udev_device_get_subsystem() may return NULL if no subsystem could be
figured out by libudev. This might be due to OOM or if the device
disconnected between the udev_device_new() call and
udev_device_get_subsystem(). Therefore, we need to handle subsystem==NULL
safely.
Instead of testing for it in each helper, we treat subsystem==NULL as
empty subsystem in match_subsystem().
Backtrace of udev_enumerate with an input-device disconnecting in exactly
this time-frame:
(gdb) bt
#0 0x00007ffff569dc24 in strnlen () from /usr/lib/libc.so.6
#1 0x00007ffff56d9e04 in fnmatch@@GLIBC_2.2.5 () from /usr/lib/libc.so.6
#2 0x00007ffff5beb83d in match_subsystem (udev_enumerate=0x7a05f0, subsystem=0x0) at src/libudev/libudev-enumerate.c:727
#3 0x00007ffff5bebb30 in parent_add_child (enumerate=enumerate@entry=0x7a05f0, path=<optimized out>) at src/libudev/libudev-enumerate.c:834
#4 0x00007ffff5bebc3f in parent_crawl_children (enumerate=enumerate@entry=0x7a05f0, path=0x7a56b0 "/sys/devices/<shortened>/input/input97", maxdepth=maxdepth@entry=254) at src/libudev/libudev-enumerate.c:866
#5 0x00007ffff5bebc54 in parent_crawl_children (enumerate=enumerate@entry=0x7a05f0, path=0x79e8c0 "/sys/devices/<shortened>/input", maxdepth=maxdepth@entry=255) at src/libudev/libudev-enumerate.c:868
#6 0x00007ffff5bebc54 in parent_crawl_children (enumerate=enumerate@entry=0x7a05f0, path=path@entry=0x753190 "/sys/devices/<shortened>", maxdepth=maxdepth@entry=256) at src/libudev/libudev-enumerate.c:868
#7 0x00007ffff5bec7df in scan_devices_children (enumerate=0x7a05f0) at src/libudev/libudev-enumerate.c:882
#8 udev_enumerate_scan_devices (udev_enumerate=udev_enumerate@entry=0x7a05f0) at src/libudev/libudev-enumerate.c:919
#9 0x00007ffff5df8777 in <random_caller> () at some/file.c:181
We need to free udev-devices again if they don't match. Funny that no-one
noticed it yet since valgrind is quite verbose about it.
Fix it and free non-matching devices.
If a realloc() happens in syspath_add(), the move_later pointer could
point to an invalid memory region.
Let move_later store the array index, instead of the pointer to the
entry.
clang reports:
src/libudev/libudev-util.c:665:35: warning: cast from
"const unsigned char *" to "unsigned int *" increases required alignment
from 1 to 4 [-Wcast-align]
Clang 3.1 warned that "attribute 'packed' is ignored". This stems from
placing "__attribute__ ((packed))" at the start of structure
declarations when common practice is to place it at the end.
Signed-off-by: Richard Yao <ryao@gentoo.org>
On Thu, Nov 15, 2012 at 5:05 PM, Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> wrote:
> Something like this appeared with latest git:
>
> Nov 15 16:55:46 fedora-15 systemd-udevd[334]: worker [364] terminated by signal 11 (Segmentation fault)
> Nov 15 16:55:46 fedora-15 [387]: Process 364 (systemd-udevd) dumped core.
> Nov 15 16:55:46 fedora-15 systemd-udevd[334]: worker [364] failed while handling '/devices/virtual/net/lo'
> Nov 15 16:55:46 fedora-15 systemd-udevd[334]: worker [360] terminated by signal 11 (Segmentation fault)
> Nov 15 16:55:46 fedora-15 systemd-udevd[334]: worker [360] failed while handling '/devices/pci0000:00/0000:00:03.0/virtio0/net
> Nov 15 16:55:46 fedora-15 [389]: Process 360 (systemd-udevd) dumped core.
>
> Core was generated by usr/lib/systemd/systemd-udevd'.
> Program terminated with signal 11, Segmentation fault.
> #0 0x0000000000423c87 in udev_hwdb_get_properties_list_entry (hwdb=0x0, modalias=0x7fffbcd155f0
There is no apparent justification for using util_strscpyl
on the filename since it's a plain hardcoded path.
Older versions used:
util_strscpyl(filename, sizeof(filename), SOME_DIR, "/queue.bin", NULL);
and when changed nobody bothered to simplify it.
Kay Sievers
David Herrmann
Harald Hoyer
Thomas Hindoe Paaboel Andersen
Zbigniew Jędrzejewski-Szmek
Michael Biebl
Jan Engelhardt
Hannes Reinecke
Richard Yao
Michael Terry
Eric Benoit
Mauro Dreissig
Václav Pavlín
Lennart Poettering
Arvydas Sidorenko