[BUG]: Crash of RoutingManagerd version 3.4.10

[akhzarj]

vSomeip Version

v.3.4.10

Boost Version

1.78.0

Environment

Target: Test bench with automated test running
OS: Embedded Linux

Describe the bug

During the testing activities we observed several (around 6 times) crashes of routingmanagerd.

• routingmanagerd core dumped with SIGSEGV, Segmentation fault
• routingmanagerd core dumped with SIGABRT, Aborted

Details in provided back-traces.

Reproduction Steps

Several hundred (300-400) Loop test on the target by running various applications.

Expected behaviour

routingmanagerd should not crash.

Logs and Screenshots

No response

[akhzarj]

The coredump back-traces:
core.routingmanagerd.850.b00df2d309b24a858643df5f2ac79195.3013.11.1717956167.log
core.da00_io01.682.42f424ddae96409e80ba1b59908db2d4.3013.11.1718020067.log
core.0100_io01.735.d97c5634e6204b199f818e6a3e141a02.3013.6.1718011439.log

[lutzbichler]

I am very interested in reproducing this. Could you provide some more details about the "Reproduction Steps", especially which applications were used and how exactly the test loops look like?

[duartenfonseca]

@akhzarj can you give some indications on how we could reproduce it?

[akhzarj]

Hi @duartenfonseca , @lutzbichler
We already find out the root cause and it is related to dangling pointers in
implementation/endpoints/src/tcp_client_endpoint_impl.cpp
with the strand::dispatch() behavior dualism:
https://www.boost.org/doc/libs/1_80_0/doc/html/boost_asio/reference/strand/dispatch.html

When strand is busy then passed function will be scheduled and execute after return from dispatch() and it's caller function and then the passed references to local variables will become dangled.
To be able to do reproduction the appropriate strands needs to be stressed to become busy.

The fix is removing references in:

• vsomeip/implementation/endpoints/src/tcp_client_endpoint_impl.cpp

  Line 272 in 0b83e24

  strand_.dispatch([self, &its_recv_buffer](){

• vsomeip/implementation/endpoints/src/tcp_client_endpoint_impl.cpp

  Line 773 in 0b83e24

  strand_.dispatch([self, &_recv_buffer, _recv_buffer_size, its_missing_capacity](){

• vsomeip/implementation/endpoints/src/tcp_client_endpoint_impl.cpp

  Line 801 in 0b83e24

  strand_.dispatch([self, &_recv_buffer, _recv_buffer_size, its_missing_capacity](){

• vsomeip/implementation/endpoints/src/tcp_client_endpoint_impl.cpp

  Line 951 in 0b83e24

  [self, &its_entry]() { self->send_queued(its_entry);}

Notes:

• In the last one the fix in addition replaces lambda with std::bind() due to lambda immutability, alternative make lambda mutable.
• It is not checked against the latest version of vsomeip, but you can easily if any new/updated strand::dispatch()
  contain the same issue.

[fcmonteiro]

Hi @akhzarj,
So, If I remember correctly this is the same issue we discussed some time ago in the monthly meeting.
The fix is not yet in the master, but I asked @kheaactua to create a PR with the fix.
Can you have a look at #774, and update it. I seem it does not contain all changes.
Thanks! :)

[kheaactua]

hmm, it looks like I am missing:

vsomeip/implementation/endpoints/src/tcp_client_endpoint_impl.cpp

Line 801 in 0b83e24

strand_.dispatch([self, &_recv_buffer, _recv_buffer_size, its_missing_capacity](){

I'll add that now.

[akhzarj]

Hi @fcmonteiro
Yes you are remembering it correctly and PR #774 contains the fix that we have
with last update from @kheaactua .