Occasional segfaults on MIPSBE device

[adde88]

I'm using a WiFi Pineapple TETRA/NANO (MIPS-BE) (latest openwrt-19.07)

Compiling latest pixiewps with CPPFLAGS=-DPIXIE_BIN=\"pixie-core\" like @rofl0r wrote in his commit: a6b3fa514c0c9a6ad5dc931040218451c64ce150 I also renamed pixiewps to pixie-core, and pixiewrapper renamed to pixiewps.

I get some occasional segfaults when running pixiewps (pixiewrapper) with the latest -u parameter, and i'm suspecting it's not working as intended, atleast on this device. Running valgrind on pixiewps gives me this:

==17223== Conditional jump or move depends on uninitialised value(s)
==17223==    at 0x407366C: ??? (in /lib/libc.so)
==17223==    by 0x408492C: ??? (in /lib/libc.so)
==17223==
==17223== Conditional jump or move depends on uninitialised value(s)
==17223==    at 0x4072AD8: ??? (in /lib/libc.so)
==17223==    by 0x40730A0: ??? (in /lib/libc.so)
==17223==
==17223== Conditional jump or move depends on uninitialised value(s)
==17223==    at 0x407366C: ??? (in /lib/libc.so)
==17223==    by 0x4007D0: main (pixiewrapper.c:125)
==17223==
==17223== Conditional jump or move depends on uninitialised value(s)
==17223==    at 0x407364C: ??? (in /lib/libc.so)
==17223==    by 0x4007D0: main (pixiewrapper.c:125)
==17223==

==17223== Conditional jump or move depends on uninitialised value(s)
==17223==    at 0x4071B3C: ??? (in /lib/libc.so)
==17223==    by 0x40739A8: ??? (in /lib/libc.so)

[rofl0r]

do you have a backtrace of the segfault ?

[adde88]

Sure. It wasn't that detailed as i had hoped for, i'll see if i can do anything about that

Reading symbols from /usr/bin/pixiewps...
(No debugging symbols found in /usr/bin/pixiewps)
(gdb)
(gdb)  r
Starting program: /usr/bin/pixiewps -u 71602176443 -e 7a0abd23b7e975907cc9d877bac7491e7bd8e2457e55e3bf5a3c05fb0bfdf4a15f5a7714b21c8a10da6b849634511ee97094c82aad2ffb6f1ebee30161ad33004d6154088d46f16d7729bb74da15928c3ad6d9e3ee7816d287e58a7dc84b3002cec775f514380e4fbd1cb1fb874fe26ff037d6c3191e28a3a7164ecd625755dc7dbaf417ec4c3ef793d423688b9c678b7b8fcc551def74afe7abfe5d3b8d57dc70bdea5d82a5e1ac57ed8fc8623a473260882ebd64c6129684d7aea822feecfd -s 19852cd0ae3cd3cd0747dd6f287febbe517eac56cb526c71c658db0f3e56bbad -z ffd26e39d3fec81b43923740d15af42f728f1769763326566da5eb8c257c0a4e -a e30b22a1d52de9861e085173006143c6d1ec912f1b2608fbc5661cac0d94efb4 -n 656892df5f40f9a76324ae2feb2f9cba -r cc38248ba462787b31102d1cd9cbe21c4a9808451e31eb99da8be41cf9e4020f16ccab9423a3efe597ec7c39a6e38be3734c4c1a7c58bca0c31e79ea99839d6babd10dfdd1045ced7f8c00b3172402d2f7f8f03908514594b66099b57ad067ef7b1b681cc5de8205c2e25d11d3482a9ed1c1738e7f8891feefb23a0cb730f533ed90192aaa83a3c6dc687f16f46184c300e03745f141a03649965185ae8cdc23eee5c4dd8921f1392970b368868c45be09bd7ad2787310d6379389c32d6d76ae
warning: Unable to find dynamic linker breakpoint function.
GDB will be unable to debug shared library initializers
and track explicitly loaded dynamic code.

Program received signal SIGSEGV, Segmentation fault.
0x77fc8af0 in ?? ()
(gdb) bt
#0  0x77fc8af0 in ?? ()
warning: GDB can't find the start of the function at 0x77fc8af0.

    GDB is unable to find the start of the function at 0x77fc8af0
and thus can't determine the size of that function's stack frame.
This means that GDB may be unable to access that stack frame, or
the frames below it.
    This problem is most likely caused by an invalid program counter or
stack pointer.
    However, if you think GDB should simply search farther back
from 0x77fc8af0 for code which looks like the beginning of a
function, you can increase the range of the search using the `set
heuristic-fence-post' command.

[adde88]

I think i got a more detailed backtrace this time.

(gdb) run
The program being debugged has been started already.
Start it from the beginning? (y or n) y
Starting program: /home/openwrt/build_dir/target-mips_24kc_musl/pixiewps-custom-1.4.2/pixiewps -u 71602176443  -e 7a0abd23b7e975907cc9d877bac7491e7bd8e2457e55e3bf5a3c05fb0bfdf4a15f5a7714b21c8a10da6b849634511ee97094c82aad2ffb6f1ebee30161ad33004d6154088d46f16d7729bb74da15928c3ad6d9e3ee7816d287e58a7dc84b3002cec775f514380e4fbd1cb1fb874fe26ff037d6c3191e28a3a7164ecd625755dc7dbaf417ec4c3ef793d423688b9c678b7b8fcc551def74afe7abfe5d3b8d57dc70bdea5d82a5e1ac57ed8fc8623a473260882ebd64c6129684d7aea822feecfd  -s 19852cd0ae3cd3cd0747dd6f287febbe517eac56cb526c71c658db0f3e56bbad  -z ffd26e39d3fec81b43923740d15af42f728f1769763326566da5eb8c257c0a4e  -a e30b22a1d52de9861e085173006143c6d1ec912f1b2608fbc5661cac0d94efb4  -n 656892df5f40f9a76324ae2feb2f9cba  -r cc38248ba462787b31102d1cd9cbe21c4a9808451e31eb99da8be41cf9e4020f16ccab9423a3efe597ec7c39a6e38be3734c4c1a7c58bca0c31e79ea99839d6babd10dfdd1045ced7f8c00b3172402d2f7f8f03908514594b66099b57ad067ef7b1b681cc5de8205c2e25d11d3482a9ed1c1738e7f8891feefb23a0cb730f533ed90192aaa83a3c6dc687f16f46184c300e03745f141a03649965185ae8cdc23eee5c4dd8921f1392970b368868c45be09bd7ad2787310d6379389c32d6d76ae

Program received signal SIGSEGV, Segmentation fault.
0x77fc8af0 in sift (head=0x7fff9780 "", width=1668248165, cmp=0x7,
    pshift=-16843009, lp=0x0) at src/stdlib/qsort.c:92
92      {
(gdb) bt
#0  0x77fc8af0 in sift (head=0x7fff9780 "", width=1668248165, cmp=0x7,
    pshift=-16843009, lp=0x0) at src/stdlib/qsort.c:92
#1  0x77fc90a8 in qsort (base=<optimized out>, nel=<optimized out>,
    width=2147461332, cmp=0x77fffd9c) at src/stdlib/qsort.c:207
#2  0x00000000 in ?? ()
Backtrace stopped: frame did not save the PC

[adde88]

I got a couple of warnings during compilation, could they perhaps be related?

src/pixiewrapper.c: In function 'main':
src/pixiewrapper.c:121:29: warning: character constant too long for its type
  if(!pixie_bin) pixie_bin = PIXIE_BIN;
                             ^~~~~~~~~
src/pixiewrapper.c:121:27: warning: assignment makes pointer from integer without a cast [-Wint-conversion]
  if(!pixie_bin) pixie_bin = PIXIE_BIN;

[rofl0r]

I got a couple of warnings during compilation, could they perhaps be related?

most likely. seems you passed PIXIE_BIN macro as a number rather than as a string

[adde88]

Yeah, i just figured it out. Seems i've been passing it wrong. I'll close this. Btw, INSANE speed improvements! Usually it takes this device 8 seconds to get the key.

[*] Time taken: 1 s 939 ms