1:41 a.m.
Hi everyone,
I'm getting a SEGFAULT when powering off a gemalto ALS3 modem with
SetProperty("Powered", Variant(false)).
This method call is made right after the SimManager interface is on
which could explain the error.
Log from oFono:
ofonod[6950]: src/sim.c:sim_remove() atom: 0x1604f0
(ofonod:6950): GLib-CRITICAL **: g_queue_is_empty: assertion 'queue !=
NULL' failed
gdb backtrace:
Program received signal SIGSEGV, Segmentation fault.
__ofono_sim_remove_session_watch (session=0x74656e, id=16) at src/sim.c:3616
3616 __ofono_watchlist_remove_item(session->watches, id);
(gdb) bt
#0 __ofono_sim_remove_session_watch (session=0x74656e, id=16) at
src/sim.c:3616
#1 0x000e368c in sim_fs_op_free (pointer=0x172498) at src/simfs.c:102
#2 0x76f11304 in node_rotate (node=0x74656e) at
/usr/src/debug/glib-2.0/1_2.38.2-r0/glib-2.38.2/glib/gsequence.c:1840
#3 0x76f11384 in node_update_fields (node=<optimized out>) at
/usr/src/debug/glib-2.0/1_2.38.2-r0/glib-2.38.2/glib/gsequence.c:1827
#4 node_rotate (node=0x74656e) at
/usr/src/debug/glib-2.0/1_2.38.2-r0/glib-2.38.2/glib/gsequence.c:1891
#5 0x000c2d7c in sim_remove (atom=0xe3640 <sim_fs_op_free>) at
src/sim.c:3175
#6 0x000a25c4 in flush_atoms (modem=0x160c00,
new_state=MODEM_STATE_POWER_OFF) at src/modem.c:432
#7 modem_change_state (modem=0x160c00, new_state=MODEM_STATE_POWER_OFF)
at src/modem.c:510
#8 0x000a2874 in set_powered (modem=modem@entry=0x160c00, powered=0) at
src/modem.c:896
#9 0x000a2e5c in modem_set_property (conn=0x13e508, msg=0x140c28,
data=0x160c00) at src/modem.c:1120
#10 0x000f657c in process_message (connection=connection@entry=0x13e508,
message=message@entry=0x140c28,
iface_user_data=iface_user_data@entry=0x160c00, method=0x11649c
<modem_methods+24>, method=0x11649c <modem_methods+24>)
at gdbus/object.c:259
#11 0x000f6998 in generic_message (connection=0x13e508,
message=message@entry=0x140c28, user_data=user_data@entry=0x15eec0) at
gdbus/object.c:1070
#12 0x76e9f240 in _dbus_object_tree_dispatch_and_unlock (tree=0x13e2f0,
message=message@entry=0x140c28,
found_object=found_object@entry=0x7efffa64) at
/usr/src/debug/dbus/1.6.18-r0/dbus-1.6.18/dbus/dbus-object-tree.c:862
#13 0x76e8fac4 in dbus_connection_dispatch
(connection=connection@entry=0x13e508) at
/usr/src/debug/dbus/1.6.18-r0/dbus-1.6.18/dbus/dbus-connection.c:4672
#14 0x000f3100 in message_dispatch (data=0x13e508) at gdbus/mainloop.c:72
#15 0x76efd9c4 in profile_print_locked (local_data=<optimized out>,
success=<optimized out>) at
/usr/src/debug/glib-2.0/1_2.38.2-r0/glib-2.38.2/glib/gmem.c:637
#16 0x76f010b0 in g_node_first_sibling (node=0x13d600) at
/usr/src/debug/glib-2.0/1_2.38.2-r0/glib-2.38.2/glib/gnode.c:1173
#17 0x00000000 in ?? ()
If you have any idea of the reason, let me know.
Best regards,
Gabriel
2:25 a.m.
Hi Gabriel,
gdb backtrace:
Program received signal SIGSEGV, Segmentation fault.
__ofono_sim_remove_session_watch (session=0x74656e, id=16) at
src/sim.c:3616
3616 __ofono_watchlist_remove_item(session->watches, id);
(gdb) bt
#0 __ofono_sim_remove_session_watch (session=0x74656e, id=16) at
src/sim.c:3616
#1 0x000e368c in sim_fs_op_free (pointer=0x172498) at src/simfs.c:102
Are you running upstream? There's nothing relevant at that line now.
This should have been fixed in commit
a99c0be535410a92773ffdfbebb766bec66b66fe by the way.
Regards,
-Denis
2:32 a.m.
Denis,
On 26/03/2018 17:25, Denis Kenzior wrote:
Hi Gabriel,
> gdb backtrace:
>
> Program received signal SIGSEGV, Segmentation fault.
> __ofono_sim_remove_session_watch (session=0x74656e, id=16) at
> src/sim.c:3616
> 3616 __ofono_watchlist_remove_item(session->watches, id);
> (gdb) bt
> #0 __ofono_sim_remove_session_watch (session=0x74656e, id=16) at
> src/sim.c:3616
> #1 0x000e368c in sim_fs_op_free (pointer=0x172498) at src/simfs.c:102
Are you running upstream? There's nothing relevant at that line now.
This should have been fixed in commit
a99c0be535410a92773ffdfbebb766bec66b66fe by the way.
It is not exactly the upstream
version but I've already applied this
patch and my changes compared to
the upstream version doesn't concern the SIM neither the driver's
disable function.
Looks like a double-free. I'll investigate deeper tomorrow.
Regards,
Gabriel
10:23 p.m.
Hi Denis,
I've been investigating for the reason of the SIGSEGV signal.
Valgrind tells me that I'm reading an already-freed sector.
I've added some debug information in:
- src/sim.c:sim_remove: see below
- src/simfs.c:sim_fs_context_free: freed sim_context
- src/simfs.c:sim_fs_op_free: freed sim_fs_op and sim_fs_op::context pointer
Here is the sim_remove function called when disabling the gemalto's plugin
static void sim_remove(struct ofono_atom *atom)
{
struct ofono_sim *sim = __ofono_atom_get_data(atom);
DBG("atom: %p", atom);
if (sim == NULL)
return;
if (sim->driver != NULL && sim->driver->remove != NULL)
sim->driver->remove(sim);
sim_free_state(sim);
DBG("simfs"); // added
sim_fs_free(sim->simfs);
sim->simfs = NULL;
DBG("simfs_isim"); // added
sim_fs_free(sim->simfs_isim);
sim->simfs_isim = NULL;
g_free(sim);
}
I've launched Ofono with valgrind (I've added comments to the logs):
ofonod[30124]: src/sim.c:sim_remove() atom: 0x4e81d88
ofonod[30124]: src/simfs.c:sim_fs_context_free() 0x4e868f8
ofonod[30124]: src/simfs.c:sim_fs_context_free() 0x4ef6a08
ofonod[30124]: src/simfs.c:sim_fs_op_free() 0x4ef6a08, 0x3c, context:
0x4eb7fb0
ofonod[30124]: src/simfs.c:sim_fs_context_free() 0x4ef6b38
ofonod[30124]: src/simfs.c:sim_fs_op_free() 0x4ef6b38, 0x3c, context:
0x4eb7fb0
ofonod[30124]: src/simfs.c:sim_fs_context_free() **0x4eb7fb0** // ->
This is freed in sim_free_state(sim);
ofonod[30124]: src/sim.c:sim_remove() simfs // -> Going in
sim_fs_free(sim->simfs);
ofonod[30124]: src/simfs.c:sim_fs_free() 0x4e845a8
ofonod[30124]: src/simfs.c:sim_fs_op_free() 0x4ef67a8, 0x3c, context:
**0x4eb7fb0** // Already freed
==30124== Invalid read of size 4
==30124== at 0xE39A0: sim_fs_op_free (simfs.c:99) // -> line: struct
sim_fs *fs = node->context->fs;
==30124== by 0x48B0303: g_queue_foreach (in
/usr/lib/libglib-2.0.so.0.3800.2)
==30124== Address **0x4eb7fb0** is 0 bytes inside a block of size 8 free'd
==30124== at 0x4835760: free (in
/usr/lib/valgrind/vgpreload_memcheck-arm-linux.so)
==30124==
ofonod[30124]: src/sim.c:sim_remove() simfs_isim
ofonod[30124]: src/simfs.c:sim_fs_free() (nil)
What do you think about this?
Best regards,
Gabriel
1634
days inactive
1637
days old
5 comments
2 participants
participants (2)
-
Denis Kenzior -
Gabriel Lucas