{"action":"created","issue":{"url":"https://api.github.com/repos/vincentbernat/lldpd/issues/135","labels_url":"https://api.github.com/repos/vincentbernat/lldpd/issues/135/labels{/name}","comments_url":"https://api.github.com/repos/vincentbernat/lldpd/issues/135/comments","events_url":"https://api.github.com/repos/vincentbernat/lldpd/issues/135/events","html_url":"https://github.com/vincentbernat/lldpd/issues/135","id":107021281,"number":135,"title":"segfault  in lldpd","user":{"login":"zhums","id":5149220,"avatar_url":"https://avatars.githubusercontent.com/u/5149220?v=3","gravatar_id":"","url":"https://api.github.com/users/zhums","html_url":"https://github.com/zhums","followers_url":"https://api.github.com/users/zhums/followers","following_url":"https://api.github.com/users/zhums/following{/other_user}","gists_url":"https://api.github.com/users/zhums/gists{/gist_id}","starred_url":"https://api.github.com/users/zhums/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/zhums/subscriptions","organizations_url":"https://api.github.com/users/zhums/orgs","repos_url":"https://api.github.com/users/zhums/repos","events_url":"https://api.github.com/users/zhums/events{/privacy}","received_events_url":"https://api.github.com/users/zhums/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-09-17T16:20:51Z","updated_at":"2015-09-18T17:27:12Z","closed_at":null,"body":"Hi Vincent,\r\n\r\nI am using 0.7.6 lldp in our test. One segfault was detect and it can not easily reproduce. I could not find the issue. Could you give me some advice?\r\n\r\nThe dmesg is:\r\nSep 16 01:21:01.605696925 exe-XC-01 user.info kernel: [   15.086946] lldpd[1965]: segfault at 38 ip 0000000000413dde sp 00007fff58a9fbd8 error 4 in lldpd[400000+2c000]\r\nSep 16 01:21:01.613996537 exe-XC-01 daemon.warn lldpcli[1963]: unable to ask lldpd to resume operations. End of file reached\r\nSep 16 01:21:01.615671040 exe-XC-01 user.warn kernel: [   15.104250] core dump: /evertz/core.lldpd.1964.exe-XC-01.1442366461.gz\r\n\r\n My Analysis is:\r\nA:  ip 0000000000413dde can tell:\r\n  413dd9:       e9 b7 e9 ff ff          jmpq   412795 <event_queue_insert>\r\n34433 \r\n34434 0000000000413dde <event_active>:\r\n34435   413dde:       48 83 7f 38 00          cmpq   $0x0,0x38(%rdi)\r\n34436   413de3:       75 11                   jne    413df6 <event_active+0x18>\r\n34437   413de5:       be 48 3b 42 00          mov    $0x423b48,%esi\r\n34438   413dea:       bf 77 35 42 00          mov    $0x423577,%edi\r\n34439   413def:       31 c0                   xor    %eax,%eax\r\n34440   413df1:       e9 45 69 00 00          jmpq   41a73b <event_warnx>\r\n34441   413df6:       0f bf d2                movswl %dx,%edx\r\n34442   413df9:       e9 95 ff ff ff          jmpq   413d93 <event_active_nolock>\r\n34443 \r\nvoid\r\nevent_active(struct event *ev, int res, short ncalls)\r\n{\r\n\tif (EVUTIL_FAILURE_CHECK(!ev->ev_base)) {\r\n\t\tevent_warnx(\"%s: event has no event_base set.\", __func__);\r\n\t\treturn;\r\n\t}\r\n\r\n\tEVBASE_ACQUIRE_LOCK(ev->ev_base, th_base_lock);\r\n\r\n\t_event_debug_assert_is_setup(ev);\r\n\r\n\tevent_active_nolock(ev, res, ncalls);\r\n\r\n\tEVBASE_RELEASE_LOCK(ev->ev_base, th_base_lock);\r\n}\r\n\r\nB: core dump can tell:\r\n\r\n(gdb) bt full\r\n#0  0x00007f842eda5655 in raise () from /lib/libc.so.6\r\nNo symbol table info available.\r\n#1  0x000000000040f895 in priv_exit_rc_status (status=11, rc=<optimized out>) at priv.c:383\r\nNo locals.\r\n#2  priv_exit_rc_status (rc=<optimized out>, status=11) at priv.c:360\r\nNo locals.\r\n#3  0x000000000040f90e in sig_chld (sig=<optimized out>) at priv.c:425\r\n        status = 11\r\n        rc = <optimized out>\r\n#4  <signal handler called>\r\nNo symbol table info available.\r\n#5  0x00007f842ee36f9e in read () from /lib/libc.so.6\r\nNo symbol table info available.\r\n#6  0x000000000041011c in read (__nbytes=4, __buf=0x7fff58a9fd7c, __fd=<optimized out>)\r\n    at /home/jzhu/development/exe-release-r9507/modules/exe/buildroot/host/usr/x86_64-buildroot-linux-gnu/sysroot/usr/include/bits/unistd.h:45\r\nNo locals.\r\n#7  may_read (buf=0x7fff58a9fd7c, n=4) at privsep_io.c:167\r\n        s = 0x7fff58a9fd7c \"\\003\"\r\n        res = 0\r\n        pos = 0\r\n#8  0x000000000040feb0 in priv_loop () at priv.c:346\r\n        cmd = PRIV_OPEN\r\n        a = <optimized out>\r\n#9  priv_init (chrootdir=0x41ea32 \"/var/run/lldpd\", ctl=4, uid=121, gid=<optimized out>) at priv.c:502\r\n        pair = {5, 6}\r\n        gidset = {6475824}\r\n        status = 0\r\n#10 0x0000000000405a6b in lldpd_main (argc=121, argv=0x7fff58aa0048) at lldpd.c:1451\r\n        cfg = <optimized out>\r\n        lchassis = <optimized out>\r\n        ch = <optimized out>\r\n        debug = <optimized out>\r\n        ctlname = 0x41e534 \"/var/run/lldpd.socket\"\r\n        mgmtp = 0x7fff58aa1b24 \"!169.254.0.1\"\r\n        cidp = 0x0\r\n        interfaces = 0x0\r\n        popt = <optimized out>\r\n        opts = \"H:vhkrdD:xX:m:u:4:6:I:C:p:M:P:S:iL:lccsef\\000\", ' ' <repeats 14 times>\r\n        i = <optimized out>\r\n        found = <optimized out>\r\n        advertise_version = 1\r\n        lldpmed = 0\r\n        noinventory = 0\r\n        descr_override = 0x0\r\n        platform_override = 0x0\r\n        lsb_release = 0x62e111 \"Buildroot 2012.11\"\r\n        lldpcli = 0x41e522 \"/usr/sbin/lldpcli\"\r\n        smart = 11\r\n        receiveonly = 0\r\n        ctl = 4\r\n        user = <optimized out>\r\n        group = <optimized out>\r\n        uid = 121\r\n        gid = 126\r\n        retry = <optimized out>\r\n#11 0x00007f842ed91ced in __libc_start_main () from /lib/libc.so.6\r\n(gdb) print remote\r\n$1 = 6\r\n\r\n\r\n\r\n00000000004100f9 <may_read>:\r\n26695  */\r\n26696 \r\n26697 /* Read all data or return 1 for error.  */\r\n26698 int\r\n26699 may_read(void *buf, size_t n)\r\n26700 {\r\n26701   4100f9:       41 54                   push   %r12\r\n26702   4100fb:       49 89 fc                mov    %rdi,%r12\r\n26703   4100fe:       55                      push   %rbp\r\n26704   4100ff:       48 89 f5                mov    %rsi,%rbp\r\n26705   410102:       53                      push   %rbx\r\n26706         char *s = buf;\r\n26707         ssize_t res, pos = 0;\r\n26708   410103:       31 db                   xor    %ebx,%ebx\r\n26709 \r\n26710         while (n > pos) {\r\n26711   410105:       eb 38                   jmp    41013f <may_read+0x46>\r\n26712   410107:       8b 3d 83 e9 21 00       mov    0x21e983(%rip),%edi        # 62ea90 <remote>\r\n26713                 res = read(remote, s + pos, n - pos);\r\n26714   41010d:       48 89 ea                mov    %rbp,%rdx\r\n26715   410110:       49 8d 34 1c             lea    (%r12,%rbx,1),%rsi\r\n26716   410114:       48 29 da                sub    %rbx,%rdx\r\n26717   410117:       e8 2c 2e ff ff          callq  402f48 <read@plt>\r\n26718                 switch (res) {\r\n26719   41011c:       48 83 f8 ff             cmp    $0xffffffffffffffff,%rax\r\n26720   410120:       74 07                   je     410129 <may_read+0x30>\r\n26721   410122:       48 85 c0                test   %rax,%rax\r\n26722   410125:       74 21                   je     410148 <may_read+0x4f>\r\n26723   410127:       eb 13                   jmp    41013c <may_read+0x43>\r\n26724                 case -1:\r\n26725                         if (errno == EINTR || errno == EAGAIN)\r\n26726   410129:       e8 ba 31 ff ff          callq  4032e8 <__errno_location@plt>\r\n26727   41012e:       8b 00                   mov    (%rax),%eax\r\n26728   410130:       83 f8 0b                cmp    $0xb,%eax\r\n26729   410133:       74 0a                   je     41013f <may_read+0x46>\r\n26730   410135:       83 f8 04                cmp    $0x4,%eax\r\n26731   410138:       74 05                   je     41013f <may_read+0x46>\r\n26732   41013a:       eb 0c                   jmp    410148 <may_read+0x4f>\r\n26733                                 continue;\r\n26734                 case 0:\r\n26735                         return (1);\r\n26736                 default:\r\n26737                         pos += res;\r\n26738   41013c:       48 01 c3                add    %rax,%rbx\r\n26739 may_read(void *buf, size_t n)\r\n26740 {\r\n26741         char *s = buf;\r\n26742         ssize_t res, pos = 0;\r\n26743 \r\n26744         while (n > pos) {\r\n26745   41013f:       48 39 dd                cmp    %rbx,%rbp\r\n26746   410142:       77 c3                   ja     410107 <may_read+0xe>\r\n26747                         return (1);\r\n26748                 default:\r\n26749                         pos += res;\r\n26750                 }\r\n26751         }\r\n26752         return (0);\r\n26753   410144:       31 c0                   xor    %eax,%eax\r\n26754   410146:       eb 05                   jmp    41014d <may_read+0x54>\r\n26755                 switch (res) {\r\n26756                 case -1:\r\n26757                         if (errno == EINTR || errno == EAGAIN)\r\n26758                                 continue;\r\n26759                 case 0:\r\n26760                         return (1);\r\n26761   410148:       b8 01 00 00 00          mov    $0x1,%eax\r\n26762                 default:\r\n26763                         pos += res;\r\n26764                 }\r\n26765         }\r\n26766         return (0);\r\n26767 }\r\n26768   41014d:       5b                      pop    %rbx\r\n26769   41014e:       5d                      pop    %rbp\r\n26770   41014f:       41 5c                   pop    %r12\r\n26771   410151:       c3                      retq\r\n\r\nint\r\nmay_read(void *buf, size_t n)\r\n{\r\n\tchar *s = buf;\r\n\tssize_t res, pos = 0;\r\n\r\n\twhile (n > pos) {\r\n\t\tres = read(remote, s + pos, n - pos);\r\n\t\tswitch (res) {\r\n\t\tcase -1:\r\n\t\t\tif (errno == EINTR || errno == EAGAIN)\r\n\t\t\t\tcontinue;\r\n\t\tcase 0:\r\n\t\t\treturn (1);\r\n\t\tdefault:\r\n\t\t\tpos += res;\r\n\t\t}\r\n\t}\r\n\treturn (0);\r\n}\r\n\r\nThanks!\r\n\r\nJames Zhu\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/vincentbernat/lldpd/issues/comments/141513713","html_url":"https://github.com/vincentbernat/lldpd/issues/135#issuecomment-141513713","issue_url":"https://api.github.com/repos/vincentbernat/lldpd/issues/135","id":141513713,"user":{"login":"vincentbernat","id":631446,"avatar_url":"https://avatars.githubusercontent.com/u/631446?v=3","gravatar_id":"","url":"https://api.github.com/users/vincentbernat","html_url":"https://github.com/vincentbernat","followers_url":"https://api.github.com/users/vincentbernat/followers","following_url":"https://api.github.com/users/vincentbernat/following{/other_user}","gists_url":"https://api.github.com/users/vincentbernat/gists{/gist_id}","starred_url":"https://api.github.com/users/vincentbernat/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vincentbernat/subscriptions","organizations_url":"https://api.github.com/users/vincentbernat/orgs","repos_url":"https://api.github.com/users/vincentbernat/repos","events_url":"https://api.github.com/users/vincentbernat/events{/privacy}","received_events_url":"https://api.github.com/users/vincentbernat/received_events","type":"User","site_admin":false},"created_at":"2015-09-18T17:27:12Z","updated_at":"2015-09-18T17:27:12Z","body":"I am unsure if piping core dumps to a program works when the program is chrooted. Could you try with a simple pattern instead?"}}