacketMetadata::Data*>::deallocate(ns3::PacketMetadata::Data**,
unsigned long) (new_allocator.h:94)
==14231==    by 0x5086720: std::_Vector_base<ns3::PacketMetadata::Data*,
std::allocator<ns3::PacketMetadata::Data*>
>::_M_deallocate(ns3::PacketMetadata::Data**, unsigned long) (stl_vector.h:133)
==14231==    by 0x5086D97: std::_Vector_base<ns3::PacketMetadata::Data*,
std::allocator<ns3::PacketMetadata::Data*> >::~_Vector_base()
(stl_vector.h:119)
==14231==    by 0x5086DEE: std::vector<ns3::PacketMetadata::Data*,
std::allocator<ns3::PacketMetadata::Data*> >::~vector() (stl_vector.h:272)
==14231==    by 0x5083905: ns3::PacketMetadata::DataFreeList::~DataFreeList()
(packet-metadata.cc:46)
==14231==    by 0x508394D: __tcf_1 (packet-metadata.cc:37)
==14231==    by 0x5BE983F: __cxa_finalize (in /lib/libc-2.6.1.so)
==14231==    by 0x4FF4742: (within
/home/gjc/projects/ns-3/ns-3-wmn/build/debug/libns3.so)
==14231==    by 0x513B880: (within
/home/gjc/projects/ns-3/ns-3-wmn/build/debug/libns3.so)
==14231==    by 0x5BE94FF: exit (in /lib/libc-2.6.1.so)
==14231==    by 0x5BD2B4A: (below main) (in /lib/libc-2.6.1.so)


I am not very familiar with the metadata code, but it looks like the system was
caught in a state where there exists a packet using a data segment that also
belongs to the metadata "free list".  The "free list" is destroyed and frees
the data segment; subsequently the packet is also destroyed and also frees the
metadata which tries to free the same data a second time.


-- 
Configure bugmail: http://www.nsnam.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.