Re: NULL deref SEGV in malloc.c:unbin()

[David Wuertele <dave+gmane@wuertele.com>]

I wrote:

> Rich Felker <dalias <at> aerifal.cx> writes:
> > On Fri, Dec 27, 2013 at 07:44:23PM +0000, David Wuertele wrote:
> > > Rich Felker <dalias <at> aerifal.cx> writes:
> > > > On Fri, Dec 27, 2013 at 06:35:00PM +0000, David Wuertele wrote:
> > > > > I wonder if anyone has hit this before?   In unbin(),
> > > > > c->next->prev is set, but c->next is NULL.   It happens
> > > > > repeatedly, and here's what gdb says: 
> > > > > 
> > > > 
> > > > It's almost surely a case of memory corruption by the calling
> > > > program, most likely using memory after it's already been
> > > > freed. 
> > > 
> > > Hmm, my program calls malloc() once and never calls free().
> > 
> > And this crash happens on the very first call to malloc? Or did you
> > mean it only called it once successfully?
> > 
> 
> Now I am watching all memory locations that mal.bins[40].head points
> to in its history, but the going is very slow.

I removed all my calls to malloc(), now it is only musl that is
calling it.  I'm watching everything that I think might be related.
It looks like calloc(), opendir(), or free() are the culprit.

(gdb) info watch
Num     Type           Disp Enb Address    What
2       watchpoint     keep y              mal.bins[40].head
	breakpoint already hit 2 times
        print *mal.bins[40].head
        bt
        cont
3       watchpoint     keep y              mal.bins[40].head.next
	breakpoint already hit 47 times
        print *mal.bins[40].head
        bt
        cont
3.1                         y                mal.bins[40].head.next
3.2                         y                mal.bins[40].head.next
4       watchpoint     keep y              mal.bins[40].head.prev
	breakpoint already hit 32 times
        print *mal.bins[40].head
        bt
        cont
4.1                         y                mal.bins[40].head.prev
4.2                         y                mal.bins[40].head.prev
(gdb) c

Watchpoint 4: mal.bins[40].head.prev

Old value = (struct chunk *) 0xc9690
New value = (struct chunk *) 0x0
0x0008b268 in calloc (m=519, n=2080) at src/malloc/calloc.c:20
20	in src/malloc/calloc.c
$78 = {psize = 2097, csize = 2097, next = 0x0, prev = 0x0}
#0  0x0008b268 in calloc (m=519, n=2080) at src/malloc/calloc.c:20
#1  0x00089f30 in opendir (name=0xaa8d4 ".") at src/dirent/opendir.c:19
#2  0x0000fb50 in mkchdir (path=0xbe83f89b "") at prog.c:1845
Watchpoint 3: mal.bins[40].head.next

Old value = (struct chunk *) 0x0
New value = (struct chunk *) 0x10
opendir (name=0xaa8d4 ".") at src/dirent/opendir.c:24
24	src/dirent/opendir.c: No such file or directory.
	in src/dirent/opendir.c
$79 = {psize = 2097, csize = 2097, next = 0x10, prev = 0x0}
#0  opendir (name=0xaa8d4 ".") at src/dirent/opendir.c:24
#1  0x0000fb50 in mkchdir (path=0xbe83f89b "") at prog.c:1845
Watchpoint 3: mal.bins[40].head.next

Old value = (struct chunk *) 0x10
New value = (struct chunk *) 0x2139018
free (p=0x2139020) at src/malloc/malloc.c:530
530	src/malloc/malloc.c: No such file or directory.
	in src/malloc/malloc.c
$80 = {psize = 2096, csize = 2097, next = 0x2139018, prev = 0x0}
#0  free (p=0x2139020) at src/malloc/malloc.c:530
#1  0x00089e84 in closedir (dir=0x2139020) at src/dirent/closedir.c:9
#2  0x0000fc80 in mkchdir (path=0xd22bc "/var/spool") at prog.c:1873

Program received signal SIGSEGV, Segmentation fault.
0x0008be70 in unbin (c=0x2139848, i=40) at src/malloc/malloc.c:241
241	in src/malloc/malloc.c
(gdb) 


Dave