Bug: pure virtual method called in QueryInterface when deactivating DisplaySettings

[npoltorapavlo]

Problem/Opportunity

During shutdown, DisplaySettings::Deinitialize calls QueryInterface to get another plugin's interface, Exchange::ISystemMode. At the same time that plugin deactivates and the interface destroys (destructor is called in another thread). Looks like a concurrency issue between QueryInterface and plugin deactivation.

QueryInterface calls AddRef that was in a composite class interface is part of:

Thread 7 "WorkerPool::Thr" received signal SIGABRT, Aborted.
[Switching to Thread 11969.12074]
__libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
warning: 47	../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S: No such file or directory
(gdb) bt
#0  __libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:47
#1  0xb3b1e300 in __pthread_kill_implementation (threadid=<optimized out>, signo=6, no_tid=<optimized out>) at pthread_kill.c:43
#2  0xb3aefbb6 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0xb3ae15d4 in __GI_abort () at abort.c:79
#4  0xb3c92fac in __gnu_cxx::__verbose_terminate_handler () at ../../../../../../../../work-shared/gcc-11.3.0-r0/gcc-11.3.0/libstdc++-v3/libsupc++/vterminate.cc:95
#5  0xb3c91bdc in __cxxabiv1::__terminate (handler=<optimized out>)
    at ../../../../../../../../work-shared/gcc-11.3.0-r0/gcc-11.3.0/libstdc++-v3/libsupc++/eh_terminate.cc:48
#6  0xb3c91c3e in std::terminate () at ../../../../../../../../work-shared/gcc-11.3.0-r0/gcc-11.3.0/libstdc++-v3/libsupc++/eh_terminate.cc:58
#7  0xb3c9254a in __cxxabiv1::__cxa_pure_virtual () at ../../../../../../../../work-shared/gcc-11.3.0-r0/gcc-11.3.0/libstdc++-v3/libsupc++/pure.cc:50
#8  0xac18aab0 in WPEFramework::Plugin::SystemModeImplementation::QueryInterface (interfaceNumber=4192, this=0x1df0d60)
    at /usr/src/debug/rdkservices/3.0+gitAUTOINC+93fce14482-r1/git/SystemMode/SystemModeImplementation.h:53
#9  WPEFramework::Plugin::SystemModeImplementation::QueryInterface (this=0x1df0d60, interfaceNumber=<optimized out>)
    at /usr/src/debug/rdkservices/3.0+gitAUTOINC+93fce14482-r1/git/SystemMode/SystemModeImplementation.h:52
#10 0x0005c712 in WPEFramework::PluginHost::Server::Service::QueryInterface (id=4192, this=0x1d96bd0)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.cpp:306
#11 WPEFramework::PluginHost::Server::Service::QueryInterface (this=0x1d96bd0, id=4192)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.cpp:281
#12 0x0006918a in WPEFramework::PluginHost::Server::ServiceMap::QueryInterfaceByCallsign (this=<optimized out>, id=4192, name=...)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.h:3081
#13 0xaaa2940c in WPEFramework::Plugin::DisplaySettings::Deinitialize (this=0xa99091a0, service=0x1d3aafc) at /usr/include/c++/11.3.0/ext/new_allocator.h:79
#14 0x0005efcc in WPEFramework::PluginHost::Server::Service::Deactivate (this=0x1d3aaf8, why=<optimized out>)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.cpp:563
#15 0x0003e324 in WPEFramework::Plugin::Controller::PutMethod (this=this@entry=0x1e386a8, index=..., request=...)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/Controller.cpp:562
#16 0x0003f40e in WPEFramework::Plugin::Controller::Process (this=0x1e386a8, request=...)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/Controller.cpp:220
#17 0x00064d20 in WPEFramework::PluginHost::Server::Service::Process (this=0x1dbe620, request=...)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.h:1430
#18 0x0007140e in WPEFramework::PluginHost::Server::Channel::Job::Process (message=..., this=0xb0aabce8)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/Proxy.h:541
#19 WPEFramework::PluginHost::Server::Channel::WebRequestJob::Dispatch (this=0xb0aabce8)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.h:3684
#20 0x00065c08 in WPEFramework::Core::ThreadPool::Minion::Process (this=this@entry=0x1ce8228)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/ThreadPool.h:452
#21 0x00065d66 in WPEFramework::Core::ThreadPool::Executor::Worker (this=0x1ce8138) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/ThreadPool.h:540
--Type <RET> for more, q to quit, c to continue without paging--c
#22 0xb3d6937c in WPEFramework::Core::Thread::StartThread (cClassPointer=0x1ce8138) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/Thread.cpp:194
#23 0xb3b1cc86 in start_thread (arg=0xceda5145) at pthread_create.c:442
#24 0xb3b6d3c0 in ?? () at ../sysdeps/unix/sysv/linux/arm/clone.S:74 from /home/npoltorapavlo/Downloads/gdb/lib/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

As interface destructor is called, composite has been destroyed already, so pure virtual method called:

Thread 5 (Thread 11969.12072 "WorkerPool::Thr"):
#0  __libc_do_syscall () at ../sysdeps/unix/sysv/linux/arm/libc-do-syscall.S:46
#1  0xb3b4245c in __GI___clock_nanosleep_time64 (clock_id=clock_id@entry=0, flags=flags@entry=0, req=req@entry=0xb01fd428, rem=0xb01fd438) at ../sysdeps/unix/sysv/linux/clock_nanosleep.c:62
#2  0xb3b45c96 in __GI___nanosleep64 (rem=<optimized out>, req=0xb01fd428) at ../sysdeps/unix/sysv/linux/nanosleep.c:25
#3  __GI___nanosleep (req=<optimized out>, rem=0xb01fd450) at ../sysdeps/unix/sysv/linux/nanosleep.c:42
#4  0xb3d63222 in SleepMs (time=time@entry=100) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/Portability.cpp:272
#5  0xb3d66f62 in WPEFramework::Core::SocketPort::WaitForClosure (this=this@entry=0x1e09d1c, time=time@entry=20000) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/SocketPort.cpp:967
#6  0xb3d6767c in WPEFramework::Core::SocketPort::Close (this=0x1e09d1c, waitTime=waitTime@entry=20000) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/SocketPort.cpp:617
#7  0xb3e06522 in WPEFramework::Core::IPCChannelClientType<WPEFramework::Core::Void, false, true>::Close (waitTime=waitTime@entry=20000, this=<optimized out>) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/IPCChannel.h:101
#8  0xac1889ba in WPEFramework::Plugin::SystemModeImplementation::~SystemModeImplementation (this=this@entry=0x1df0d60, __in_chrg=__in_chrg@entry=0, __vtt_parm=0xac19f7ac <VTT for WPEFramework::Core::ProxyObject<WPEFramework::Core::ServiceMetadata<WPEFramework::Plugin::SystemModeImplementation>::ServiceImplementation<WPEFramework::Plugin::SystemModeImplementation> >+12>) at /usr/include/WPEFramework/core/Proxy.h:541
#9  0xac188a82 in WPEFramework::Plugin::SystemModeImplementation::~SystemModeImplementation (this=this@entry=0x1df0d60, __vtt_parm=<optimized out>) at /usr/src/debug/rdkservices/3.0+gitAUTOINC+93fce14482-r1/git/SystemMode/SystemModeImplementation.cpp:156
#10 0xac18ca60 in WPEFramework::Core::Service<WPEFramework::Plugin::SystemModeImplementation>::~Service (this=this@entry=0x1df0d60, __in_chrg=__in_chrg@entry=0, __vtt_parm=0xac19f7a8 <VTT for WPEFramework::Core::ProxyObject<WPEFramework::Core::ServiceMetadata<WPEFramework::Plugin::SystemModeImplementation>::ServiceImplementation<WPEFramework::Plugin::SystemModeImplementation> >+8>) at /usr/include/WPEFramework/core/Services.h:124
#11 0xac18ca94 in WPEFramework::Core::Service<WPEFramework::Plugin::SystemModeImplementation>::~Service (this=this@entry=0x1df0d60, __vtt_parm=<optimized out>) at /usr/include/WPEFramework/core/Services.h:181
#12 0xac18cab6 in WPEFramework::Core::ServiceMetadata<WPEFramework::Plugin::SystemModeImplementation>::ServiceImplementation<WPEFramework::Plugin::SystemModeImplementation>::~ServiceImplementation (this=this@entry=0x1df0d60, __in_chrg=__in_chrg@entry=0, __vtt_parm=<optimized out>) at /usr/include/WPEFramework/core/Services.h:41
#13 0xac18cae8 in WPEFramework::Core::ServiceMetadata<WPEFramework::Plugin::SystemModeImplementation>::ServiceImplementation<WPEFramework::Plugin::SystemModeImplementation>::~ServiceImplementation (this=this@entry=0x1df0d60, __vtt_parm=<optimized out>) at /usr/include/WPEFramework/core/Services.h:260
#14 0xac18cb5e in WPEFramework::Core::ProxyObject<WPEFramework::Core::ServiceMetadata<WPEFramework::Plugin::SystemModeImplementation>::ServiceImplementation<WPEFramework::Plugin::SystemModeImplementation> >::~ProxyObject (__vtt_parm=0x0, __in_chrg=2, this=this@entry=0x1df0d60) at /usr/include/WPEFramework/core/Proxy.h:247
#15 WPEFramework::Core::ProxyObject<WPEFramework::Core::ServiceMetadata<WPEFramework::Plugin::SystemModeImplementation>::ServiceImplementation<WPEFramework::Plugin::SystemModeImplementation> >::~ProxyObject (this=this@entry=0x1df0d60) at /usr/include/WPEFramework/core/Proxy.h:119
#16 0xac18cb90 in WPEFramework::Core::ProxyObject<WPEFramework::Core::ServiceMetadata<WPEFramework::Plugin::SystemModeImplementation>::ServiceImplementation<WPEFramework::Plugin::SystemModeImplementation> >::~ProxyObject (this=this@entry=0x1df0d60) at /usr/include/WPEFramework/core/Proxy.h:119
#17 0xac18cbce in WPEFramework::Core::ProxyObject<WPEFramework::Core::ServiceMetadata<WPEFramework::Plugin::SystemModeImplementation>::ServiceImplementation<WPEFramework::Plugin::SystemModeImplementation> >::Release (this=0x1df0d60) at /usr/include/WPEFramework/core/Proxy.h:136
#18 0xac1b99b8 in WPEFramework::Plugin::SystemMode::Deinitialize (this=0x1e08398, service=0x1d96bd4) at /usr/src/debug/rdkservices/3.0+gitAUTOINC+93fce14482-r1/git/SystemMode/SystemMode.cpp:106
#19 0x0005efcc in WPEFramework::PluginHost::Server::Service::Deactivate (this=0x1d96bd0, why=<optimized out>) at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.cpp:563
#20 0x0003e324 in WPEFramework::Plugin::Controller::PutMethod (this=this@entry=0x1e386a8, index=..., request=...) at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/Controller.cpp:562
#21 0x0003f40e in WPEFramework::Plugin::Controller::Process (this=0x1e386a8, request=...) at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/Controller.cpp:220
#22 0x00064d20 in WPEFramework::PluginHost::Server::Service::Process (this=0x1dbe620, request=...) at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.h:1430
#23 0x0007140e in WPEFramework::PluginHost::Server::Channel::Job::Process (message=..., this=0xb0aa36d8) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/Proxy.h:541
#24 WPEFramework::PluginHost::Server::Channel::WebRequestJob::Dispatch (this=0xb0aa36d8) at /usr/src/debug/wpeframework/4.4-r0/git/Source/WPEFramework/PluginServer.h:3684
#25 0x00065c08 in WPEFramework::Core::ThreadPool::Minion::Process (this=this@entry=0x1ce7dd8) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/ThreadPool.h:452
#26 0x00065d66 in WPEFramework::Core::ThreadPool::Executor::Worker (this=0x1ce7ce8) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/ThreadPool.h:540
#27 0xb3d6937c in WPEFramework::Core::Thread::StartThread (cClassPointer=0x1ce7ce8) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/Thread.cpp:194
#28 0xb3b1cc86 in start_thread (arg=0xceda5145) at pthread_create.c:442
#29 0xb3b6d3c0 in ?? () at ../sysdeps/unix/sysv/linux/arm/clone.S:74 from /home/npoltorapavlo/Downloads/gdb/lib/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

Steps to reproduce

No response

Expected Behavior

No crash

Actual Behavior

Crash

Notes (Optional)

No response

[npoltorapavlo]

Crash fixed by rdkcentral/Thunder#1977

But that being said be aware that it of course means you will either get a nullptr or a valid (refcounted) pointer to the Service being "QueryInterfaceByCallsigned" to but that Service Deinitialize will run (and in case of an OOP plugin the Plugin will really stop and the proxy your interface points to will point to a closed connection (again no crash, the reference counting does its work).
it will not hang and return with an error (if the method has a Core::hresult as return type, Thunder 5). So in principle there is no direct issue, no crash, but the call may not have executed as it could not reach its destination.