After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 653733 - gssdp-device-sniffer core dump
gssdp-device-sniffer core dump
Status: RESOLVED FIXED
Product: gssdp
Classification: Other
Component: General
unspecified
Other OpenBSD
: Normal major
: ---
Assigned To: GUPnP Maintainers
GUPnP Maintainers
Depends on:
Blocks:
 
 
Reported: 2011-06-30 11:05 UTC by Jasper Lievisse Adriaanse
Modified: 2019-02-22 09:29 UTC
See Also:
GNOME target: ---
GNOME version: ---


Attachments
IP_MULTICAST_TTL testcase (509 bytes, text/plain)
2011-07-04 12:20 UTC, Jasper Lievisse Adriaanse
Details

Description Jasper Lievisse Adriaanse 2011-06-30 11:05:32 UTC
Starting gssdp-device-sniffer directly results in a core dump on OpenBSD:
(gdb) run
Starting program: /usr/local/bin/gssdp-device-sniffer 
/usr/local/share/themes/MurrinaVerdeOlivo/gtk-2.0/gtkrc:45: Murrine configuratio                                                                                    n option "scrollbar_color" is no longer supported and will be ignored.

Program received signal SIGBUS, Bus error.
[Switching to process 7133, thread 0x20f865000]
pthread_mutex_lock (mutex=0xdfdfdfdfdfdfdfe7)
    at /usr/src/lib/libpthread/uthread/uthread_mutex.c:681
681             else if ((*mutex != NULL) || ((ret = init_static(mutex)) == 0))
(gdb) bt
  • #0 pthread_mutex_lock
    at /usr/src/lib/libpthread/uthread/uthread_mutex.c line 681
  • #1 g_source_unref
    from /usr/local/lib/libglib-2.0.so.2800.0
  • #2 gssdp_socket_source_dispose
    at gssdp-socket-source.c line 361
  • #3 g_object_unref
    from /usr/local/lib/libgobject-2.0.so.2800.0
  • #4 g_initable_new_valist
    from /usr/local/lib/libgio-2.0.so.2800.0
  • #5 g_initable_new
    from /usr/local/lib/libgio-2.0.so.2800.0
  • #6 gssdp_socket_source_new
    at gssdp-socket-source.c line 131
  • #7 gssdp_client_constructed
    at gssdp-client.c line 168
  • #8 g_object_newv
    from /usr/local/lib/libgobject-2.0.so.2800.0
  • #9 g_object_new_valist
    from /usr/local/lib/libgobject-2.0.so.2800.0
  • #10 g_object_new
  • #11 gssdp_client_new
    at gssdp-client.c line 517
  • #12 init_upnp
    at gssdp-device-sniffer.c line 604
  • #13 main
    at gssdp-device-sniffer.c line 649

Looking at the location of mutex made me suspect memory handling errors. When I run without MALLOC_OPTIONS (used to be set to 'FJG', see http://www.openbsd.org/cgi-bin/man.cgi?query=malloc):

(gssdp-device-sniffer:28144): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
This indicates a bug in someone's code. You must ensure an error is NULL before it's set.
The overwriting error message was: Error binding to address: Address already in use

(gssdp-device-sniffer:28144): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
This indicates a bug in someone's code. You must ensure an error is NULL before it's set.
The overwriting error message was: Failed to set TTLInvalid argument
Error creating the GSSDP client: Failed to bind socketFailed to set TTLInvalid argument
Comment 1 Jens Georg 2011-06-30 12:04:37 UTC
Is that gssdp version 0.10.0?
Comment 2 Jasper Lievisse Adriaanse 2011-06-30 12:34:02 UTC
Yes, but I just tried with 0.11.0:

(gssdp-device-sniffer:28107): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
This indicates a bug in someone's code. You must ensure an error is NULL before it's set.
The overwriting error message was: Invalid argument

(gssdp-device-sniffer:28107): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
This indicates a bug in someone's code. You must ensure an error is NULL before it's set.
The overwriting error message was: Invalid argument

(gssdp-device-sniffer:28107): GLib-WARNING **: GError set over the top of a previous GError or uninitialized memory.
This indicates a bug in someone's code. You must ensure an error is NULL before it's set.
The overwriting error message was: Invalid argument
Bus error (core dumped)

backtrace is the same:
Program received signal SIGBUS, Bus error.
[Switching to process 32296, thread 0x20341c000]
pthread_mutex_lock (mutex=0xdfdfdfdfdfdfdfe7) at /usr/src/lib/libpthread/uthread/uthread_mutex.c:681
681             else if ((*mutex != NULL) || ((ret = init_static(mutex)) == 0))
(gdb) t
[Current thread is 1 (process 32296, thread 0x20341c000)]
(gdb) bt
  • #0 pthread_mutex_lock
    at /usr/src/lib/libpthread/uthread/uthread_mutex.c line 681
  • #1 g_source_unref
    from /usr/local/lib/libglib-2.0.so.2800.0
  • #2 gssdp_socket_source_dispose
    at gssdp-socket-source.c line 353
  • #3 g_object_unref
    from /usr/local/lib/libgobject-2.0.so.2800.0
  • #4 gssdp_client_dispose
    at gssdp-client.c line 317
  • #5 g_object_unref
    from /usr/local/lib/libgobject-2.0.so.2800.0
  • #6 g_initable_new_valist
    from /usr/local/lib/libgio-2.0.so.2800.0
  • #7 g_initable_new
    from /usr/local/lib/libgio-2.0.so.2800.0
  • #8 gssdp_client_new
    at gssdp-client.c line 518
  • #9 init_upnp
    at gssdp-device-sniffer.c line 604
  • #10 main
    at gssdp-device-sniffer.c line 649
  • #0 pthread_mutex_lock
    at /usr/src/lib/libpthread/uthread/uthread_mutex.c line 681
  • #1 g_source_unref
    from /usr/local/lib/libglib-2.0.so.2800.0
  • #2 gssdp_socket_source_dispose
    at gssdp-socket-source.c line 353
  • #3 g_object_unref
    from /usr/local/lib/libgobject-2.0.so.2800.0
  • #4 gssdp_client_dispose
    at gssdp-client.c line 317
  • #5 g_object_unref
    from /usr/local/lib/libgobject-2.0.so.2800.0
  • #6 g_initable_new_valist
    from /usr/local/lib/libgio-2.0.so.2800.0
  • #7 g_initable_new
    from /usr/local/lib/libgio-2.0.so.2800.0
  • #8 gssdp_client_new
    at gssdp-client.c line 518
  • #9 init_upnp
    at gssdp-device-sniffer.c line 604
  • #10 main
    at gssdp-device-sniffer.c line 649
(gdb)
Comment 3 Jens Georg 2011-06-30 12:48:08 UTC
hm, I just did a compile of 0.10.0 on OpenBSD 4.9 (libsoup + gtk + dependencies installed with pkg_add) and I get "cannot set TTLInvalid argument" but no crash. or GError warnings.

Will check error flow though.
Comment 4 Jasper Lievisse Adriaanse 2011-06-30 12:58:15 UTC
Could you do the following and try again?

'sudo ln -s S /etc/malloc.conf'

(And great that you're testing on OpenBSD!)
Comment 5 Jens Georg 2011-06-30 13:14:46 UTC
Ah yes. Does that fix it for you? It does for me :)

diff --git a/libgssdp/gssdp-socket-source.c b/libgssdp/gssdp-socket-source.c
index fc834ea..46fd7b8 100644
--- a/libgssdp/gssdp-socket-source.c
+++ b/libgssdp/gssdp-socket-source.c
@@ -205,6 +205,7 @@ gssdp_socket_source_do_init (GInitable     *initable,
                                             inner_error,
                                             "Failed to set TTL");
 
+                goto error;
         }
         /* Set up additional things according to the type of socket desired */
         if (self->priv->type == GSSDP_SOCKET_SOURCE_TYPE_MULTICAST) {
Comment 6 Jasper Lievisse Adriaanse 2011-06-30 13:30:57 UTC
Yep, works for me. Ill probably import it into ports later this week.
Comment 7 Jens Georg 2011-06-30 13:43:38 UTC
If you have any idea how to fix the TTL stuff/literature how to do multicast on OpenBSD, please don't hesitate to share.
Comment 8 Jasper Lievisse Adriaanse 2011-06-30 14:03:40 UTC
I'll try to have a look.
Comment 9 Jasper Lievisse Adriaanse 2011-07-04 12:20:17 UTC
Created attachment 191226 [details]
IP_MULTICAST_TTL testcase
Comment 10 Jasper Lievisse Adriaanse 2011-07-04 12:24:32 UTC
Hmm, looking at the source for ping(8) (http://www.openbsd.org/cgi-bin/cvsweb/src/sbin/ping/ping.c look for MULTICAST_TTL) they're basically doing the same dance...just setsockopt(2).

Trying to recreate the steps taken in gssdp_socket_source_do_init() are in the attached ttl.c. It just creates a socket, sets SO_BROADCAST and then a TTL of '4'. But that just exits cleanly..

Attached is a ktrace(1) snippet from gssdp between creating the socket
and bailing out:

 28882 gssdp-device-sni CALL  socket(PF_INET,SOCK_DGRAM,IPPROTO_UDP)
 28882 gssdp-device-sni RET   socket 8
 28882 gssdp-device-sni CALL  fcntl(0x8,F_GETFL,0)
 28882 gssdp-device-sni RET   fcntl 2
 28882 gssdp-device-sni CALL  fcntl(0x8,F_SETFL,0x6<O_RDWR|O_NONBLOCK>)
 28882 gssdp-device-sni RET   fcntl 0
 28882 gssdp-device-sni CALL  sigprocmask(SIG_BLOCK,0xffffffff)
 28882 gssdp-device-sni RET   sigprocmask 0
 28882 gssdp-device-sni CALL  mprotect(0x202b63000,0x5000,0x3<PROT_READ|PROT_WRITE>)
 28882 gssdp-device-sni RET   mprotect 0
 28882 gssdp-device-sni CALL  mprotect(0x202b63000,0x5000,0x1<PROT_READ>)
 28882 gssdp-device-sni RET   mprotect 0
 28882 gssdp-device-sni CALL  sigprocmask(SIG_SETMASK,0)
 28882 gssdp-device-sni RET   sigprocmask 4294901503/0xfffefeff
 28882 gssdp-device-sni CALL  fcntl(0x8,F_GETFD,0)
 28882 gssdp-device-sni RET   fcntl 0
 28882 gssdp-device-sni CALL  fcntl(0x8,F_SETFD,FD_CLOEXEC)
 28882 gssdp-device-sni RET   fcntl 0
 28882 gssdp-device-sni CALL  fcntl(0x8,F_SETFL,0x6<O_RDWR|O_NONBLOCK>)
 28882 gssdp-device-sni RET   fcntl 0
 28882 gssdp-device-sni CALL  fcntl(0x8,F_GETFL,0)
 28882 gssdp-device-sni RET   fcntl 6
 28882 gssdp-device-sni CALL  sigprocmask(SIG_BLOCK,0xffffffff)
 28882 gssdp-device-sni RET   sigprocmask 0
 28882 gssdp-device-sni CALL  mprotect(0x20843a000,0x1000,0x3<PROT_READ|PROT_WRITE>)
 28882 gssdp-device-sni RET   mprotect 0
 28882 gssdp-device-sni CALL  mprotect(0x20843a000,0x1000,0x1<PROT_READ>)
 28882 gssdp-device-sni RET   mprotect 0
 28882 gssdp-device-sni CALL  sigprocmask(SIG_SETMASK,0)
 28882 gssdp-device-sni RET   sigprocmask 4294901503/0xfffefeff
 28882 gssdp-device-sni CALL  sigprocmask(SIG_BLOCK,0xffffffff)
 28882 gssdp-device-sni RET   sigprocmask 0
 28882 gssdp-device-sni CALL  mprotect(0x20843a000,0x1000,0x3<PROT_READ|PROT_WRITE>)
 28882 gssdp-device-sni RET   mprotect 0
 28882 gssdp-device-sni CALL  mprotect(0x20843a000,0x1000,0x1<PROT_READ>)
 28882 gssdp-device-sni RET   mprotect 0
 28882 gssdp-device-sni CALL  sigprocmask(SIG_SETMASK,0)
 28882 gssdp-device-sni RET   sigprocmask 4294901503/0xfffefeff
 28882 gssdp-device-sni CALL  sigprocmask(SIG_BLOCK,0xffffffff)
 28882 gssdp-device-sni RET   sigprocmask 0
 28882 gssdp-device-sni CALL  mprotect(0x204b18000,0x1000,0x3<PROT_READ|PROT_WRITE>)
 28882 gssdp-device-sni RET   mprotect 0
 28882 gssdp-device-sni CALL  mprotect(0x204b18000,0x1000,0x1<PROT_READ>)
 28882 gssdp-device-sni RET   mprotect 0
 28882 gssdp-device-sni CALL  sigprocmask(SIG_SETMASK,0)
 28882 gssdp-device-sni RET   sigprocmask 4294901503/0xfffefeff
 28882 gssdp-device-sni CALL  setsockopt(0x8,SOL_SOCKET,SO_BROADCAST,0x7f7ffffeb624,0x4)
 28882 gssdp-device-sni RET   setsockopt 0
 28882 gssdp-device-sni CALL  setsockopt(0x8,0,0xa,0x7f7ffffeb624,0x4)
 28882 gssdp-device-sni RET   setsockopt -1 errno 22 Invalid argument
 
And this is from the ttl.c testcase:
 12838 ttl      CALL  socket(PF_INET,SOCK_RAW,IPPROTO_ICMP)
 12838 ttl      RET   socket 3
 12838 ttl      CALL  sigprocmask(SIG_BLOCK,0xffffffff)
 12838 ttl      RET   sigprocmask 0
 12838 ttl      CALL  mprotect(0x700000,0x1000,0x3<PROT_READ|PROT_WRITE>)
 12838 ttl      RET   mprotect 0
 12838 ttl      CALL  mprotect(0x700000,0x1000,0x1<PROT_READ>)
 12838 ttl      RET   mprotect 0
 12838 ttl      CALL  sigprocmask(SIG_SETMASK,0)
 12838 ttl      RET   sigprocmask 4294901503/0xfffefeff
 12838 ttl      CALL  setsockopt(0x3,SOL_SOCKET,SO_BROADCAST,0x7f7fffff3808,0x4)
 12838 ttl      RET   setsockopt 0
 12838 ttl      CALL  setsockopt(0x3,0,0xa,0x7f7fffff380f,0x1)
 12838 ttl      RET   setsockopt 0
Comment 11 Jens Georg 2011-07-04 12:27:43 UTC
Ah sorry, forgot to link:

https://bugzilla.gnome.org/show_bug.cgi?id=653775

Already figured it out :)