Linux server crashes when I kill entity by knife and remove it after

Hedgehog Fog · **Author**

Hello,
I need help with fix some bug on linux.
I create entity with pev_takedamage DMG_AIM, and I hook Ham_Killed event for this entity. When I try to remove this entity on Kill:

PHP Code:


			
engfunc(EngFunc_RemoveEntity, ent)

Linux server just crash, no errors in amx log.

This bug appears only if I kill this entity by knife.

No problem if I do something like that:

PHP Code:


			
set_pev(ent, pev_flags, pev(ent, pev_flags) | FL_KILLME);

Anyway I would like to know the reason of crashes.

PRoSToTeM@ · *Last edited by PRoSToTeM@; 10-30-2016 at 08:30. Reason: misinformation*

Something can use this entity after your removing, that's why. In your case knife code calls Classify function for damaged entity to choose the damage sound, that's why server crashes. https://github.com/s1lentq/ReGameDLL....cpp#L361-L367. In other case another plugin can get invalid entity when expected to get only valid after your removing (for example next plugin that also hooks Killed for this entity class).
So mostly you should use delayed entity removing.

Hedgehog Fog

PRoSToTeM@
Thanks.
Anyway, looks like it's no reason for crash. When engine try to make something with invalid entity we got error messages in console, not a server crash. And this problem appears only on Linux server, no problem on Windows server.

PRoSToTeM@ · *Last edited by PRoSToTeM@; 10-30-2016 at 08:28. Reason: misinformation*

Quote:

Originally Posted by Hedgehog95

Anyway, looks like it's no reason for crash.

Gamedll try to access already freed memory (privateData is freed), that is a reason for crash.

Quote:

Originally Posted by Hedgehog95

When engine try to make something with invalid entity we got error messages in console, not a server crash.

First of all that is gamedll, not engine. Secondly gamedll/plugins don't check entity after calling something.

Quote:

Originally Posted by Hedgehog95

And this problem appears only on Linux server, no problem on Windows server.

That is strange.

Solokiller · *Last edited by Solokiller; 10-30-2016 at 07:17.*

Calling the EngFunc_RemoveEntity function should be avoided if it's at all possible. It's more of a bookkeeping function for special cases, like failed entity creation.
Normally, SDK code uses UTIL_Remove, which first calls UpdateOnRemove and then flags it for removal with FL_KILLME.

What you're doing bypasses that and makes it possible to break entity cleanup. By removing it right away you also risk the invalid access that PRoSToTeM@ mentioned.
Note that the engine never touches privatedata, it only uses edict and entvars, which are never freed. The engine shouldn't crash when accessing that data.

I've noticed crashes that only occur on one platform, but i don't know what could be causing that. It could be related to how dynamic memory allocation is handled, different algorithms could cause memory to be reused at different points in time.

Depresie · *Last edited by Depresie; 10-30-2016 at 07:25.*

Ahm, when the entity is killed, it is automatically removed, you don't have to remove it manually.. probably that's why it is crashing

I remember i had a similar issue some time ago, the server was crashing when i was killing a certain entity with the knife, unfortenately i don't remember how it was happening and what was triggering it

Solokiller · *Last edited by Solokiller; 10-30-2016 at 07:41.*

Quote:

Originally Posted by Depresie

Ahm, when the entity is killed, it is automatically removed, you don't have to remove it manually.. probably that's why it is crashing

That depends on the entity. Killed is called when the entity is killed by taking damage. The entity isn't removed unless the logic in Killed flags it for removal. Killed isn't called at all if you killtarget the entity: https://github.com/ValveSoftware/hal.../subs.cpp#L262

Entities will sometimes delay their own removal after being killed. Monsters will first fade out, or get gibbed before being removed. Weapons call UTIL_Remove in Killed, so it'll be removed by the engine after the frame is done.

Setting FL_KILLME twice won't cause any problems, but calling EngFunc_RemoveEntity does invalidate the private data, which means that if Killed is allowed to run after your code is done, it'll be accessing freed memory. The 'this' pointer may no longer point to a valid pev member at that point, at which point anything could happen.

PRoSToTeM@

Quote:

Originally Posted by Solokiller

Note that the engine never touches privatedata, it only uses edict and entvars, which are never freed. The engine shouldn't crash when accessing that data.

Oh, thanks, forgot it.

Hedgehog Fog

Thanks you guys.