From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/4423 Path: news.gmane.org!not-for-mail From: David Wuertele Newsgroups: gmane.linux.lib.musl.general Subject: Re: NULL deref SEGV in malloc.c:unbin() Date: Sat, 28 Dec 2013 01:28:42 +0000 (UTC) Message-ID: References: <20131227190544.GF24286@brightrain.aerifal.cx> <20131227221345.GG24286@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: plane.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Trace: ger.gmane.org 1388194154 32373 80.91.229.3 (28 Dec 2013 01:29:14 GMT) X-Complaints-To: usenet@ger.gmane.org NNTP-Posting-Date: Sat, 28 Dec 2013 01:29:14 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-4427-gllmg-musl=m.gmane.org@lists.openwall.com Sat Dec 28 02:29:21 2013 Return-path: Envelope-to: gllmg-musl@plane.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by plane.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1VwiiP-0005bz-EX for gllmg-musl@plane.gmane.org; Sat, 28 Dec 2013 02:29:21 +0100 Original-Received: (qmail 21515 invoked by uid 550); 28 Dec 2013 01:29:20 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 21507 invoked from network); 28 Dec 2013 01:29:20 -0000 X-Injected-Via-Gmane: http://gmane.org/ Original-Lines: 91 Original-X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: sea.gmane.org User-Agent: Loom/3.14 (http://gmane.org/) X-Loom-IP: 205.234.27.227 (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36) Xref: news.gmane.org gmane.linux.lib.musl.general:4423 Archived-At: I wrote: > Rich Felker aerifal.cx> writes: > > On Fri, Dec 27, 2013 at 07:44:23PM +0000, David Wuertele wrote: > > > Rich Felker aerifal.cx> writes: > > > > On Fri, Dec 27, 2013 at 06:35:00PM +0000, David Wuertele wrote: > > > > > I wonder if anyone has hit this before? In unbin(), > > > > > c->next->prev is set, but c->next is NULL. It happens > > > > > repeatedly, and here's what gdb says: > > > > > > > > > > > > > It's almost surely a case of memory corruption by the calling > > > > program, most likely using memory after it's already been > > > > freed. > > > > > > Hmm, my program calls malloc() once and never calls free(). > > > > And this crash happens on the very first call to malloc? Or did you > > mean it only called it once successfully? > > > > Now I am watching all memory locations that mal.bins[40].head points > to in its history, but the going is very slow. I removed all my calls to malloc(), now it is only musl that is calling it. I'm watching everything that I think might be related. It looks like calloc(), opendir(), or free() are the culprit. (gdb) info watch Num Type Disp Enb Address What 2 watchpoint keep y mal.bins[40].head breakpoint already hit 2 times print *mal.bins[40].head bt cont 3 watchpoint keep y mal.bins[40].head.next breakpoint already hit 47 times print *mal.bins[40].head bt cont 3.1 y mal.bins[40].head.next 3.2 y mal.bins[40].head.next 4 watchpoint keep y mal.bins[40].head.prev breakpoint already hit 32 times print *mal.bins[40].head bt cont 4.1 y mal.bins[40].head.prev 4.2 y mal.bins[40].head.prev (gdb) c Watchpoint 4: mal.bins[40].head.prev Old value = (struct chunk *) 0xc9690 New value = (struct chunk *) 0x0 0x0008b268 in calloc (m=519, n=2080) at src/malloc/calloc.c:20 20 in src/malloc/calloc.c $78 = {psize = 2097, csize = 2097, next = 0x0, prev = 0x0} #0 0x0008b268 in calloc (m=519, n=2080) at src/malloc/calloc.c:20 #1 0x00089f30 in opendir (name=0xaa8d4 ".") at src/dirent/opendir.c:19 #2 0x0000fb50 in mkchdir (path=0xbe83f89b "") at prog.c:1845 Watchpoint 3: mal.bins[40].head.next Old value = (struct chunk *) 0x0 New value = (struct chunk *) 0x10 opendir (name=0xaa8d4 ".") at src/dirent/opendir.c:24 24 src/dirent/opendir.c: No such file or directory. in src/dirent/opendir.c $79 = {psize = 2097, csize = 2097, next = 0x10, prev = 0x0} #0 opendir (name=0xaa8d4 ".") at src/dirent/opendir.c:24 #1 0x0000fb50 in mkchdir (path=0xbe83f89b "") at prog.c:1845 Watchpoint 3: mal.bins[40].head.next Old value = (struct chunk *) 0x10 New value = (struct chunk *) 0x2139018 free (p=0x2139020) at src/malloc/malloc.c:530 530 src/malloc/malloc.c: No such file or directory. in src/malloc/malloc.c $80 = {psize = 2096, csize = 2097, next = 0x2139018, prev = 0x0} #0 free (p=0x2139020) at src/malloc/malloc.c:530 #1 0x00089e84 in closedir (dir=0x2139020) at src/dirent/closedir.c:9 #2 0x0000fc80 in mkchdir (path=0xd22bc "/var/spool") at prog.c:1873 Program received signal SIGSEGV, Segmentation fault. 0x0008be70 in unbin (c=0x2139848, i=40) at src/malloc/malloc.c:241 241 in src/malloc/malloc.c (gdb) Dave