Bug#835070: vorbis-tools: ogg123 segfaults on playing ogg files

[Petter Reinholdtsen]

Control: tags -1 + patch

I created a draft patch to address this.  See the attached file.  Perhaps it 
should
be discussed with upstream?

See also https://bugs.debian.org/842796 >.
-- 
Happy hacking
Petter Reinholdtsen
Description: Fix locking issues reported by valgrind --tool=helgrind

 The ogg123 tool would segfault on machines with hardware backed POSIX
 mutexes when trying to unlock an unlocked lock.  This patch avoid the
 problem by changing the mutex-es used to resurcive mutexes and
 dropping the call to status_reset_output_lock() during exit which can
 trigger the segfault.  The real problem seem to be a thread holding
 the output_lock mutex can be killed without releasing.  Not sure how
 to address this.

 helgrind would also warn about execute_actions() reading and writing
 to memory without holding a lock that the other thread was holding
 when using that part of memory.  Adding a lock would deadlock the
 process as the actions tried to get the lock again.  Switching to
 recursive locks seem to solve this issue to.  I'm not sure if this is
 really needed.

Bug-Debian: https://bugs.debian.org/835070
Bug-Debian: https://bugs.debian.org/842796
Forwarded: no

Index: vorbis-tools/ogg123/buffer.c
===
--- vorbis-tools.orig/ogg123/buffer.c	2016-11-07 11:37:16.152652422 +
+++ vorbis-tools/ogg123/buffer.c	2016-11-07 11:37:16.148652377 +
@@ -250,15 +250,10 @@
   break;
 }
 
-/* Don't need to lock buffer while running actions since position
-   won't change.  We clear out any actions before we compute the
-   dequeue size so we don't consider actions that need to
-   run right now.  */
-execute_actions(buf, >actions, buf->position);
-
 LOCK_MUTEX(buf->mutex);
 
-/* Need to be locked while we check things. */
+execute_actions(buf, >actions, buf->position);
+
 write_amount = compute_dequeue_size(buf, buf->audio_chunk_size);
 
 UNLOCK_MUTEX(buf->mutex);
@@ -418,7 +413,10 @@
   buf->write_arg = arg;
 
   /* Setup pthread variables */
-  pthread_mutex_init(>mutex, NULL);
+  pthread_mutexattr_t mutexattr;
+  pthread_mutexattr_init();
+  pthread_mutexattr_settype(, PTHREAD_MUTEX_RECURSIVE);
+  pthread_mutex_init(>mutex, );
   pthread_cond_init(>write_cond, NULL);
   pthread_cond_init(>playback_cond, NULL);
 
@@ -453,7 +451,10 @@
   pthread_cond_destroy(>playback_cond);
 
   /* Reinit pthread variables */
-  pthread_mutex_init(>mutex, NULL);
+  pthread_mutexattr_t mutexattr;
+  pthread_mutexattr_init();
+  pthread_mutexattr_settype(, PTHREAD_MUTEX_RECURSIVE);
+  pthread_mutex_init(>mutex, );
   pthread_cond_init(>write_cond, NULL);
   pthread_cond_init(>playback_cond, NULL);
 
Index: vorbis-tools/ogg123/ogg123.c
===
--- vorbis-tools.orig/ogg123/ogg123.c	2016-11-07 11:37:16.152652422 +
+++ vorbis-tools/ogg123/ogg123.c	2016-11-07 11:37:16.148652377 +
@@ -743,7 +743,6 @@
 
   format->cleanup(decoder);
   transport->close(source);
-  status_reset_output_lock();  /* In case we were killed mid-output */
 
   status_message(1, _("Done."));
 
Index: vorbis-tools/ogg123/status.c
===
--- vorbis-tools.orig/ogg123/status.c	2016-11-07 11:37:16.152652422 +
+++ vorbis-tools/ogg123/status.c	2016-11-07 11:37:16.148652377 +
@@ -40,7 +40,7 @@
 int max_verbosity = 0;
 int exit_status = EXIT_SUCCESS;
 
-pthread_mutex_t output_lock = PTHREAD_MUTEX_INITIALIZER;
+pthread_mutex_t output_lock = PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
 
 
 /* --- Private functions -- */

Bug#835070: vorbis-tools: ogg123 segfaults on playing ogg files

[Petter Reinholdtsen]

Hm, I was reminded of this issue when I read
http://www.bityard.org/blog/2016/08/05/debugging_segfaults_open-iscsi_iscsiuio_intel_broadwell
 >.
Could it be the same issue?

-- 
Happy hacking
Petter Reinholdtsen

Bug#835070: vorbis-tools: ogg123 segfaults on playing ogg files

[Yevgeny Kosarzhevsky]

Thanks,

here is the output:

~$ valgrind ogg123 /usr/share/sounds/KDE-Im-Cant-Connect.ogg
==29668== Memcheck, a memory error detector
==29668== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==29668== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for copyright
info
==29668== Command: ogg123 /usr/share/sounds/KDE-Im-Cant-Connect.ogg
==29668==

Audio Device:   Advanced Linux Sound Architecture (ALSA) output

Playing: /usr/share/sounds/KDE-Im-Cant-Connect.ogg
Ogg Vorbis stream: 2 channel, 48000 Hz


Done.
==29668==
==29668== HEAP SUMMARY:
==29668== in use at exit: 194,333 bytes in 4,923 blocks
==29668==   total heap usage: 9,593 allocs, 4,670 frees, 1,022,831 bytes
allocated
==29668==
==29668== LEAK SUMMARY:
==29668==definitely lost: 0 bytes in 0 blocks
==29668==indirectly lost: 0 bytes in 0 blocks
==29668==  possibly lost: 151,952 bytes in 4,780 blocks
==29668==still reachable: 42,381 bytes in 143 blocks
==29668== suppressed: 0 bytes in 0 blocks
==29668== Rerun with —leak-check=full to see details of leaked memory
==29668==
==29668== For counts of detected and suppressed errors, rerun with: -v
==29668== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)

valgrind shows the same output you've posted, there is no segfault and no
sound.
Yes the ogg file is from kde-runtime-data, but I am getting the same result
with file from oxygen-sounds

I am using testing/sid packages on my system mostly. All packages related
to vorbis-tools are either from sid or from testing branches (see initial
report). Here are versions of packages which provide sound files:

~$ dpkg -l kde-runtime-data oxygen-sounds |grep ii
ii  kde-runtime-data 4:16.04.3-1  all  shared data files for the
KDE base runtime module
ii  oxygen-sounds4:5.7.0-1all  Sounds for the Oxygen
desktop theme

On 22 August 2016 at 09:24, Petter Reinholdtsen  wrote:

>
> Hi, and thank you for the crash report.
>
> [phao...@gmail.com]
> > Let me know if you need more information.
>
> Please try to reproduce the crash using valgrind.  Is the file you use
> to crash from the kde-runtime-data package?  Which version are you
> using?  Are you really using oldstable?
>
> I'm unable to reproduce the crash in Strech:
>
> % valgrind ogg123 /usr/share/sounds/KDE-Im-Cant-Connect.ogg
> ==12052== Memcheck, a memory error detector
> ==12052== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
> ==12052== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for
> copyright info
> ==12052== Command: ogg123 /usr/share/sounds/KDE-Im-Cant-Connect.ogg
> ==12052==
>
> Audio Device:   Advanced Linux Sound Architecture (ALSA) output
>
> Spiller: /usr/share/sounds/KDE-Im-Cant-Connect.ogg
> Ogg Vorbis stream: 2 channel, 48000 Hz
>
> Færdig.
> ==12052==
> ==12052== HEAP SUMMARY:
> ==12052== in use at exit: 275,582 bytes in 4,930 blocks
> ==12052==   total heap usage: 8,674 allocs, 3,744 frees, 1,077,314 bytes
> allocated
> ==12052==
> ==12052== LEAK SUMMARY:
> ==12052==definitely lost: 0 bytes in 0 blocks
> ==12052==indirectly lost: 0 bytes in 0 blocks
> ==12052==  possibly lost: 151,802 bytes in 4,776 blocks
> ==12052==still reachable: 123,780 bytes in 154 blocks
> ==12052== suppressed: 0 bytes in 0 blocks
> ==12052== Rerun with --leak-check=full to see details of leaked memory
> ==12052==
> ==12052== For counts of detected and suppressed errors, rerun with: -v
> ==12052== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
> %
>
> --
> Happy hacking
> Petter Reinholdtsen
>



-- 
Regards,
Yevgeny

Bug#835070: vorbis-tools: ogg123 segfaults on playing ogg files

[Petter Reinholdtsen]

Hi, and thank you for the crash report.

[phao...@gmail.com]
> Let me know if you need more information.

Please try to reproduce the crash using valgrind.  Is the file you use
to crash from the kde-runtime-data package?  Which version are you
using?  Are you really using oldstable?

I'm unable to reproduce the crash in Strech:

% valgrind ogg123 /usr/share/sounds/KDE-Im-Cant-Connect.ogg
==12052== Memcheck, a memory error detector
==12052== Copyright (C) 2002-2015, and GNU GPL'd, by Julian Seward et al.
==12052== Using Valgrind-3.12.0.SVN and LibVEX; rerun with -h for copyright info
==12052== Command: ogg123 /usr/share/sounds/KDE-Im-Cant-Connect.ogg
==12052== 

Audio Device:   Advanced Linux Sound Architecture (ALSA) output

Spiller: /usr/share/sounds/KDE-Im-Cant-Connect.ogg
Ogg Vorbis stream: 2 channel, 48000 Hz
  
Færdig.
==12052== 
==12052== HEAP SUMMARY:
==12052== in use at exit: 275,582 bytes in 4,930 blocks
==12052==   total heap usage: 8,674 allocs, 3,744 frees, 1,077,314 bytes 
allocated
==12052== 
==12052== LEAK SUMMARY:
==12052==definitely lost: 0 bytes in 0 blocks
==12052==indirectly lost: 0 bytes in 0 blocks
==12052==  possibly lost: 151,802 bytes in 4,776 blocks
==12052==still reachable: 123,780 bytes in 154 blocks
==12052== suppressed: 0 bytes in 0 blocks
==12052== Rerun with --leak-check=full to see details of leaked memory
==12052== 
==12052== For counts of detected and suppressed errors, rerun with: -v
==12052== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 0 from 0)
%

-- 
Happy hacking
Petter Reinholdtsen

Bug#835070: vorbis-tools: ogg123 segfaults on playing ogg files

[phaoost]

Package: vorbis-tools
Version: 1.4.0-10
Severity: important

Dear Maintainer,

I am getting segfault when trying to play ogg files. File is being played with 
no sound and then getting segfault.
Here is some output:

~$ gdb --args ogg123 /usr/share/sounds/KDE-Im-Cant-Connect.ogg 
GNU gdb (Debian 7.11.1-2) 7.11.1
Copyright (C) 2016 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
.
Find the GDB manual and other documentation resources online at:
.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ogg123...Reading symbols from 
/usr/lib/debug/.build-id/81/473fbaeae8f802994c1590b9238bfaec47375b.debug...done.
done.
(gdb) r
Starting program: /usr/bin/ogg123 /usr/share/sounds/KDE-Im-Cant-Connect.ogg
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Audio Device:   Advanced Linux Sound Architecture (ALSA) output

[New Thread 0x7fffee3fa700 (LWP 26989)]
Playing: /usr/share/sounds/KDE-Im-Cant-Connect.ogg
Ogg Vorbis stream: 2 channel, 48000 Hz
[Thread 0x7fffee3fa700 (LWP 26989) exited]0.4 kbps)  Output Buffer   0.0% (EOS) 

Thread 1 "ogg123" received signal SIGSEGV, Segmentation fault.
__lll_unlock_elision (lock=lock@entry=0x614c60 , private=0) at 
../sysdeps/unix/sysv/linux/x86/elision-unlock.c:29
29  ../sysdeps/unix/sysv/linux/x86/elision-unlock.c: No such file or 
directory.
(gdb) bt
#0  __lll_unlock_elision (lock=lock@entry=0x614c60 , private=0) at 
../sysdeps/unix/sysv/linux/x86/elision-unlock.c:29
#1  0x770f7187 in __pthread_mutex_unlock_usercnt 
(mutex=mutex@entry=0x614c60 , decr=decr@entry=1) at 
pthread_mutex_unlock.c:64
#2  0x770f720a in __GI___pthread_mutex_unlock 
(mutex=mutex@entry=0x614c60 ) at pthread_mutex_unlock.c:314
#3  0x0040a94a in status_reset_output_lock () at status.c:365
#4  0x00408eff in play (source_string=) at ogg123.c:746
#5  0x00403daa in main (argc=, argv=) at 
ogg123.c:496

Let me know if you need more information.

-- System Information:
Debian Release: 8.5
  APT prefers oldstable
  APT policy: (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.6.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: sysvinit (via /sbin/init)

Versions of packages vorbis-tools depends on:
ii  libao4   1.1.0-3
ii  libc62.23-4
ii  libcurl3-gnutls  7.50.1-1
ii  libflac8 1.3.1-4
ii  libogg0  1.3.2-1
ii  libspeex11.2~rc1.2-1
ii  libvorbis0a  1.3.5-3
ii  libvorbisenc21.3.5-3
ii  libvorbisfile3   1.3.5-3

vorbis-tools recommends no packages.

vorbis-tools suggests no packages.

-- no debconf information