Attachment 1473502 Details for Bug 1612603 – File: backtrace

File: backtrace

backtrace (text/plain), 8.57 KB, created by Ondrej Svetlik on 2018-08-05 20:16:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ondrej Svetlik

Created: 2018-08-05 20:16:18 UTC

Size: 8.57 KB

patch

obsolete

>[New LWP 948]
>[Thread debugging using libthread_db enabled]
>Using host libthread_db library "/lib64/libthread_db.so.1".
>Core was generated by `/usr/libexec/bluetooth/bluetoothd'.
>Program terminated with signal SIGSEGV, Segmentation fault.
>#0  0x00005602a6197a57 in btd_device_get_service (dev=dev@entry=0x5602a7033c00, remote_uuid=remote_uuid@entry=0x5602a61c1c68 "0000110c-0000-1000-8000-00805f9b34fb") at src/device.c:6443
>
>Thread 1 (Thread 0x7f60efe23540 (LWP 948)):
>#0  0x00005602a6197a57 in btd_device_get_service (dev=dev@entry=0x5602a7033c00, remote_uuid=remote_uuid@entry=0x5602a61c1c68 "0000110c-0000-1000-8000-00805f9b34fb") at src/device.c:6443
>        service = 0x5602a7033b20
>        p = 0x0
>        l = 0x5602a702c190
>#1  0x00005602a612daca in source_cb (new_state=BTD_SERVICE_STATE_UNAVAILABLE, old_state=BTD_SERVICE_STATE_DISCONNECTED, service=0x5602a704cfc0) at plugins/policy.c:357
>        dev = 0x5602a7033c00
>        data = <optimized out>
>        target = <optimized out>
>        dev = <optimized out>
>        data = <optimized out>
>        target = <optimized out>
>        err = <optimized out>
>#2  service_cb (service=0x5602a704cfc0, old_state=BTD_SERVICE_STATE_DISCONNECTED, new_state=BTD_SERVICE_STATE_UNAVAILABLE, user_data=<optimized out>) at plugins/policy.c:613
>        profile = 0x5602a64112e0 <a2dp_source_profile>
>        reconnect = <optimized out>
>        __func__ = "service_cb"
>#3  0x00005602a6188852 in change_state (service=service@entry=0x5602a704cfc0, state=state@entry=BTD_SERVICE_STATE_UNAVAILABLE, err=err@entry=0) at src/service.c:109
>        cb = <optimized out>
>        old = BTD_SERVICE_STATE_DISCONNECTED
>        addr = "78:00:9E:EE:BF:F1"
>        l = 0x5602a701a200
>        __func__ = "change_state"
>#4  0x00005602a6188b63 in service_remove (service=0x5602a704cfc0) at src/service.c:175
>No locals.
>#5  0x00005602a619674a in device_remove (device=0x5602a7033c00, remove_stored=0) at src/device.c:4157
>        service = 0x5602a704cfc0
>        __func__ = "device_remove"
>#6  0x00005602a617f62a in adapter_remove (adapter=adapter@entry=0x5602a7020570) at src/adapter.c:5757
>        l = 0x5602a701a4b0
>        db = <optimized out>
>        __func__ = "adapter_remove"
>#7  0x00005602a6182897 in adapter_unregister (adapter=0x5602a7020570) at src/adapter.c:8064
>        __func__ = "adapter_unregister"
>        __btd_debug_desc = {file = 0x5602a61ce40d "src/adapter.c", flags = 0}
>        new_default = <optimized out>
>#8  index_removed (index=<optimized out>, length=<optimized out>, param=<optimized out>, user_data=<optimized out>) at src/adapter.c:8777
>        adapter = 0x5602a7020570
>        __func__ = "index_removed"
>#9  0x00005602a61b03c9 in queue_foreach (queue=0x5602a7018140, function=function@entry=0x5602a61b1070 <notify_handler>, user_data=user_data@entry=0x7ffd62be1a20) at src/shared/queue.c:220
>        next = 0x5602a7031d60
>        entry = <optimized out>
>#10 0x00005602a61b1cf1 in process_notify (param=<optimized out>, length=0, index=<optimized out>, event=<optimized out>, mgmt=0x5602a700fa00) at src/shared/mgmt.c:304
>        match = {event = 5, index = 0, length = 0, param = 0x5602a700fdf6}
>        match = <optimized out>
>#11 can_read_data (io=<optimized out>, user_data=0x5602a700fa00) at src/shared/mgmt.c:370
>        mgmt = 0x5602a700fa00
>        hdr = <optimized out>
>        cc = <optimized out>
>        cs = <optimized out>
>        bytes_read = <optimized out>
>        opcode = <optimized out>
>        event = <optimized out>
>        index = <optimized out>
>        length = 0
>#12 0x00005602a61bf2e9 in watch_callback (channel=<optimized out>, cond=<optimized out>, user_data=<optimized out>) at src/shared/io-glib.c:170
>        watch = <optimized out>
>        result = <optimized out>
>        destroy = <optimized out>
>#13 0x00007f60ef9578ad in g_main_context_dispatch () from /lib64/libglib-2.0.so.0
>No symbol table info available.
>#14 0x00007f60ef957c78 in ?? () from /lib64/libglib-2.0.so.0
>No symbol table info available.
>#15 0x00007f60ef957fa2 in g_main_loop_run () from /lib64/libglib-2.0.so.0
>No symbol table info available.
>#16 0x00005602a612b882 in main (argc=<optimized out>, argv=<optimized out>) at src/main.c:781
>        context = <optimized out>
>        err = 0x0
>        sdp_flags = <optimized out>
>        gdbus_flags = <optimized out>
>        signal = 1
>        watchdog = 0
>        watchdog_usec = <optimized out>
>        __func__ = "main"
>From                To                  Syms Read   Shared Object Library
>0x00007f60ef9260d0  0x00007f60ef9a134e  Yes (*)     /lib64/libglib-2.0.so.0
>0x00007f60ef6c7a90  0x00007f60ef6f41c5  No          /lib64/libdbus-1.so.3
>0x00007f60ef4b5ee0  0x00007f60ef4b6bbe  Yes         /lib64/libdl.so.2
>0x00007f60ef2af210  0x00007f60ef2b247c  Yes         /lib64/librt.so.1
>0x00007f60eef0f340  0x00007f60ef05625f  Yes         /lib64/libc.so.6
>0x00007f60eec7e660  0x00007f60eecceb86  Yes (*)     /lib64/libpcre.so.1
>0x00007f60eea63be0  0x00007f60eea71801  Yes         /lib64/libpthread.so.0
>0x00007f60ee7d0150  0x00007f60ee8349d9  Yes (*)     /lib64/libsystemd.so.0
>0x00007f60efc24f60  0x00007f60efc41910  Yes         /lib64/ld-linux-x86-64.so.2
>0x00007f60ee59d0b0  0x00007f60ee5b3f66  Yes         /lib64/liblzma.so.5
>0x00007f60ee384fd0  0x00007f60ee3963db  No          /lib64/liblz4.so.1
>0x00007f60ee17f5b0  0x00007f60ee180e8f  Yes         /lib64/libcap.so.2
>0x00007f60edf30ee0  0x00007f60edf6825e  Yes (*)     /lib64/libmount.so.1
>0x00007f60edc145c0  0x00007f60edce1bfc  Yes (*)     /lib64/libgcrypt.so.20
>0x00007f60ed9f3ad0  0x00007f60eda04705  Yes (*)     /lib64/libgcc_s.so.1
>0x00007f60ed7aa6f0  0x00007f60ed7db27e  Yes (*)     /lib64/libblkid.so.1
>0x00007f60ed59a740  0x00007f60ed59e171  Yes (*)     /lib64/libuuid.so.1
>0x00007f60ed376df0  0x00007f60ed38e93f  Yes         /lib64/libselinux.so.1
>0x00007f60ed1541e0  0x00007f60ed1657ee  Yes         /lib64/libgpg-error.so.0
>0x00007f60eced2160  0x00007f60ecf2ccb3  Yes (*)     /lib64/libpcre2-8.so.0
>0x00007f60eccccb10  0x00007f60ecccd762  Yes         /usr/lib64/bluetooth/plugins/sixaxis.so
>0x00007f60ecaa8e30  0x00007f60ecabfd61  Yes (*)     /lib64/libudev.so.1
>(*): Shared library is missing debugging information.
>$1 = 0x0
>$2 = 0x0
>rax            0x0	0
>rbx            0x5602a702c190	94569391899024
>rcx            0x0	0
>rdx            0x30	48
>rsi            0x5602a61c1c68	94569376783464
>rdi            0x5602a7033b20	94569391930144
>rbp            0x5602a7033b20	0x5602a7033b20
>rsp            0x7ffd62be18e0	0x7ffd62be18e0
>r8             0x0	0
>r9             0x7ffd62be12c0	140726260077248
>r10            0x0	0
>r11            0x7ffd62be16a6	140726260078246
>r12            0x5602a61c1c68	94569376783464
>r13            0x5602a7033c00	94569391930368
>r14            0x1	1
>r15            0x5602a70181a0	94569391817120
>rip            0x5602a6197a57	0x5602a6197a57 <btd_device_get_service+55>
>eflags         0x10206	[ PF IF RF ]
>cs             0x33	51
>ss             0x2b	43
>ds             0x0	0
>es             0x0	0
>fs             0x0	0
>gs             0x0	0
>Dump of assembler code for function btd_device_get_service:
>   0x00005602a6197a20 <+0>:	endbr64 
>   0x00005602a6197a24 <+4>:	push   %r12
>   0x00005602a6197a26 <+6>:	push   %rbp
>   0x00005602a6197a27 <+7>:	push   %rbx
>   0x00005602a6197a28 <+8>:	mov    0x178(%rdi),%rbx
>   0x00005602a6197a2f <+15>:	test   %rbx,%rbx
>   0x00005602a6197a32 <+18>:	je     0x5602a6197a70 <btd_device_get_service+80>
>   0x00005602a6197a34 <+20>:	mov    %rsi,%r12
>   0x00005602a6197a37 <+23>:	jmp    0x5602a6197a49 <btd_device_get_service+41>
>   0x00005602a6197a39 <+25>:	nopl   0x0(%rax)
>   0x00005602a6197a40 <+32>:	mov    0x8(%rbx),%rbx
>   0x00005602a6197a44 <+36>:	test   %rbx,%rbx
>   0x00005602a6197a47 <+39>:	je     0x5602a6197a70 <btd_device_get_service+80>
>   0x00005602a6197a49 <+41>:	mov    (%rbx),%rbp
>   0x00005602a6197a4c <+44>:	mov    %rbp,%rdi
>   0x00005602a6197a4f <+47>:	callq  0x5602a6188dd0 <btd_service_get_profile>
>   0x00005602a6197a54 <+52>:	mov    %r12,%rsi
>=> 0x00005602a6197a57 <+55>:	mov    0x18(%rax),%rdi
>   0x00005602a6197a5b <+59>:	callq  0x5602a612aeb0 <g_str_equal@plt>
>   0x00005602a6197a60 <+64>:	test   %eax,%eax
>   0x00005602a6197a62 <+66>:	je     0x5602a6197a40 <btd_device_get_service+32>
>   0x00005602a6197a64 <+68>:	mov    %rbp,%rax
>   0x00005602a6197a67 <+71>:	pop    %rbx
>   0x00005602a6197a68 <+72>:	pop    %rbp
>   0x00005602a6197a69 <+73>:	pop    %r12
>   0x00005602a6197a6b <+75>:	retq   
>   0x00005602a6197a6c <+76>:	nopl   0x0(%rax)
>   0x00005602a6197a70 <+80>:	xor    %ebp,%ebp
>   0x00005602a6197a72 <+82>:	pop    %rbx
>   0x00005602a6197a73 <+83>:	mov    %rbp,%rax
>   0x00005602a6197a76 <+86>:	pop    %rbp
>   0x00005602a6197a77 <+87>:	pop    %r12
>   0x00005602a6197a79 <+89>:	retq   
>End of assembler dump.
>== EXPLOITABLE ==

Actions: View

Attachments on bug 1612603: 1473502 | 1473503 | 1473504 | 1473505 | 1473506 | 1473507 | 1473508 | 1473509 | 1473510 | 1473511 | 1473512 | 1473513 | 1473514