Re: Static linking of musl with code compiled using GNU header files

[Rich Felker <dalias@aerifal.cx>]

On Fri, Mar 14, 2014 at 04:04:50PM -0500, David Grothe wrote:
> I built a shim module that defined all the undefined "__" routines
> that showed up in my link.  Then all my programs linked
> successfully.  But when I went to run one of my daemon processes it
> got a segv in the malloc code, as follows.
> 
> Program terminated with signal 11, Segmentation fault.
> #0  0x0811cd5d in unbin (c=0x9b53898, i=8) at src/malloc/malloc.c:242
> #1  0x0811d266 in malloc (n=112) at src/malloc/malloc.c:371
> #2  0x0804b3ce in ssd_malloc_fcn (nbytes=16, file=0x81348e6
> "../pi.c", linenr=2398) at ../pi.c:632
> #3  0x0804b597 in ssd_zalloc_fcn (nbytes=12, file=0x81348e6
> "../pi.c", linenr=2398) at ../pi.c:687
> #4  0x0804b5e2 in ssd_calloc_fcn (n_memb=1, memb_size=12,
> file=0x81348e6 "../pi.c", linenr=2398) at ../pi.c:696
> #5  0x0804ef18 in ss_setup_code_path (size=1024) at ../pi.c:2398
> #6  0x080548be in register_connections () at ../pi.c:5074
> #7  0x0805a2b8 in main (argc=2, argv=0xbfae15f4) at ../pi.c:7393
> (gdb) p *c
> $1 = {psize = 17, csize = 144, next = 0x81a3990, prev = 0x1}

The crashing line is:

        c->prev->next = c->next;

Based on this and your gdb print of *c, it looks like the chunk malloc
is trying to pull from the bin has had its contents (where it stores
its membership in the linked list of free chunks) clobbered, most
likely by your program. This is probably a use-after-free error. At
the very least, c->prev has been clobbered; it's also possible that
c->next was clobbered. You could try printing *c->next to see if it
looks like a valid chunk header (i can tell you if you send it to the
list).

Looking for the code that called free((void *)0x9b538a0) might be a
good way to track this down.

Rich