aethercast service crash in WpaSupplicantMessage::Read

Bug #1524996 reported by Tony Espy
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
aethercast
Fix Released
Critical
Thomas Voß

Bug Description

Tested aethercast today on krillin ( rc-proposed, #200 ).

First, it's taken me a little while to figure out how to use the Miracast feature on my TV ( a LG SmartTV ). I had been using Settings::Network::WiFiDirect to enable it, but turns out the correct way to enable screen sharing is to use the ScreenShare app ( I'm still getting used to running Apps on my TV ). So for this bug, I had only enabled WiFiDirect...

Also, one of my neighbors has a ROKU which apparently supports WiFiDirect ( but Display ), and I think the crash may happen when my krillin first sees this device. The device shows up as DIRECT-roku-BCA62B on my Nexus5.

When I initiate a scan, the service crashes with the following backtrace:

root@ubuntu-phablet:~# gdb /usr/sbin/aethercast
GNU gdb (Ubuntu 7.9-1ubuntu1) 7.9
Copyright (C) 2015 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "arm-linux-gnueabihf".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/aethercast...(no debugging symbols found)...done.
(gdb) r
Starting program: /usr/sbin/aethercast
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/arm-linux-gnueabihf/libthread_db.so.1".
[II 2015-12-10 21:24:36] [miracastserviceadapter.cpp:133@OnNameAcquired] Registered bus name org.wds
[DD 2015-12-10 21:24:36] [wpasupplicantnetworkmanager.cpp:493@ConnectSupplicant] Connecting supplicant on /var/run/p2p0_supplicant/p2p0
[II 2015-12-10 21:25:34] [miracastserviceadapter.cpp:144@OnHandleScan] Scanning for remote devices
[EE 2015-12-10 21:25:34] g_object_unref: assertion 'G_IS_OBJECT (object)' failed
[WW 2015-12-10 21:25:34] [wpasupplicantnetworkmanager.cpp:156@OnUnsolicitedResponse] unhandled supplicant event: <3>CTRL-EVENT-BSS-ADDED 0 b8:3e:59:df:37:0d
[New Thread 0xb5eff3e0 (LWP 16206)]
[New Thread 0xb681b3e0 (LWP 16203)]

Program received signal SIGSEGV, Segmentation fault.
0xb6b34b62 in std::basic_stringstream<char, std::char_traits<char>, std::allocator<char> >::basic_stringstream(std::string const&, std::_Ios_Openmode) ()
   from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
(gdb) bt
#0 0xb6b34b62 in std::basic_stringstream<char, std::char_traits<char>, std::allocator<char> >::basic_stringstream(std::string const&, std::_Ios_Openmode) ()
   from /usr/lib/arm-linux-gnueabihf/libstdc++.so.6
#1 0x0005d9f0 in WpaSupplicantMessage const& WpaSupplicantMessage::Read<std::string, std::string&, Named<std::string>&>(std::string&, std::string&, Named<std::string>&) const ()
#2 0x00059ef2 in WpaSupplicantNetworkManager::OnP2pDeviceFound(WpaSupplicantMessage&) ()
#3 0x0005b534 in WpaSupplicantNetworkManager::OnUnsolicitedResponse(WpaSupplicantMessage) ()
#4 0x0007c54c in WpaSupplicantCommandQueue::HandleMessage(WpaSupplicantMessage) ()
#5 0x0005911a in WpaSupplicantNetworkManager::OnIncomingMessages(_GIOChannel*, GIOCondition, void*) ()
#6 0xb6e14e90 in g_main_context_dispatch ()
   from /lib/arm-linux-gnueabihf/libglib-2.0.so.0
#7 0xb6e15114 in ?? () from /lib/arm-linux-gnueabihf/libglib-2.0.so.0
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

Related branches

Tony Espy (awe)
description: updated
Simon Fels (morphis)
Changed in aethercast:
assignee: nobody → Thomas Voß (thomas-voss)
status: New → Triaged
importance: Undecided → Critical
Revision history for this message
Tony Espy (awe) wrote :

Here's an updated backtrace produced after installing the debug symbols.

It took me a few tries to reproduce, but the process is the same as originally described. Stop the default job, and run it under gdb, then enter the scan command using aethercastctl. This failed for me the first time after I installed the debug symbols, so I rebooted and tried again and was able to produce the crash.

Let me know if you need anything else.

Changed in aethercast:
status: Triaged → In Progress
Revision history for this message
PS Jenkins bot (ps-jenkins) wrote :

Fix committed into lp:aethercast at revision 116, scheduled for release in aethercast, milestone Unknown

Changed in aethercast:
status: In Progress → Fix Committed
Revision history for this message
Simon Fels (morphis) wrote :

Fix landed in silo 0.

Changed in aethercast:
status: Fix Committed → Fix Released
Revision history for this message
Tony Espy (awe) wrote :

I'm not able to test, as aethercastctl now hangs after the latest update ( see bug #1526114 for details ).

Revision history for this message
Tony Espy (awe) wrote :

Tested with aethercast version 0.1+15.04.20151215.1-0ubuntu1 on krillin ( rc-proposed, #202 ). Can't reproduce anymore.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.