{"action":"created","issue":{"url":"https://api.github.com/repos/CESNET/libnetconf/issues/97","labels_url":"https://api.github.com/repos/CESNET/libnetconf/issues/97/labels{/name}","comments_url":"https://api.github.com/repos/CESNET/libnetconf/issues/97/comments","events_url":"https://api.github.com/repos/CESNET/libnetconf/issues/97/events","html_url":"https://github.com/CESNET/libnetconf/issues/97","id":104219534,"number":97,"title":"double free when call transapi_revert_callbacks_recursive() revert xml tree ","user":{"login":"jinxud","id":13162520,"avatar_url":"https://avatars.githubusercontent.com/u/13162520?v=3","gravatar_id":"","url":"https://api.github.com/users/jinxud","html_url":"https://github.com/jinxud","followers_url":"https://api.github.com/users/jinxud/followers","following_url":"https://api.github.com/users/jinxud/following{/other_user}","gists_url":"https://api.github.com/users/jinxud/gists{/gist_id}","starred_url":"https://api.github.com/users/jinxud/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jinxud/subscriptions","organizations_url":"https://api.github.com/users/jinxud/orgs","repos_url":"https://api.github.com/users/jinxud/repos","events_url":"https://api.github.com/users/jinxud/events{/privacy}","received_events_url":"https://api.github.com/users/jinxud/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"michalvasko","id":12510224,"avatar_url":"https://avatars.githubusercontent.com/u/12510224?v=3","gravatar_id":"","url":"https://api.github.com/users/michalvasko","html_url":"https://github.com/michalvasko","followers_url":"https://api.github.com/users/michalvasko/followers","following_url":"https://api.github.com/users/michalvasko/following{/other_user}","gists_url":"https://api.github.com/users/michalvasko/gists{/gist_id}","starred_url":"https://api.github.com/users/michalvasko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michalvasko/subscriptions","organizations_url":"https://api.github.com/users/michalvasko/orgs","repos_url":"https://api.github.com/users/michalvasko/repos","events_url":"https://api.github.com/users/michalvasko/events{/privacy}","received_events_url":"https://api.github.com/users/michalvasko/received_events","type":"User","site_admin":false},"milestone":null,"comments":10,"created_at":"2015-09-01T09:01:36Z","updated_at":"2015-09-07T09:59:47Z","closed_at":null,"body":"Hi,\r\n\r\nI found when transapi apply call back fail and try to revert the xml diff tree, it will cause the double free.\r\nmy case the order is TRANSAPI_CLBCKS_ROOT_TO_LEAF.\r\n\r\nnetopeer-server[4812]: Transapi revert XML tree (/B:interfaces/B:interface/D:l3-interface/D:ip, proposed operation 9).\r\n*** glibc detected *** /usr/bin/netopeer-server: double free or corruption (!prev): 0x000000000384ce20 ***\r\n======= Backtrace: =========\r\n/lib/libc.so.6(+0x78cc6)[0x2aaaac009cc6]\r\n/lib/libc.so.6(cfree+0x73)[0x2aaaac010303]\r\n/usr/lib64/libxml2.so.2(xmlFreeNodeList+0x221)[0x2aaaaad24d71]\r\n/usr/lib64/libxml2.so.2(xmlFreeNodeList+0x6d)[0x2aaaaad24bbd]\r\n\r\ndb) bt\r\n#0  0x00002aaaabfc4c35 in *__GI_raise (sig=<value optimized out>) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64\r\n#1  0x00002aaaabfc8780 in *__GI_abort () at abort.c:92\r\n#2  0x00002aaaabfffc0b in __libc_message (do_abort=<value optimized out>, fmt=<value optimized out>) at ../sysdeps/unix/sysv/linux/libc_fatal.c:189\r\n#3  0x00002aaaac009cc6 in malloc_printerr (action=3, str=0x2aaaac0e1868 \"double free or corruption (!prev)\", ptr=<value optimized out>)\r\n    at malloc.c:6295\r\n#4  0x00002aaaac010303 in *__GI___libc_free (mem=<value optimized out>) at malloc.c:3738\r\n#5  0x00002aaaaad24d71 in xmlFreeNodeList__internal_alias (cur=0x384cda0) at tree.c:3623\r\n#6  0x00002aaaaad24bbd in xmlFreeNodeList__internal_alias (cur=0x384cd00) at tree.c:3612\r\n#7  0x00002aaaaad24bbd in xmlFreeNodeList__internal_alias (cur=0x384cc60) at tree.c:3612\r\n#8  0x00002aaaaad24bbd in xmlFreeNodeList__internal_alias (cur=0x384cbc0) at tree.c:3612\r\n#9  0x00002aaaaad2564a in xmlFreeNode__internal_alias (cur=0x384cb20) at tree.c:3686\r\n#10 0x00002aaaabd58bf2 in transapi_revert_xml_tree (info=0x7fffffffd080, tree=0x3852ff0) at src/transapi/transapi.c:50\r\n#11 0x00002aaaabd58eb8 in transapi_revert_callbacks_recursive_own (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x3852ff0, \r\n    erropt=NC_EDIT_ERROPT_NOTSET, error=0x7fffffffd138) at src/transapi/transapi.c:114\r\n#12 0x00002aaaabd594c8 in transapi_revert_callbacks_recursive (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x3852ff0, \r\n    erropt=NC_EDIT_ERROPT_NOTSET, error=0x7fffffffd138) at src/transapi/transapi.c:262\r\n#13 0x00002aaaabd59384 in transapi_revert_callbacks_recursive_children (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x3853300, \r\n    erropt=NC_EDIT_ERROPT_NOTSET, error=0x7fffffffd138) at src/transapi/transapi.c:235\r\n#14 0x00002aaaabd59505 in transapi_revert_callbacks_recursive (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x3853300, \r\n    erropt=NC_EDIT_ERROPT_NOTSET, error=0x7fffffffd138) at src/transapi/transapi.c:266\r\n#15 0x00002aaaabd59384 in transapi_revert_callbacks_recursive_children (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x9953c0, \r\n    erropt=NC_EDIT_ERROPT_NOTSET, error=0x7fffffffd138) at src/transapi/transapi.c:235\r\n#16 0x00002aaaabd59505 in transapi_revert_callbacks_recursive (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x9953c0, \r\n    erropt=NC_EDIT_ERROPT_NOTSET, error=0x7fffffffd138) at src/transapi/transapi.c:266\r\n#17 0x00002aaaabd59384 in transapi_revert_callbacks_recursive_children (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x384f980, \r\n    erropt=NC_EDIT_ERROPT_NOTSET, error=0x7fffffffd138) at src/transapi/transapi.c:235\r\n#18 0x00002aaaabd59505 in transapi_revert_callbacks_recursive (info=0x7fffffffd080, session=0x8eb080, rpc=0x3152470, tree=0x384f980, \r\n    erropt=NC_EDIT_ERROPT_NOTSET, error=0x7fffffffd138) at src/transapi/transapi.c:266\r\n#19 0x00002aaaabd5a1b8 in transapi_running_changed (ds=0x262aa10, session=0x8eb080, rpc=0x3152470, old_doc=0x9cd0b0, new_doc=0x2002ef0, \r\n    erropt=NC_EDIT_ERROPT_NOTSET, error=0x7fffffffd138) at src/transapi/transapi.c:582\r\n#20 0x00002aaaabd4b032 in ncds_apply_transapi (ds=0x262aa10, session=0x8eb080, rpc=0x3152470, old=0x9cd0b0, erropt=NC_EDIT_ERROPT_NOTSET, reply=0x0)\r\n    at src/datastore.c:6169\r\n---Type <return> to continue, or q <return> to quit---\r\n#21 0x00002aaaabd4cf08 in ncds_apply_rpc (id=1714636916, session=0x8eb080, rpc=0x3152470) at src/datastore.c:7163\r\n#22 0x00002aaaabd4d49f in ncds_apply_rpc2all (session=0x8eb080, rpc=0x3152470, ids=0x0) at src/datastore.c:7306\r\n#23 0x0000000000404283 in server_process_rpc (session=0x8eb080, rpc=0x3152470) at src/server_operations.c:564\r\n#24 0x0000000000406949 in process_operation (socket=29) at src/server_comm_socket.c:477\r\n#25 0x0000000000406d79 in comm_loop (conn=0x60a8e0, timeout=500) at src/server_comm_socket.c:598\r\n#26 0x0000000000403e29 in main (argc=1, argv=0x7fffffffe878) at src/server.c:357\r\n\r\nand I found when handle the parent(/B:interfaces/B:interface/D:l3-interface) of this node(/B:interfaces/B:interface/D:l3-interface/D:ip), it already free something of the child. could you help check?\r\n\r\ndo I need change the order to TRANSAPI_CLBCKS_LEAF_TO_ROOT?\r\n\r\nThanks,\r\nJin"},"comment":{"url":"https://api.github.com/repos/CESNET/libnetconf/issues/comments/138256750","html_url":"https://github.com/CESNET/libnetconf/issues/97#issuecomment-138256750","issue_url":"https://api.github.com/repos/CESNET/libnetconf/issues/97","id":138256750,"user":{"login":"michalvasko","id":12510224,"avatar_url":"https://avatars.githubusercontent.com/u/12510224?v=3","gravatar_id":"","url":"https://api.github.com/users/michalvasko","html_url":"https://github.com/michalvasko","followers_url":"https://api.github.com/users/michalvasko/followers","following_url":"https://api.github.com/users/michalvasko/following{/other_user}","gists_url":"https://api.github.com/users/michalvasko/gists{/gist_id}","starred_url":"https://api.github.com/users/michalvasko/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michalvasko/subscriptions","organizations_url":"https://api.github.com/users/michalvasko/orgs","repos_url":"https://api.github.com/users/michalvasko/repos","events_url":"https://api.github.com/users/michalvasko/events{/privacy}","received_events_url":"https://api.github.com/users/michalvasko/received_events","type":"User","site_admin":false},"created_at":"2015-09-07T09:59:47Z","updated_at":"2015-09-07T09:59:47Z","body":"Hi Jin,\r\n\r\nyes, those invalid frees are the problem and the output may be enough for me to find the bug. However, I honestly cannot do anything when I'm guessing the lines (since you use some customized transapi.c). So I am afraid I cannot help you unless you use the stock libnetconf from our master branch.\r\n\r\nRegards,\r\nMichal"}}