{"action":"closed","issue":{"url":"https://api.github.com/repos/gparmer/Composite/issues/121","labels_url":"https://api.github.com/repos/gparmer/Composite/issues/121/labels{/name}","comments_url":"https://api.github.com/repos/gparmer/Composite/issues/121/comments","events_url":"https://api.github.com/repos/gparmer/Composite/issues/121/events","html_url":"https://github.com/gparmer/Composite/issues/121","id":59289798,"number":121,"title":"Bug in cbuf_alloc slow path","user":{"login":"gedare","id":1657385,"avatar_url":"https://avatars.githubusercontent.com/u/1657385?v=3","gravatar_id":"","url":"https://api.github.com/users/gedare","html_url":"https://github.com/gedare","followers_url":"https://api.github.com/users/gedare/followers","following_url":"https://api.github.com/users/gedare/following{/other_user}","gists_url":"https://api.github.com/users/gedare/gists{/gist_id}","starred_url":"https://api.github.com/users/gedare/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gedare/subscriptions","organizations_url":"https://api.github.com/users/gedare/orgs","repos_url":"https://api.github.com/users/gedare/repos","events_url":"https://api.github.com/users/gedare/events{/privacy}","received_events_url":"https://api.github.com/users/gedare/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":3,"created_at":"2015-02-27T20:28:33Z","updated_at":"2015-02-27T20:54:53Z","closed_at":"2015-02-27T20:54:53Z","body":"I am observing a bug in the following scenario:\r\n\r\n1. cbuf_alloc() calls__cbuf_alloc_slow() which calls __cbufp_alloc_slow()\r\n2. __cbufp_alloc_slow() does not collect any cbufs, so it calls cbuf_create().\r\n3. cbuf_create() makes a new cbuf but does not find the meta, so it returns cbid * -1. **The cbuf was added to the bin->c list.**\r\n4. __cbuf_alloc_slow() detects cbid < 0 and expands meta vector, calls __cbufp_alloc_slow() again and will overwrite the previously returned negative cbid with the return value.\r\n5. __cbufp_alloc_slow() has cbid < 0, and amnt == 0, so it again calls cbuf_create() discarding the negative cbid that was passed in as an argument. **The cbid that was returned from the previous cbuf_create is now lost.**\r\n6. cbuf_create()  makes a new cbuf and gets a meta this time\r\n7. cbuf_alloc() is happy.\r\n\r\nProblem: The first call to cbuf_create is not getting handled properly, and the cbid gets 'leaked'. I detected this bug because later on, in cbuf_collect(), there is a loop over bin->c, and a new check was added recently for (CBUF_IS_IN_FREELiST(cbi->owner.m)), that causes a NULL pointer dereference in case cbi->owner.m was not set, as in the above case of the leaked cbid.\r\n\r\nI'm pretty sure this bug existed before our recent changes to cbuf. It was just exposed now because of the added check about whether the cbuf is in the freelist."}}