From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/4658 Path: news.gmane.org!not-for-mail From: Rich Felker Newsgroups: gmane.linux.lib.musl.general Subject: Re: Static linking of musl with code compiled using GNU header files Date: Fri, 14 Mar 2014 20:22:09 -0400 Message-ID: <20140315002209.GL184@brightrain.aerifal.cx> References: <53232493.80901@gcom.com> <20140314162957.GB27448@port70.net> <53234FE2.7040309@gcom.com> <53236EF2.4030606@gcom.com> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: ger.gmane.org 1394842933 32661 80.91.229.3 (15 Mar 2014 00:22:13 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 15 Mar 2014 00:22:13 +0000 (UTC) Cc: Support at Gcom To: musl@lists.openwall.com Original-X-From: musl-return-4662-gllmg-musl=m.gmane.org@lists.openwall.com Sat Mar 15 01:22:22 2014 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1WOcMo-0003KZ-G0 for gllmg-musl@plane.gmane.org; Sat, 15 Mar 2014 01:22:22 +0100 Original-Received: (qmail 13493 invoked by uid 550); 15 Mar 2014 00:22:21 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 13482 invoked from network); 15 Mar 2014 00:22:21 -0000 Content-Disposition: inline In-Reply-To: <53236EF2.4030606@gcom.com> User-Agent: Mutt/1.5.21 (2010-09-15) Xref: news.gmane.org gmane.linux.lib.musl.general:4658 Archived-At: On Fri, Mar 14, 2014 at 04:04:50PM -0500, David Grothe wrote: > I built a shim module that defined all the undefined "__" routines > that showed up in my link. Then all my programs linked > successfully. But when I went to run one of my daemon processes it > got a segv in the malloc code, as follows. > > Program terminated with signal 11, Segmentation fault. > #0 0x0811cd5d in unbin (c=0x9b53898, i=8) at src/malloc/malloc.c:242 > #1 0x0811d266 in malloc (n=112) at src/malloc/malloc.c:371 > #2 0x0804b3ce in ssd_malloc_fcn (nbytes=16, file=0x81348e6 > "../pi.c", linenr=2398) at ../pi.c:632 > #3 0x0804b597 in ssd_zalloc_fcn (nbytes=12, file=0x81348e6 > "../pi.c", linenr=2398) at ../pi.c:687 > #4 0x0804b5e2 in ssd_calloc_fcn (n_memb=1, memb_size=12, > file=0x81348e6 "../pi.c", linenr=2398) at ../pi.c:696 > #5 0x0804ef18 in ss_setup_code_path (size=1024) at ../pi.c:2398 > #6 0x080548be in register_connections () at ../pi.c:5074 > #7 0x0805a2b8 in main (argc=2, argv=0xbfae15f4) at ../pi.c:7393 > (gdb) p *c > $1 = {psize = 17, csize = 144, next = 0x81a3990, prev = 0x1} The crashing line is: c->prev->next = c->next; Based on this and your gdb print of *c, it looks like the chunk malloc is trying to pull from the bin has had its contents (where it stores its membership in the linked list of free chunks) clobbered, most likely by your program. This is probably a use-after-free error. At the very least, c->prev has been clobbered; it's also possible that c->next was clobbered. You could try printing *c->next to see if it looks like a valid chunk header (i can tell you if you send it to the list). Looking for the code that called free((void *)0x9b538a0) might be a good way to track this down. Rich