Bug: Seg fault in ResourceMonitorType::Worker() when deactivating RDK services caused by leaking JSONRPC::LinkType-s

[npoltorapavlo]

Problem/Opportunity

When deactivating services there's a crash, caused by leaking JSONRPC::LinkType.

ResourceMonitor holds pointers to IResource-s such as sockets. When JSONRPC::LinkType is leaked, corresponding socket (WPEFramework::Web::WebSocketLinkType<WPEFramework::Core::SocketStream, WPEFramework::Web::Response, WPEFramework::Web::Request, WPEFramework::Web::WebSocket::ResponseAllocator&>::HandlerType<WPEFramework::Core::SocketStream>) isn't closed or unregistered from ResourceMonitor. When unloading a library that contains template classes need to ensure that any instantiated template classes or objects created from them are properly destroyed before the library is unloaded.

Signature:
Any Seg fault in ResourceMonitorType::Worker():

Thread 3 "Monitor::IResou" received signal SIGSEGV, Segmentation fault.
[Switching to Thread 12024.12032]
Downloading source file /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/ResourceMonitor.h
0x00071c52 in WPEFramework::Core::ResourceMonitorType<WPEFramework::Core::IResource, WPEFramework::Core::Void>::Worker (this=0x3a0d58)                                 
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/ResourceMonitor.h:424
warning: 424	/usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/ResourceMonitor.h: No such file or directory
(gdb) bt
#0  0x00071c52 in WPEFramework::Core::ResourceMonitorType<WPEFramework::Core::IResource, WPEFramework::Core::Void>::Worker (this=0x3a0d58)
    at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/../core/ResourceMonitor.h:424
#1  0xb3d2937c in WPEFramework::Core::Thread::StartThread (cClassPointer=0x3a0918) at /usr/src/debug/wpeframework/4.4-r0/git/Source/core/Thread.cpp:194
#2  0xb3adcc86 in start_thread (arg=0x5d37d15d) at pthread_create.c:442
#3  0xb3b2d3c0 in ?? () at ../sysdeps/unix/sysv/linux/arm/clone.S:74 from /home/npoltorapavlo/Downloads/gdb/lib/libc.so.6
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

It crashes calling function on "entry" object in ResourceMonitor.h. Gdb shows _vptr.IResource address is not mapped.

(gdb) p *entry
$12 = {_vptr.IResource = 0xaad9f7fc}

I debugged one seg fault, in process mappings before crash address was in:

0xaad9c000 0xaada1000     0x5000    0x3c000  r--p   /usr/lib/wpeframework/plugins/libWPEFrameworkXCast.so

on crash, address wasn't mapped - plugin deactivated/destroyed/unloaded.
Cast entry to WebSocketLinkType::HandlerType :

(gdb) p *(WPEFramework::Web::WebSocketLinkType<WPEFramework::Core::SocketStream, WPEFramework::Web::Response, WPEFramework::Web::Request, WPEFramework::Web::WebSocket::ResponseAllocator&>::HandlerType<WPEFramework::Core::SocketStream> *)entry
m_Socket = 23
m_State = 209
m_ReceiveBuffer = 0xaa5b9110 "\201y{\"jsonrpc\":\"2.0\",\"method\":\"temporary1.statechange\"...
_parent = @0xaa5b80a8

shows socket not destroyed, state not 0, active Controller "statechange" subscription.
Going though _parent addresses, CommunicationChannel instance:

(gdb) p *(WPEFramework::JSONRPC::LinkType<WPEFramework::Core::JSON::IElement>::CommunicationChannel *) 0xaa5b8078
_observers = {<std::__cxx11::_List_base<WPEFramework::JSONRPC::LinkType<WPEFramework::Core::JSON::IElement>*...
_M_next = 0xa721c4f8, _M_prev = 0xa734b5e8}, _M_size = 2

shows 2 active LinkType.

Code of that plugin, shows 2 LinkType objects created with "new", Subscribe is called, no "delete". I.e. leak:

WPEFramework::JSONRPC::LinkType<WPEFramework::Core::JSON::IElement> *m_ControllerObj = nullptr;
WPEFramework::JSONRPC::LinkType<WPEFramework::Core::JSON::IElement> *m_NetworkPluginObj = nullptr;
m_ControllerObj = new WPEFramework::JSONRPC::LinkType<Core::JSON::IElement>("", "", false);
m_NetworkPluginObj = new WPEFramework::JSONRPC::LinkType<Core::JSON::IElement>(_T(NETWORK_CALLSIGN_VER),"");
m_ControllerObj->Subscribe<JsonObject>(THUNDER_RPC_TIMEOUT, _T("statechange"),&XCastImplementation::eventHandler_pluginState,this);
--- no delete ---

Looks like ResourceMonitor crash can happen whenever there are leaked JSONRPC::LinkType-s in the plugin that unloaded.

Steps to reproduce

for item in "org.rdk.Bluetooth" ... "org.rdk.Network"; do
  curl -X PUT http://127.0.0.1:9998/Service/Controller/Deactivate/$item &
done 

sends multiple deactivate calls (40).

Expected Behavior

No crash

Actual Behavior

Crash

Notes (Optional)

No response

[npoltorapavlo]

Examples:

https://github.com/rdkcentral/ttsengine/blob/dcddcd8623698b082a66d28d37a6e263e4c03630/ttsclient/Service.cpp#L136

https://github.com/rdkcentral/entservices-mediaanddrm/blob/59a433dbf2fa7230012b9b191127625d54c39f10/TextToSpeech/impl/SatToken.cpp#L49

rdkservices/TextToSpeech/impl/SatToken.cpp

Line 30 in be20d0b

m_authService = new WPEFramework::JSONRPC::LinkType<Core::JSON::IElement>(_T(m_callsign.c_str()),"");

https://github.com/rdkcentral/entservices-mediaanddrm/blob/59a433dbf2fa7230012b9b191127625d54c39f10/TextToSpeech/impl/NetworkStatusObserver.cpp#L98

rdkservices/TextToSpeech/impl/NetworkStatusObserver.cpp

Line 79 in be20d0b

m_networkService = new WPEFramework::JSONRPC::LinkType<Core::JSON::IElement>(_T(NETWORK_CALLSIGN_VER),"");

https://github.com/rdkcentral/entservices-casting/blob/b45f7e1f9724474ce96ae6e08bf4d80f5ef13368/XCast/XCastImplementation.cpp#L218

rdkservices/XCast/XCastImplementation.cpp

Line 452 in be20d0b

m_ControllerObj = new WPEFramework::JSONRPC::LinkType<Core::JSON::IElement>("", "", false);

rdkservices/XCast/XCastImplementation.cpp

Line 501 in be20d0b

m_NetworkPluginObj = new WPEFramework::JSONRPC::LinkType<Core::JSON::IElement>(_T(NETWORK_CALLSIGN_VER),"");

https://github.com/rdkcentral/entservices-softwareupdate/blob/1208b9dc5d0f2aa8f2a7f83491d1ec31df838d7f/MaintenanceManager/MaintenanceManager.cpp#L697

rdkservices/MaintenanceManager/MaintenanceManager.cpp

Line 687 in be20d0b

thunder_client = new WPEFramework::JSONRPC::LinkType<Core::JSON::IElement>(callsign, "", false, query);

https://github.com/rdkcentral/xdialserver/blob/652d90d18e5623a2e4f35a4bd34e9a91f71d7bed/server/plat/gdial.cpp#L598

rdkservices/HdmiInput/HdmiInput.cpp

Line 761 in be20d0b

m_client = new WPEFramework::JSONRPC::LinkType<Core::JSON::IElement>(_T(HDMICECSINK_CALLSIGN_VER), (_T(HDMICECSINK_CALLSIGN_VER)), false, query);

rdkservices/HdmiInput/HdmiInput.cpp

Line 1303 in be20d0b

m_tv_client = new WPEFramework::JSONRPC::LinkType<Core::JSON::IElement>(_T(TVSETTINGS_CALLSIGN_VER), (_T(TVSETTINGS_CALLSIGN_VER)), false, query);