Debian Bug report logs - #652146
hwinfo crash with segfault

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: xserver-xorg-input-evtouch not installable <pupala@nethouse.sk>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: hwinfo crash with segfault

Date: Thu, 15 Dec 2011 09:58:30 +0100

Package: hwinfo
Version: 16.0-2.1
Severity: important

Dear Maintainer,
*** Please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these lines ***


-- System Information:
Debian Release: wheezy/sid
  APT prefers testing-proposed-updates
  APT policy: (500, 'testing-proposed-updates'), (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.1.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=sk_SK.UTF-8, LC_CTYPE=sk_SK.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/bash

Versions of packages hwinfo depends on:
ii  libc6    2.13-21
ii  libhd16  16.0-2.1

hwinfo recommends no packages.

hwinfo suggests no packages.

-- no debconf information

hwinfo already chrash with segfault.

'dmesg | grep hwinfo' output

[ 6750.021903] hwinfo[25037]: segfault at 503 ip 00007fa9ba15a1e1 sp 00007fff641fdb20 error 4 in libhd.so.16.0[7fa9ba12d000+bb000]

Message #10 received at 652146@bugs.debian.org (full text, mbox, reply):

From: Michael Prokop <mika@debian.org>

To: pupala@nethouse.sk, 652146@bugs.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#652146: hwinfo crash with segfault

Date: Sat, 14 Jan 2012 12:41:28 +0100

[Message part 1 (text/plain, inline)]

severity 652146 grave
thanks

* [Don Dez 15, 2011 at 09:58:30 +0100]:

> hwinfo already chrash with segfault.
> 'dmesg | grep hwinfo' output
> [ 6750.021903] hwinfo[25037]: segfault at 503 ip 00007fa9ba15a1e1 sp 00007fff641fdb20 error 4 in libhd.so.16.0[7fa9ba12d000+bb000]

I can reproduce the bug.

Problem doesn't seem to be present on 32bit systems,
but on amd64 it's definitely reproducable.

regards,
-mika-

[signature.asc (application/pgp-signature, inline)]

Message #17 received at 652146@bugs.debian.org (full text, mbox, reply):

From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

To: Michael Prokop <mika@debian.org>

Cc: 652146@bugs.debian.org, control@bugs.debian.org

Subject: Re: Bug#652146: hwinfo crash with segfault

Date: Mon, 16 Jan 2012 01:07:14 +0100

[Message part 1 (text/plain, inline)]

tags 652146 patch
thanks

Michael Prokop wrote...

> Problem doesn't seem to be present on 32bit systems,
> but on amd64 it's definitely reproducable.

The most likely culprit is

    "push %%rbx\n\t"

in src/hd/hd.c:hd_is_xen, in combination with the compiler and perhaps
libc.

As the compiler makes the strcmp call inline, hd_is_xen becomes a leaf
function. Hence the compiler optimizes the frame pointer handling,
therefore %rsp is not decremented and may not be used for push/pop
operations - at least not without tampering data, probably somewhere
in the caller's domain.

Suggested solution:

Instead of pushing, save %rbp in another register and mark that one
clobbered:

--- src/hd/hd.c.orig	2009-05-12 17:49:52.000000000 +0200
+++ src/hd/hd.c	2012-01-16 00:57:35.600532496 +0100
@@ -3245,16 +3257,16 @@
     "mov %%edx,8(%%esi)\n\t"
     "pop %%ebx"
 #else
-    "push %%rbx\n\t"
+    "mov %%ebx,%%edi\n\t"
     "cpuid\n\t"
     "mov %%ebx,(%%rsi)\n\t"
     "mov %%ecx,4(%%rsi)\n\t"
     "mov %%edx,8(%%rsi)\n\t"
-    "pop %%rbx"
+    "mov %%edi,%%ebx\n\t"
 #endif
     : "=a" (u), "=c" (foo)
     : "a" (0x40000000), "c" (0), "S" (signature)
-    : "%edx"
+    : "%edx", "%edi"
   );
 
   signature[12] = 0;


Other solutions:

* Mark %ebx clobbered. This appears to create the regular frameing but
  I wouldn't rely on that.
* Use some kind of pragma that disables frame optimization. Ditto.

Still unexplained: Why does this not happen on i386? Avoiding push/pop
there too would at least do not harm.

    Christoph

[signature.asc (application/pgp-signature, inline)]

Message #24 received at 652146@bugs.debian.org (full text, mbox, reply):

From: Michael Prokop <mika@debian.org>

To: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>, 652146@bugs.debian.org

Cc: control@bugs.debian.org, Steffen Winterfeldt <snwint@suse.de>

Subject: hwinfo: diff for NMU version 16.0-2.2

Date: Mon, 16 Jan 2012 12:22:24 +0100

[Message part 1 (text/plain, inline)]

tags 652146 + pending
forwarded 652146 snwint@suse.de
thanks

Cc-ing Steffen Winterfeldt as being upstream of hwinfo, he might be
interested in this issue + patch as well. Dear Steffen, full details
are available in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652146

* Christoph Biedl [Mon Jan 16, 2012 at 01:07:14AM +0100]:
> Michael Prokop wrote...

> > Problem doesn't seem to be present on 32bit systems,
> > but on amd64 it's definitely reproducable.

> The most likely culprit is

>     "push %%rbx\n\t"

> in src/hd/hd.c:hd_is_xen, in combination with the compiler and perhaps
> libc.
[...]

I was involved in debugging this issue and have just verified the
patch by Christoph against today's Debian/unstable once again, it
works fine for i386 + amd64, the segfault is no longer present with
the patch applied.

I've prepared an NMU for hwinfo (versioned as 16.0-2.2) and uploaded
it to DELAYED/5 (see attached file for the diff). Please feel free
to tell me if I should delay it longer.

regards,
-mika-

[hwinfo-16.0-2.2-nmu.diff (text/x-diff, attachment)]

[signature.asc (application/pgp-signature, inline)]

Message #33 received at 652146@bugs.debian.org (full text, mbox, reply):

From: Steffen Winterfeldt <snwint@suse.de>

To: Michael Prokop <mika@debian.org>

Cc: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>, 652146@bugs.debian.org, control@bugs.debian.org

Subject: Re: hwinfo: diff for NMU version 16.0-2.2

Date: Tue, 17 Jan 2012 12:19:03 +0100 (CET)

On Mon, 16 Jan 2012, Michael Prokop wrote:

> tags 652146 + pending
> forwarded 652146 snwint@suse.de
> thanks
>
> Cc-ing Steffen Winterfeldt as being upstream of hwinfo, he might be
> interested in this issue + patch as well. Dear Steffen, full details
> are available in http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=652146

Thanks! But shouldn't it be 'mov %%rbx,%%rdi' etc, then?


Steffen

-- 
Give orange me give eat orange me eat orange give me eat orange give me you.
(chimp Nim, using sign language)

Message #38 received at 652146@bugs.debian.org (full text, mbox, reply):

From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

To: Steffen Winterfeldt <snwint@suse.de>

Cc: Michael Prokop <mika@debian.org>, 652146@bugs.debian.org

Subject: Re: hwinfo: diff for NMU version 16.0-2.2

Date: Wed, 18 Jan 2012 19:31:17 +0100

[Message part 1 (text/plain, inline)]

Steffen Winterfeldt wrote...

> Thanks! But shouldn't it be 'mov %%rbx,%%rdi' etc, then?

Hm, why? cpuid affects only the lower 32 Bits. Using %rbx instead
shouldn't do harm, though.

    Christoph

[signature.asc (application/pgp-signature, inline)]

Message #43 received at 652146@bugs.debian.org (full text, mbox, reply):

From: Steffen Winterfeldt <snwint@suse.de>

To: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

Cc: Michael Prokop <mika@debian.org>, 652146@bugs.debian.org

Subject: Re: hwinfo: diff for NMU version 16.0-2.2

Date: Thu, 19 Jan 2012 10:51:01 +0100 (CET)

On Wed, 18 Jan 2012, Christoph Biedl wrote:

> Steffen Winterfeldt wrote...
>
>> Thanks! But shouldn't it be 'mov %%rbx,%%rdi' etc, then?
>
> Hm, why? cpuid affects only the lower 32 Bits. Using %rbx instead
> shouldn't do harm, though.

No, the result is zero-extended to 64 bits in 64bit-mode.


Steffen

Message #48 received at 652146-close@bugs.debian.org (full text, mbox, reply):

From: Michael Prokop <mika@debian.org>

To: 652146-close@bugs.debian.org

Subject: Bug#652146: fixed in hwinfo 16.0-2.2

Date: Sat, 21 Jan 2012 11:49:04 +0000

Source: hwinfo
Source-Version: 16.0-2.2

We believe that the bug you reported is fixed in the latest version of
hwinfo, which is due to be installed in the Debian FTP archive:

hwinfo_16.0-2.2.diff.gz
  to main/h/hwinfo/hwinfo_16.0-2.2.diff.gz
hwinfo_16.0-2.2.dsc
  to main/h/hwinfo/hwinfo_16.0-2.2.dsc
hwinfo_16.0-2.2_amd64.deb
  to main/h/hwinfo/hwinfo_16.0-2.2_amd64.deb
libhd-dev_16.0-2.2_amd64.deb
  to main/h/hwinfo/libhd-dev_16.0-2.2_amd64.deb
libhd-doc_16.0-2.2_all.deb
  to main/h/hwinfo/libhd-doc_16.0-2.2_all.deb
libhd16_16.0-2.2_amd64.deb
  to main/h/hwinfo/libhd16_16.0-2.2_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 652146@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Prokop <mika@debian.org> (supplier of updated hwinfo package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Mon, 16 Jan 2012 11:02:29 +0100
Source: hwinfo
Binary: hwinfo libhd16 libhd-doc libhd-dev
Architecture: source amd64 all
Version: 16.0-2.2
Distribution: unstable
Urgency: low
Maintainer: William Vera <billy@billy.com.mx>
Changed-By: Michael Prokop <mika@debian.org>
Description: 
 hwinfo     - Hardware identification system
 libhd-dev  - Hardware identification system library and headers
 libhd-doc  - Hardware identification system library documentation
 libhd16    - Hardware identification system library
Closes: 652146
Changes: 
 hwinfo (16.0-2.2) unstable; urgency=low
 .
   * Non-maintainer upload.
   * Add patch fix_segfault_in_hd_is_xen_on_amd64 which fixes segfaults
     on amd64. Thanks Christoph Biedl <debian.axhn@manchmal.in-ulm.de>
     (Closes: #652146)
Checksums-Sha1: 
 52784013a8519dde17a366798da52a406338777d 1197 hwinfo_16.0-2.2.dsc
 0cf376856be7c838d744fc0e2cb5d0f046bddc53 11202 hwinfo_16.0-2.2.diff.gz
 ce07efe07a97bc54ef2fbe7fffda28b3cd6c4f70 46838 hwinfo_16.0-2.2_amd64.deb
 0a948933d854eadbe1b5d6122a9c6e349e42cf0a 698428 libhd16_16.0-2.2_amd64.deb
 f1281d74023c6500745a50f7e116e05f9b85910e 780564 libhd-dev_16.0-2.2_amd64.deb
 15f49e4dd77843295d6827b8f1c36b29723bcd03 1597712 libhd-doc_16.0-2.2_all.deb
Checksums-Sha256: 
 432d1658d813e584731203ae20899626032b6f2e2c5c9d54e34c2d1c2c43edd7 1197 hwinfo_16.0-2.2.dsc
 37652df29b4b61f6c322a700d15319b0bb7bc0535ce9aefa058ac8bf0239e198 11202 hwinfo_16.0-2.2.diff.gz
 e9331e2e8660f86da1672d8302f634350f01a530487cb82484789e2ad075082c 46838 hwinfo_16.0-2.2_amd64.deb
 979c29853162aa8faccd54144420d68a5a1936347e0c2026aef998e0886ef159 698428 libhd16_16.0-2.2_amd64.deb
 d706cda6e188541f2ec019ce71cdcae7258513597138e3761bef193c17ee7ff9 780564 libhd-dev_16.0-2.2_amd64.deb
 2ef90338ae25df2034c6189f0960b4569df9f0c4245343ccab5907f50555fbf0 1597712 libhd-doc_16.0-2.2_all.deb
Files: 
 12d706e0d50e8264e7fb991bed60cfae 1197 admin optional hwinfo_16.0-2.2.dsc
 af2dbcb941b81b4e7cbdd20ccbce23e7 11202 admin optional hwinfo_16.0-2.2.diff.gz
 6b4f18353c52829bd2ada96a1a31ed0d 46838 admin optional hwinfo_16.0-2.2_amd64.deb
 66820828d934f826b6027fae9560b28d 698428 libs optional libhd16_16.0-2.2_amd64.deb
 06f991a39a31265c59b59983651e5bde 780564 libdevel optional libhd-dev_16.0-2.2_amd64.deb
 be7b11c39a56f94b876e93e1265d33ef 1597712 doc optional libhd-doc_16.0-2.2_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk8UBBwACgkQ2N9T+zficugMpQCfQ1MfZHqsLACHvDRp1DWmBSco
XzsAoINgRmg2iblpC0PHxyL5hEDIQ/tf
=Og87
-----END PGP SIGNATURE-----

Message #53 received at 652146@bugs.debian.org (full text, mbox, reply):

From: Sebastian Cruz <default50@gmail.com>

To: Debian Bug Tracking System <652146@bugs.debian.org>

Subject: hwinfo: bug still present for me

Date: Sat, 21 Jan 2012 18:07:36 -0300

Package: hwinfo
Version: 16.0-2.2
Followup-For: Bug #652146

Dear Maintainer,
*** Please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
     ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these lines ***

I upgraded hwinfo from unstable and the problem is still there for me.

stdout said:

# hwinfo
> hal.1: read hal dataprocess 9471: arguments to dbus_move_error() were incorrect, assertion "(dest) == NULL || !dbus_error_is_set ((dest))" failed in file ../../dbus/dbus-errors.c line 282.
This is normally a bug in some application using the D-Bus library.
libhal.c 3483 : Error unsubscribing to signals, error=The name org.freedesktop.Hal was not provided by any .service files
> pci.6: ps3zsh: segmentation fault  hwinfo                     

And in messages I can see:

[ 9998.595896] hwinfo[9566]: segfault at 503 ip 00007fb8519f71e1 sp 00007ffff6d95660 error 4 in libhd.so.16.0[7fb8519ca000+bb000]

Let me know if I can be of any help.

Thanks!

-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (990, 'testing'), (300, 'unstable'), (100, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.2.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.utf8, LC_CTYPE=en_US.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages hwinfo depends on:
ii  libc6    2.13-24
ii  libhd16  16.0-2.1

hwinfo recommends no packages.

hwinfo suggests no packages.

-- no debconf information

Message #58 received at 652146@bugs.debian.org (full text, mbox, reply):

From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

To: Steffen Winterfeldt <snwint@suse.de>

Cc: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>, Michael Prokop <mika@debian.org>, 652146@bugs.debian.org

Subject: Re: hwinfo: diff for NMU version 16.0-2.2

Date: Sun, 22 Jan 2012 11:48:00 +0100

Steffen Winterfeldt wrote...

> On Wed, 18 Jan 2012, Christoph Biedl wrote:
> 
> >Steffen Winterfeldt wrote...
> >
> >>Thanks! But shouldn't it be 'mov %%rbx,%%rdi' etc, then?
> >
> >Hm, why? cpuid affects only the lower 32 Bits. Using %rbx instead
> >shouldn't do harm, though.
> 
> No, the result is zero-extended to 64 bits in 64bit-mode.

I stand corrected.

(Call me Thomas, I wanted to see that with my own eye, this took a
while, sorry about that.)


By the way, I am quite confused by the fact

  cpuid with %eax set to 0 returns the ID in %ebx,%edx,%ecx

while

  cpuid with %eax set to 0x40000000 appearently returns, if running
  under xen, the ID in %ebx,%ecx,%edx, read: With %ecx and %edx in
  swapped order.

Mind of you double-check your code does the right thing unless you've
already done so? I don't have a Xen installation at hand to do this,
they crashed or did other nasty things every time I've tried in the
past six years.

    Christoph

Message #63 received at 652146@bugs.debian.org (full text, mbox, reply):

From: Nathan Cutler <presnypreklad@gmail.com>

To: Debian Bug Tracking System <652146@bugs.debian.org>

Subject: hwinfo: Confirm, bug is still there

Date: Sun, 29 Jan 2012 20:46:58 +0100

Package: hwinfo
Version: 16.0-2.2
Followup-For: Bug #652146

I can confirm that the bug is still there in version 16.0-2.2 (amd64).



-- System Information:
Debian Release: wheezy/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 3.1.0-1-amd64 (SMP w/2 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages hwinfo depends on:
ii  libc6    2.13-24
ii  libhd16  16.0-2.1

hwinfo recommends no packages.

hwinfo suggests no packages.

-- no debconf information

Send a report that this bug log contains spam.