Bug 503738 – net-misc/dhcpcd-6.3.0 crash on udev events

• Status: RESOLVED FIXED
• Product: Gentoo Linux

[Description Jason A. Donenfeld 2014-03-07 15:37:00 UTC]

1. Start dhcpcd.
2. Plug in android phone to USB with USB tethering enabled.
3. Observe the following crash in dhcpcd:

Program received signal SIGSEGV, Segmentation fault.
0x000000000000000e in ?? ()
(gdb) bt
#0  0x000000000000000e in ?? ()
#1  0x00007ffff7db0da4 in udev_handle_device (ctx=0x7fffffffe320) at udev.c:95
#2  0x00000000004308a7 in dev_handle_data (arg=0x7fffffffe320) at dev.c:153
#3  0x0000000000408bce in eloop_start (dctx=0x7fffffffe320) at eloop.c:398
#4  0x0000000000407440 in main (argc=3, argv=0x7fffffffe5d8) at dhcpcd.c:1504

1. Plug in android phone to USB with USB tethering enabled.
2. Start dhcpcd.
3. Unplug android phone from USB.
4. Observe the following crash in dhcpcd:

Program received signal SIGSEGV, Segmentation fault.
0x000000000000000e in ?? ()
(gdb) bt
#0  0x000000000000000e in ?? ()
#1  0x00007ffff7db0dd9 in udev_handle_device (ctx=0x7fffffffe320) at udev.c:97
#2  0x00000000004308a7 in dev_handle_data (arg=0x7fffffffe320) at dev.c:153
#3  0x0000000000408bce in eloop_start (dctx=0x7fffffffe320) at eloop.c:398
#4  0x0000000000407440 in main (argc=3, argv=0x7fffffffe5d8) at dhcpcd.c:1504



On those lines, 95 and 97, we have respectively:
dhcpcd->handle_interface(ctx, 1, ifname);
dhcpcd->handle_interface(ctx, -1, ifname);

So it seems fair to say that for whatever reason, the handle_interface function pointer is pointed to garbage.

Reproducible: Always

[Comment 1 Roy Marples 2014-03-08 08:51:11 UTC]

http://roy.marples.name/projects/dhcpcd/ci/5d85ba298d?sbs=0

[Comment 2 William Hubbs 2014-03-09 19:38:54 UTC]

This patch was not included in 6.3.1, so I added 6.3.1-r1 to the tree.