On Sun, Feb 13, 2022 at 01:12:34PM +0300, Mikhail wrote:
> Running this command on the latest snapshot produces core file for me:
>
> doas tcpdump -i urtwn0 proto ip6
>
> Core details:
>
> misha:/home/misha:3959$ doas lldb --core tcpdump.core tcpdump
> (lldb) target create "tcpdump" --core "tcpdump.core"
> Core file '/home/misha/tcpdump.core' (x86_64) was loaded.
> (lldb) bt
> * thread #1, stop reason = signal SIGSEGV
> * frame #0: 0x000007b299d82607 libpcap.so.9.0`pcap_compile [inlined]
> freechunks at gencode.c:209:9
> frame #1: 0x000007b299d825c2 libpcap.so.9.0`pcap_compile(p=<unavailable>,
> program=<unavailable>, buf=<unavailable>, optimize=<unavailable>,
> mask=<unavailable>) at gencode.c:287:3
> frame #2: 0x000007aff4d7a74f tcpdump`___lldb_unnamed_symbol311 + 159
> frame #3: 0x000007aff4d783a6 tcpdump`___lldb_unnamed_symbol286 + 3510
> frame #4: 0x000007aff4d73f61 tcpdump`___lldb_unnamed_symbol259 + 97
> frame #5: 0x000007aff4d73b32 tcpdump`___lldb_unnamed_symbol253 + 290
>
> It looks like setjmp() call on gencode.c:286 returns "1", while the man
> page says it must return only "0".
I can see two problems:
1. setjump returning 1
2. freechunks() segfaulting.
Here I'll concentrate on 2), as I suspect 1) has a cause that is already in
the process of being diagnosed/fixed elsewhere.
The offensding statement is:
#0 0x0000002428da032c in freechunks () at /usr/src/lib/libpcap/gencode.c:209
209 free(membag[i].ptrs[j]);
(gdb) print membag
$1 = {{total = 0, slot = 0, ptrs = 0x0} <repeats 16 times>}
It looks like this happens when no allocation has happened at all.
The diff below fixes the core dump for me.
-Otto
Index: gencode.c
===================================================================
RCS file: /cvs/src/lib/libpcap/gencode.c,v
retrieving revision 1.59
diff -u -p -r1.59 gencode.c
--- gencode.c 5 Dec 2021 16:40:24 -0000 1.59
+++ gencode.c 13 Feb 2022 11:52:55 -0000
@@ -205,6 +205,8 @@ freechunks(void)
int i, j;
for (i = 0; i <= cur_membag; i++) {
+ if (membag[i].ptrs == NULL)
+ continue;
for (j = 0; j <= membag[i].slot; j++)
free(membag[i].ptrs[j]);
free(membag[i].ptrs);
