{"action":"created","issue":{"url":"https://api.github.com/repos/charybdis-ircd/charybdis/issues/215","repository_url":"https://api.github.com/repos/charybdis-ircd/charybdis","labels_url":"https://api.github.com/repos/charybdis-ircd/charybdis/issues/215/labels{/name}","comments_url":"https://api.github.com/repos/charybdis-ircd/charybdis/issues/215/comments","events_url":"https://api.github.com/repos/charybdis-ircd/charybdis/issues/215/events","html_url":"https://github.com/charybdis-ircd/charybdis/issues/215","id":175264431,"number":215,"title":"GNUTLS segmentation fault with connection timeouts","user":{"login":"anarcat","id":796623,"avatar_url":"https://avatars.githubusercontent.com/u/796623?v=3","gravatar_id":"","url":"https://api.github.com/users/anarcat","html_url":"https://github.com/anarcat","followers_url":"https://api.github.com/users/anarcat/followers","following_url":"https://api.github.com/users/anarcat/following{/other_user}","gists_url":"https://api.github.com/users/anarcat/gists{/gist_id}","starred_url":"https://api.github.com/users/anarcat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/anarcat/subscriptions","organizations_url":"https://api.github.com/users/anarcat/orgs","repos_url":"https://api.github.com/users/anarcat/repos","events_url":"https://api.github.com/users/anarcat/events{/privacy}","received_events_url":"https://api.github.com/users/anarcat/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/charybdis-ircd/charybdis/labels/bug","name":"bug","color":"fc2929"},{"url":"https://api.github.com/repos/charybdis-ircd/charybdis/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"aaronmdjones","id":3105118,"avatar_url":"https://avatars.githubusercontent.com/u/3105118?v=3","gravatar_id":"","url":"https://api.github.com/users/aaronmdjones","html_url":"https://github.com/aaronmdjones","followers_url":"https://api.github.com/users/aaronmdjones/followers","following_url":"https://api.github.com/users/aaronmdjones/following{/other_user}","gists_url":"https://api.github.com/users/aaronmdjones/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronmdjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronmdjones/subscriptions","organizations_url":"https://api.github.com/users/aaronmdjones/orgs","repos_url":"https://api.github.com/users/aaronmdjones/repos","events_url":"https://api.github.com/users/aaronmdjones/events{/privacy}","received_events_url":"https://api.github.com/users/aaronmdjones/received_events","type":"User","site_admin":false},"assignees":[{"login":"aaronmdjones","id":3105118,"avatar_url":"https://avatars.githubusercontent.com/u/3105118?v=3","gravatar_id":"","url":"https://api.github.com/users/aaronmdjones","html_url":"https://github.com/aaronmdjones","followers_url":"https://api.github.com/users/aaronmdjones/followers","following_url":"https://api.github.com/users/aaronmdjones/following{/other_user}","gists_url":"https://api.github.com/users/aaronmdjones/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronmdjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronmdjones/subscriptions","organizations_url":"https://api.github.com/users/aaronmdjones/orgs","repos_url":"https://api.github.com/users/aaronmdjones/repos","events_url":"https://api.github.com/users/aaronmdjones/events{/privacy}","received_events_url":"https://api.github.com/users/aaronmdjones/received_events","type":"User","site_admin":false}],"milestone":null,"comments":20,"created_at":"2016-09-06T14:38:40Z","updated_at":"2016-09-11T20:19:17Z","closed_at":null,"body":"I have this strange crash here which I can reproduce only when using a `qwebirc` webchat frontend. From the user's point of view, the connexion fails with:\r\n\r\n    [10:31] == Disconnected from server: Connection to IRC server failed.\r\n\r\nFrom the server side, it's much more fun though:\r\n\r\n```\r\nProgram received signal SIGSEGV, Segmentation fault.\r\n0x00007f742bbcf720 in rb_ssl_timeout (F=0x7f742c00e128, notused=<optimized out>) at gnutls.c:85\r\n85      gnutls.c: Aucun fichier ou dossier de ce type.\r\n(gdb) bt\r\n#0  0x00007f742bbcf720 in rb_ssl_timeout (F=0x7f742c00e128, notused=<optimized out>) at gnutls.c:85\r\n#1  0x00007f742bbcce2a in rb_checktimeouts (notused=0x7f742c00e128) at commio.c:328\r\n#2  0x00007f742bbd0a80 in rb_run_event (ev=ev@entry=0x17e6620) at event.c:191\r\n#3  0x00007f742bbd459b in rb_read_timerfd (F=0x7f742c00e3d0, data=0x17e6620) at epoll.c:458\r\n#4  0x00007f742bbd491a in rb_select_epoll (delay=<optimized out>) at epoll.c:199\r\n#5  0x00007f742bbce9bc in rb_select (timeout=timeout@entry=18446744073709551615) at commio.c:2104\r\n#6  0x00007f742bbd139c in rb_lib_loop (delay=delay@entry=0) at ratbox_lib.c:228\r\n#7  0x0000000000401baf in main (argc=<optimized out>, argv=<optimized out>) at ssld.c:1219\r\n(gdb) bt full\r\n#0  0x00007f742bbcf720 in rb_ssl_timeout (F=0x7f742c00e128, notused=<optimized out>) at gnutls.c:85\r\n        __PRETTY_FUNCTION__ = \"rb_ssl_timeout\"\r\n#1  0x00007f742bbcce2a in rb_checktimeouts (notused=0x7f742c00e128) at commio.c:328\r\n        td = 0x17ea200\r\n        F = 0x7f742c00e128\r\n        hdl = 0x7f742bbcf710 <rb_ssl_timeout>\r\n        data = 0x0\r\n#2  0x00007f742bbd0a80 in rb_run_event (ev=ev@entry=0x17e6620) at event.c:191\r\nNo locals.\r\n#3  0x00007f742bbd459b in rb_read_timerfd (F=0x7f742c00e3d0, data=0x17e6620) at epoll.c:458\r\n        data = 0x17e6620\r\n        F = 0x7f742c00e3d0\r\n        event = 0x17e6620\r\n        retlen = <optimized out>\r\n        count = 1\r\n#4  0x00007f742bbd491a in rb_select_epoll (delay=<optimized out>) at epoll.c:199\r\n        hdl = <optimized out>\r\n        F = 0x7f742c00e3d0\r\n        num = <optimized out>\r\n        flags = <optimized out>\r\n        old_flags = 1\r\n        op = <optimized out>\r\n        ep_event = {events = 24777344, data = {ptr = 0x0, fd = 0, u32 = 0, u64 = 0}}\r\n        o_errno = <optimized out>\r\n        data = <optimized out>\r\n#5  0x00007f742bbce9bc in rb_select (timeout=timeout@entry=18446744073709551615) at commio.c:2104\r\n        ret = <optimized out>\r\n#6  0x00007f742bbd139c in rb_lib_loop (delay=delay@entry=0) at ratbox_lib.c:228\r\n        next = <optimized out>\r\n#7  0x0000000000401baf in main (argc=<optimized out>, argv=<optimized out>) at ssld.c:1219\r\n        s_ctlfd = <optimized out>\r\n        s_pipe = <optimized out>\r\n        s_pid = <optimized out>\r\n        x = <optimized out>\r\n```\r\n\r\nIt looks like a NULL pointer is passed as `F->accept` to the `rb_ssl_timeout` callback. it is unclear why or when that is called - it looks like it's being called during the client setup. i have indeed found the handler is called with a NULL pointer here:\r\n\r\n```\r\nBreakpoint 1, rb_settimeout (F=F@entry=0x7ffff7fe5e90, timeout=timeout@entry=0, callback=callback@entry=0x0, cbdata=cbdata@entry=0x0) at commio.c:265\r\n265     in commio.c\r\n(gdb) bt\r\n#0  rb_settimeout (F=F@entry=0x7ffff7fe5e90, timeout=timeout@entry=0, callback=callback@entry=0x0, cbdata=cbdata@entry=0x0) at commio.c:265\r\n#1  0x00007ffff7bab17b in rb_close (F=0x7ffff7fe5e90) at commio.c:873\r\n#2  0x0000000000416331 in close_connection (client_p=0x7ffff7fe5e90) at client.c:1959\r\n#3  0x0000000000416edd in exit_local_server (comment=<optimized out>, from=<optimized out>, source_p=<optimized out>, client_p=<optimized out>)\r\n    at client.c:1442\r\n#4  exit_client (client_p=0x7ffff7fe5e90, source_p=0x0, from=0x0, comment=0x0) at client.c:1588\r\n#5  0x000000000041743d in exit_aborted_clients (unused=0x7ffff7fe5e90) at client.c:1188\r\n#6  0x00007ffff7bad6d0 in rb_run_event (ev=ev@entry=0xd470a0) at event.c:201\r\n#7  0x00007ffff7bb157b in rb_read_timerfd (F=0x7ffff7fe7788, data=0xd470a0) at epoll.c:458\r\n#8  0x00007ffff7bb18fa in rb_select_epoll (delay=<optimized out>) at epoll.c:199\r\n#9  0x00007ffff7bab38c in rb_select (timeout=timeout@entry=18446744073709551615) at commio.c:2105\r\n#10 0x00007ffff7badf9c in rb_lib_loop (delay=0) at ratbox_lib.c:229\r\n#11 0x000000000040be84 in main (argc=0, argv=0x7fffffffe6e8) at ircd.c:732\r\n(gdb) p F->accept\r\n$8 = (struct acceptdata *) 0x0\r\n```\r\n\r\nbut it could be that it's supposed to be configured after the handler is setup? that seems fishy. in fact, using a `rb_settimeout` breakpoint, *all* the handler setups would have a NULL pointer there.\r\n\r\ni wonder if a naive fix like this would be enough:\r\n\r\n```\r\ndiff --git a/libratbox/src/gnutls.c b/libratbox/src/gnutls.c\r\nindex 05fe812..9198ff5 100644\r\n--- a/libratbox/src/gnutls.c\r\n+++ b/libratbox/src/gnutls.c\r\n@@ -87,8 +87,10 @@ rb_ssl_clear_handshake_count(rb_fde_t *F)\r\n static void\r\n rb_ssl_timeout(rb_fde_t *F, void *notused)\r\n {\r\n-\tlrb_assert(F->accept != NULL);\r\n-\tF->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);\r\n+\tif (F->accept != NULL)\r\n+\t{\r\n+\t\tF->accept->callback(F, RB_ERR_TIMEOUT, NULL, 0, F->accept->data);\r\n+\t}\r\n }\r\n \r\n \r\n```\r\n\r\nany feedback would be appreciated.\r\n\r\nThis is Charybdis 3.5.3 or 3.4.2 on Debian jessie. This server was working fine when it was running 3.3.0."},"comment":{"url":"https://api.github.com/repos/charybdis-ircd/charybdis/issues/comments/246201959","html_url":"https://github.com/charybdis-ircd/charybdis/issues/215#issuecomment-246201959","issue_url":"https://api.github.com/repos/charybdis-ircd/charybdis/issues/215","id":246201959,"user":{"login":"aaronmdjones","id":3105118,"avatar_url":"https://avatars.githubusercontent.com/u/3105118?v=3","gravatar_id":"","url":"https://api.github.com/users/aaronmdjones","html_url":"https://github.com/aaronmdjones","followers_url":"https://api.github.com/users/aaronmdjones/followers","following_url":"https://api.github.com/users/aaronmdjones/following{/other_user}","gists_url":"https://api.github.com/users/aaronmdjones/gists{/gist_id}","starred_url":"https://api.github.com/users/aaronmdjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aaronmdjones/subscriptions","organizations_url":"https://api.github.com/users/aaronmdjones/orgs","repos_url":"https://api.github.com/users/aaronmdjones/repos","events_url":"https://api.github.com/users/aaronmdjones/events{/privacy}","received_events_url":"https://api.github.com/users/aaronmdjones/received_events","type":"User","site_admin":false},"created_at":"2016-09-11T20:19:17Z","updated_at":"2016-09-11T20:19:17Z","body":"Well if you already pulled in one whole file ... ;)"}}
{"actor":{"display_login":"aaronmdjones"}}