Re: [PATCH] fix segfault when running GN_OP_Terminate

[Bastien Nocera]

On Tue, 2005-06-14 at 00:16 +0200, Pawel Kot wrote:
> Hi Bastien,
> 
> On 6/14/05, Bastien Nocera <address@hidden> wrote:
> > The attached program crashes straight before printing the model for the
> > phone. It works fine with my patch applied. Maybe some other data needs
> > to be zero'ed in gn_data_clear?
> 
> Well, it runs fine for me.
> 
> > It gives me that backtrace:
> > #0  0x00be0df9 in free () from /lib/tls/libc.so.6
> > #1  0xb7f945c1 in device_close (state=0xbffff2dc) at device.c:120
> > #2  0xb7fca274 in link_terminate (state=0xbffff2dc) at utils.c:55
> > #3  0xb7fa4e1f in pgen_terminate (data=0x0, state=0xbffff2dc) at
> > generic.c:51
> > #4  0xb7fc20aa in Terminate (data=0x0, state=0xbffff2dc) at atgen.c:1772
> > #5  0xb7fc22a6 in Functions (op=GN_OP_Init, data=0x0, state=0xbffff2dc)
> >     at atgen.c:242
> > #6  0xb7f927e4 in gn_sm_functions (op=GN_OP_Terminate, data=0x0, sm=0x0)
> >     at gsm-statemachine.c:347
> > #7  0x0804885d in main (argc=2, argv=0xbffff6a4) at gnokii-identify.c:56
> 
> Could you show 'bt full' output?

Not much more information:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1208465728 (LWP 32036)]
0x00be0df9 in free () from /lib/tls/libc.so.6
(gdb) bt full
#0  0x00be0df9 in free () from /lib/tls/libc.so.6
No symbol table info available.
#1  0xb7f945c1 in device_close (state=0xbffff2dc) at device.c:120
No locals.
#2  0xb7fca274 in link_terminate (state=0xbffff2dc) at utils.c:55
No locals.
#3  0xb7fa4e1f in pgen_terminate (data=0x0, state=0xbffff2dc) at
generic.c:51
No locals.
#4  0xb7fc20aa in Terminate (data=0x0, state=0xbffff2dc) at atgen.c:1772
No locals.
#5  0xb7fc22a6 in Functions (op=GN_OP_Init, data=0x0, state=0xbffff2dc)
    at atgen.c:242
        drvinst = (at_driver_instance *) 0x177ff86
#6  0xb7f927e4 in gn_sm_functions (op=GN_OP_Terminate, data=0x0, sm=0x0)
    at gsm-statemachine.c:347
No locals.
#7  0x0804885d in main (argc=2, argv=0xbffff6a4) at gnokii-identify.c:56
No locals.


> Something apparently was overwritten/not initialized. Not sure what.

state->device.device_instance was never initialised, at least that's
what valgrind is telling me (that's the if statement that checks
forstate->device.device_instance):

==32050== Conditional jump or move depends on uninitialised value(s)
==32050==    at 0x1B9265AC: device_close (device.c:119)
==32050==    by 0x1B95C273: link_terminate (utils.c:55)
==32050==    by 0x1B936E1E: pgen_terminate (generic.c:51)
==32050==    by 0x1B9540A9: Terminate (atgen.c:1772)
==32050==    by 0x1B9542A5: Functions (atgen.c:242)
==32050==    by 0x1B9247E3: gn_sm_functions (gsm-statemachine.c:347)
==32050==    by 0x804885C: main (gnokii-identify.c:56)

After is the crash, as you'll see in the valgrind output I gave earlier.

> PS. Which gcc version do you use?

gcc version 3.4.3 20050227 (Red Hat 3.4.3-22.fc3)

---
Bastien Nocera <address@hidden>