Bug 732216

Summary: srcds_linux: realloc(): invalid pointer - glibc crash - when running counter-strike server
Product: [openSUSE] openSUSE 12.1 Reporter: Jason Tubnor <jason>
Component: BasesystemAssignee: E-mail List <bnc-team-screening>
Status: RESOLVED WONTFIX QA Contact: E-mail List <qa-bugs>
Severity: Normal    
Priority: P5 - None CC: aj
Version: Final   
Target Milestone: ---   
Hardware: 32bit   
OS: Other   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---
Attachments: Application core dump

Description Jason Tubnor 2011-11-23 05:22:52 UTC 
Created attachment 463566 [details]
Application core dump

User-Agent:       Mozilla/5.0 (Windows NT 5.1; rv:7.0.1) Gecko/20100101 Firefox/7.0.1

This issue exists in both openSUSE 12.1 i586 and x86_64 releases.  It is not an issue with openSUSE 11.4.

Upon running the srcds server the same way as I do on 11.4, I get a realloc() invalid pointer once the glibc is detected.  Below is the output and debug files (See Actual Results)



Reproducible: Always

Steps to Reproduce:
1.  Clean base server install (no KDE or GNOME)
2.  Will happen with either -desktop or -default kernel
3.  Install base installation from Steam (no mods)
Actual Results:  
openSUSE 12.1 i586:


./srcds_run -console -game cstrike +map de_dust2 +sv_lan 0 -maxplayers 11

Auto detecting CPU
Using default binary: ./srcds_linux
Enabling debug mode
Server will auto-restart if there is a crash.
Running a benchmark to measure system clock frequency...
Finished RDTSC test. To prevent the startup delay from this benchmark, set the environment variable RDTSC_FREQUENCY to 3214.000000 on this system. This value is dependent upon the CPU clock speed and architecture and should be determined separately for each server. The use of this mechanism for timing can be disabled by setting RDTSC_FREQUENCY to 'disabled'.
Using breakpad minidump system
Using breakpad crash handler

Console initialized.
Game.dll loaded for "Counter-Strike: Source"
Setting breakpad minidump AppID = 240
Forcing breakpad minidump interfaces to load
Looking up breakpad interfaces from steamclient
Calling BreakpadMiniDumpSystemInit
Installing breakpad exception handler for appid(240)/version(4743)
maxplayers set to 11
No '-replayserverdir' parameter found - using default replay folder.
Replay: Creating thread pool...succeeded.
Replay: Starting thread pool with 4 threads...succeeded.
Cleaning files from temp dir, "/opt/srcds/css/cstrike/replay/server/tmp/" ...no files removed.
Unknown command "r_decal_cullsize"
Network: IP unknown, mode MP, dedicated Yes, ports 27015 SV / 27005 CL
ConVarRef room_type doesn't point to an existing ConVar
Executing dedicated server config file
*** glibc detected *** ./srcds_linux: realloc(): invalid pointer: 0x082a58a0 ***
======= Backtrace: =========
/lib/libc.so.6(+0x6ed8b)[0xb7492d8b]
/lib/libc.so.6(+0x71d30)[0xb7495d30]
/lib/libc.so.6(realloc+0x27b)[0xb749751b]
/opt/srcds/css/cstrike/bin/server.so(+0x7810c2)[0xb3efe0c2]
/opt/srcds/css/cstrike/bin/server.so(+0x761251)[0xb3ede251]
/opt/srcds/css/cstrike/bin/server.so(+0x612b4a)[0xb3d8fb4a]
/opt/srcds/css/cstrike/bin/server.so(+0x763522)[0xb3ee0522]
/opt/srcds/css/cstrike/bin/server.so(+0x6148de)[0xb3d918de]
/opt/srcds/css/cstrike/bin/server.so(+0x6e856a)[0xb3e6556a]
/opt/srcds/css/bin/engine.so(+0x1bff08)[0xb6bf7f08]
/opt/srcds/css/bin/engine.so(+0x1b9f8a)[0xb6bf1f8a]
/opt/srcds/css/bin/engine.so(+0x116178)[0xb6b4e178]
/opt/srcds/css/bin/engine.so(+0x121fc3)[0xb6b59fc3]
/opt/srcds/css/bin/engine.so(+0x122081)[0xb6b5a081]
/opt/srcds/css/bin/engine.so(+0x1225b8)[0xb6b5a5b8]
/opt/srcds/css/bin/engine.so(+0x1d7600)[0xb6c0f600]
/opt/srcds/css/bin/engine.so(+0x1d362a)[0xb6c0b62a]
bin/dedicated.so(+0x54f0e)[0xb6fbbf0e]
bin/dedicated.so(+0x54c38)[0xb6fbbc38]
/opt/srcds/css/bin/engine.so(+0x1d3f26)[0xb6c0bf26]
/opt/srcds/css/bin/engine.so(+0x1ef1a8)[0xb6c271a8]
/opt/srcds/css/bin/engine.so(+0x1d4d2a)[0xb6c0cd2a]
bin/dedicated.so(+0x55106)[0xb6fbc106]
bin/dedicated.so(+0x58bc8)[0xb6fbfbc8]
bin/dedicated.so(+0x5a8ac)[0xb6fc18ac]
bin/dedicated.so(+0x58bc8)[0xb6fbfbc8]
bin/dedicated.so(+0x5556d)[0xb6fbc56d]
bin/dedicated.so(DedicatedMain+0x25)[0xb6fbd9e5]
./srcds_linux[0x80488ad]
/lib/libc.so.6(__libc_start_main+0xf3)[0xb743d003]
./srcds_linux[0x8048731]
======= Memory map: ========
08048000-08049000 r-xp 00000000 08:02 523344     /opt/srcds/css/srcds_linux
08049000-0804a000 rw-p 00000000 08:02 523344     /opt/srcds/css/srcds_linux
0804a000-08e41000 rw-p 00000000 00:00 0          [heap]
ae25f000-ae6fe000 rw-p 00000000 00:00 0
ae73a000-ae88e000 rw-p 00000000 00:00 0
ae8f7000-aeb50000 rw-p 00000000 00:00 0
aeb5d000-aec53000 rw-p 00000000 00:00 0
aec61000-aecd3000 rw-p 00000000 00:00 0
aecd7000-aecfb000 rw-p 00000000 00:00 0
aed1f000-aef01000 rw-p 00000000 00:00 0
aef14000-aefe0000 rw-p 00000000 00:00 0
aeff5000-af0d4000 rw-p 00000000 00:00 0
af0ef000-af1a2000 rw-p 00000000 00:00 0
af1a2000-af1a3000 ---p 00000000 00:00 0
af1a3000-af2a2000 rw-p 00000000 00:00 0
af2a2000-af2a3000 ---p 00000000 00:00 0
af2a3000-af3a2000 rw-p 00000000 00:00 0
af3a2000-af3a3000 ---p 00000000 00:00 0
af3a3000-af4a2000 rw-p 00000000 00:00 0
af4a2000-af4a3000 ---p 00000000 00:00 0
af4a3000-af7a3000 rw-p 00000000 00:00 0
af7a3000-af7aa000 r-xp 00000000 08:02 1700651    /lib/librt-2.14.1.so
af7aa000-af7ab000 r--p 00006000 08:02 1700651    /lib/librt-2.14.1.so
af7ab000-af7ac000 rw-p 00007000 08:02 1700651    /lib/librt-2.14.1.so
af7b1000-af888000 r-xp 00000000 08:02 523362     /opt/srcds/css/bin/replay.so
af888000-af88d000 rw-p 000d6000 08:02 523362     /opt/srcds/css/bin/replay.so
af88d000-af89b000 rw-p 00000000 00:00 0
af89b000-af89c000 ---p 00000000 00:00 0
af89c000-af9df000 rw-p 00000000 00:00 0
af9df000-afa6c000 r-xp 00000000 08:02 523348     /opt/srcds/css/bin/crashhandler.so
afa6c000-afa6f000 rw-p 0008c000 08:02 523348     /opt/srcds/css/bin/crashhandler.so
afa6f000-afa7a000 rw-p 00000000 00:00 0
afa7a000-afadc000 r-xp 00000000 08:02 523360     /opt/srcds/css/bin/libvstdlib_s.so
afadc000-afade000 rw-p 00062000 08:02 523360     /opt/srcds/css/bin/libvstdlib_s.so
afade000-afae1000 rw-p 00000000 00:00 0
afae1000-afb09000 r-xp 00000000 08:02 523358     /opt/srcds/css/bin/libtier0_s.so
afb09000-afb0a000 rw-p 00028000 08:02 523358     /opt/srcds/css/bin/libtier0_s.so
afb0a000-afb10000 rw-p 00000000 00:00 0
afb10000-b06e1000 r-xp 00000000 08:02 523366     /opt/srcds/css/bin/steamclient.so
b06e1000-b0747000 rw-p 00bd0000 08:02 523366     /opt/srcds/css/bin/steamclient.so
b0747000-b3763000 rw-p 00000000 00:00 0
b3763000-b377b000 r-xp 00000000 08:02 523363     /opt/srcds/css/bin/scenefilecache.so
b377b000-b377c000 rw-p 00017000 08:02 523363     /opt/srcds/css/bin/scenefilecache.so
b377c000-b377d000 rw-p 00000000 00:00 0
b377d000-b441b000 r-xp 00000000 08:02 523391     /opt/srcds/css/cstrike/bin/server.so
b441b000-b44fb000 rw-p 00c9e000 08:02 523391     /opt/srcds/css/cstrike/bin/server.so
b44fb000-b4d30000 rw-p 00000000 00:00 0
b4d30000-b4d46000 r-xp 00000000 08:02 523364     /opt/srcds/css/bin/shaderapiempty.so
b4d46000-b4d48000 rw-p 00016000 08:02 523364     /opt/srcds/css/bin/shaderapiempty.so
b4d48000-b4db2000 r-xp 00000000 08:02 523349     /opt/srcds/css/bin/datacache.so
b4db2000-b4dbc000 rw-p 0006a000 08:02 523349     /opt/srcds/css/bin/datacache.so
b4dbc000-b4dbf000 rw-p 00000000 00:00 0
b4dbf000-b4f82000 r-xp 00000000 08:02 523368     /opt/srcds/css/bin/vphysics.so
b4f82000-b4f83000 ---p 001c3000 08:02 523368     /opt/srcds/css/bin/vphysics.so
b4f83000-b4f88000 r--p 001c3000 08:02 523368     /opt/srcds/css/bin/vphysics.so
b4f88000-b4f8d000 rw-p 001c8000 08:02 523368     /opt/srcds/css/bin/vphysics.so
b4f8d000-b4f9d000 rw-p 00000000 00:00 0
b4f9d000-b5076000 r-xp 00000000 08:02 523367     /opt/srcds/css/bin/studiorender.so
b5076000-b5078000 rw-p 000d8000 08:02 523367     /opt/srcds/css/bin/studiorender.so
b5078000-b6430000 rw-p 00000000 00:00 0
b6430000-b656f000 r-xp 00000000 08:02 523361     /opt/srcds/css/bin/materialsystem.so
b656f000-b6579000 rw-p 0013f000 08:02 523361     /opt/srcds/css/bin/materialsystem.so
b6579000-b6596000 rw-p 00000000 00:00 0
b6596000-b65c8000 r-xp 00000000 08:02 523365     /opt/srcds/css/bin/soundemittersystem.so
b65c8000-b65c9000 rw-p 00032000 08:02 523365     /opt/srcds/css/bin/soundemittersystem.so
b65c9000-b6a38000 rw-p 00000000 00:00 0
b6a38000-b6cf6000 r-xp 00000000 08:02 523351     /opt/srcds/css/bin/engine.so
b6cf6000-b6d04000 rw-p 002be000 08:02 523351     /opt/srcds/css/bin/engine.so
b6d04000-b6d80000 rw-p 00000000 00:00 0
b6d80000-b6d81000 ---p 00000000 00:00 0
b6d81000-b6e80000 rw-p 00000000 00:00 0
b6e80000-b6e94000 r-xp 00000000 08:02 523352     /opt/srcds/css/bin/libgcc_s.so.1
b6e94000-b6e95000 rw-p 00013000 08:02 523352     /opt/srcds/css/bin/libgcc_s.so.1
b6e95000-b6f4c000 r-xp 00000000 08:02 523353     /opt/srcds/css/bin/libstdc++.so.6
b6f4c000-b6f4d000 ---p 000b7000 08:02 523353     /opt/srcds/css/bin/libstdc++.so.6
b6f4d000-b6f51000 r--p 000b7000 08:02 523353     /opt/srcds/css/bin/libstdc++.so.6
b6f51000-b6f52000 rw-p 000bb000 08:02 523353     /opt/srcds/css/bin/libstdc++.so.6
b6f52000-b6f59000 rw-p 00000000 00:00 0
b6f59000-b6f65000 r-xp 00000000 08:02 523355     /opt/srcds/css/bin/libsteam_api.so
b6f65000-b6f66000 rw-p 0000c000 08:02 523355     /opt/srcds/css/bin/libsteam_api.so
b6f66000-b6f67000 rw-p 00000000 00:00 0
b6f67000-b700f000 r-xp 00000000 08:02 523350     /opt/srcds/css/bin/dedicated.so
b700f000-b7013000 rw-p 000a8000 08:02 523350     /opt/srcds/css/bin/dedicated.so
b7013000-b7424000 rw-p 00000000 00:00 0
b7424000-b758a000 r-xp 00000000 08:02 1700623    /lib/libc-2.14.1.so
b758a000-b758c000 r--p 00165000 08:02 1700623    /lib/libc-2.14.1.so
b758c000-b758d000 rw-p 00167000 08:02 1700623    /lib/libc-2.14.1.so
b758d000-b7590000 rw-p 00000000 00:00 0
b7590000-b75a7000 r-xp 00000000 08:02 1700647    /lib/libpthread-2.14.1.so
b75a7000-b75a8000 r--p 00016000 08:02 1700647    /lib/libpthread-2.14.1.so
b75a8000-b75a9000 rw-p 00017000 08:02 1700647    /lib/libpthread-2.14.1.so
b75a9000-b75ac000 rw-p 00000000 00:00 0
b75ac000-b75af000 r-xp 00000000 08:02 1700629    /lib/libdl-2.14.1.so
b75af000-b75b0000 r--p 00002000 08:02 1700629    /lib/libdl-2.14.1.so
b75b0000-b75b1000 rw-p 00003000 08:02 1700629    /lib/libdl-2.14.1.so
b75b1000-b75da000 r-xp 00000000 08:02 1700631    /lib/libm-2.14.1.so
b75da000-b75db000 r--p 00028000 08:02 1700631    /lib/libm-2.14.1.so
b75db000-b75dc000 rw-p 00029000 08:02 1700631    /lib/libm-2.14.1.so
b75e0000-b75e1000 rw-p 00000000 00:00 0
b75e1000-b7617000 r-xp 00000000 08:02 523359     /opt/srcds/css/bin/libvstdlib.so
b7617000-b7619000 rw-p 00035000 08:02 523359     /opt/srcds/css/bin/libvstdlib.so
b7619000-b7694000 rw-p 00000000 00:00 0
b7694000-b76ce000 r-xp 00000000 08:02 523357     /opt/srcds/css/bin/libtier0.so
b76ce000-b76d0000 rw-p 0003a000 08:02 523357     /opt/srcds/css/bin/libtier0.so
b76d0000-b76e8000 rw-p 00000000 00:00 0
b76e8000-b7707000 r-xp 00000000 08:02 1700616    /lib/ld-2.14.1.so
b7707000-b7708000 r--p 0001f000 08:02 1700616    /lib/ld-2.14.1.so
b7708000-b7709000 rw-p 00020000 08:02 1700616    /lib/ld-2.14.1.so
bfe3e000-bfe67000 rw-p 00000000 00:00 0          [stack]
ffffe000-fffff000 r-xp 00000000 00:00 0          [vdso]
PreMinidumpCallback: updating dump comment
Uploading dump (in-process) [proxy '']
/tmp/dumps/crash_20111123154759_1.dmp
success = yes
response:  CrashID=bp-1a3f2119-1f01-4642-8764-674972111122

PreMinidumpCallback: updating dump comment
./srcds_run: line 372:  2141 Segmentation fault      (core dumped) $HL_CMD
Missing separate debuginfo for /opt/srcds/css/srcds_linux
BFD: Warning: /opt/srcds/css/core is truncated: expected core file size >= 157544448, found: 1032192.
Cannot access memory at address 0xb77088d8
Failed to read a valid object file image from memory.
Cannot access memory at address 0xaf978db4
Cannot access memory at address 0xb77088d8
debug.cmds:5: Error in sourced command file:
No function contains program counter for selected frame.
email debug.log to linux@valvesoftware.com
Wed Nov 23 15:48:01 EST 2011: Server restart in 10 seconds

-----------------

cat debug.log

----------------------------------------------
CRASH: Wed Nov 23 15:48:01 EST 2011
Start Line: ./srcds_linux -console -game cstrike +map de_dust2 +sv_lan 0 -maxpla
yers 11 -debug
[New LWP 2143]
[New LWP 2141]
[New LWP 2146]
[New LWP 2142]
[New LWP 2147]
[New LWP 2144]
[New LWP 2145]
Core was generated by `./srcds_linux -console -game cstrike +map de_dust2 +sv_la
n 0 -maxplayers 11 -de'.
Program terminated with signal 11, Segmentation fault.
#0  0xb74693f2 in ?? ()
#0  0xb74693f2 in ?? ()
No symbol table info available.
eax            0x0      0
ecx            0x0      0
edx            0xaf979448       -1349020600
ebx            0xb758bff4       -1218920460
esp            0xaf978db4       0xaf978db4
ebp            0xaf978ed8       0xaf978ed8
esi            0xffffffb8       -72
edi            0xaf990070       -1348927376
eip            0xb74693f2       0xb74693f2
eflags         0x10246  [ PF ZF IF RF ]
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
No shared libraries loaded at this time.
End of Source crash report
----------------------------------------------

--------------------------------------------------------------------



Expected Results:  
How the server runs in 11.4:

./srcds_run -console -game cstrike +map de_dust2 +sv_lan 0 -maxplayers 11

Auto detecting CPU
Using default binary: ./srcds_linux
Server will auto-restart if there is a crash.
Running a benchmark to measure system clock frequency...
Finished RDTSC test. To prevent the startup delay from this benchmark, set the environment variable RDTSC_FREQUENCY to 3214.000000 on this system. This value is dependent upon the CPU clock speed and architecture and should be determined separately for each server. The use of this mechanism for timing can be disabled by setting RDTSC_FREQUENCY to 'disabled'.
Using breakpad minidump system
Using breakpad crash handler

Console initialized.
Game.dll loaded for "Counter-Strike: Source"
Setting breakpad minidump AppID = 240
Forcing breakpad minidump interfaces to load
Looking up breakpad interfaces from steamclient
Calling BreakpadMiniDumpSystemInit
Installing breakpad exception handler for appid(240)/version(4743)
maxplayers set to 11
No '-replayserverdir' parameter found - using default replay folder.
Replay: Creating thread pool...succeeded.
Replay: Starting thread pool with 4 threads...succeeded.
Cleaning files from temp dir, "/opt/srcds/css/cstrike/replay/server/tmp/" ...no files removed.
Unknown command "r_decal_cullsize"
Network: IP aaa.bbb.ccc.ddd, mode MP, dedicated Yes, ports 27015 SV / 27005 CL
ConVarRef room_type doesn't point to an existing ConVar
Executing dedicated server config file
Initializing Steam libraries for secure Internet server
Failed to load Steam Service
ServiceStart: failed to start
Looking up breakpad interfaces from steamclient
Calling BreakpadMiniDumpSystemInit
Game will not start until both teams have players.
Game will not start until both teams have players.
Dropped Kevin from server (Kicked by Console)
Comment 1 Andreas Jaeger 2011-11-29 11:05:50 UTC 
This is a bug in srcds.

WE just released an online update for aaa_base that will disable the malloc check in glibc that triggered this. So, install it as a workaround.

But I suggest to tell the srcds team about the problem - they should be able to reproduce it with setting:
export MALLOC_CHECK_=3
export MALLOC_PERTURB_=69


And disabling the above might workaround the problem.

I'm marking the bug as RESOLVED WONTFIX since srcds_linux is not part of openSUSE.