Comment 10 for bug 927954

Revision history for this message
Pasha Orekhov (pashaorekhov) wrote :

Mathieu Trudel-Lapierre (mathieu-tl) you are extreme optimistic:

Feb 20 13:42:41 oak kernel: [23799.840389] usb_modeswitch_[32188]: segfault at 4beeb4 ip b76160d6 sp bff20ba0 error 4 in libc-2.17.so[b759c000+1ae000]
Feb 20 13:50:02 oak kernel: [24240.638396] usb_modeswitch_[32254]: segfault at 4b0eb4 ip b75fa0d6 sp bfbc0040 error 4 in libc-2.17.so[b7580000+1ae000]
Feb 20 13:50:15 oak kernel: [24253.583514] usb_modeswitch_[32269]: segfault at 227eb4 ip b760a0d6 sp bffeddb0 error 4 in libc-2.17.so[b7590000+1ae000]

ubuntu 13.10, 12.LTS
 huawei e171 (12d1/155b)
kernel 3.11.0-17-generic
usb-modem-manager 1.2.3+repack0

(gdb) bt (recompiled with -g)
#0 _IO_new_fclose (fp=0x392f68) at iofclose.c:49
#1 0x0804d670 in read_attrs (subsystem=0x8050334 "USB", dev_type=0x8052208 <usb>,
    attr_list=0x8052160 <usb_attrs>, dir=0x939a020 "/sys/bus/usb/devices/1-1")
    at usb_modeswitch_dispatcher.c:1717
#2 0x0804d794 in read_usb_attrs (dir=0x939a020 "/sys/bus/usb/devices/1-1", ifdir=0x0)
    at usb_modeswitch_dispatcher.c:1743
#3 0x0804961a in main (argc=4, argv=0xbf95f2c4) at usb_modeswitch_dispatcher.c:319

run diag:
   if ((rc = fopen(attr_path, "r")) != NULL) {
+ printf("f before =%p\n", rc);
    if (fgets(value, PATH_MAX, rc) != NULL) {
     dev_type[i]->value = strdup(rtrim(value));
    }
    else {
     dev_type[i]->value = 0;
    }
+ printf("f after =%p\n", rc);
    fclose(rc);
   }

run:
/home/opa/works/tst/vagon/huawei_e171/usb-modeswitch-1.2.3+repack0/usb_modeswitch_dispatcher --switch-mode /1-1:1.0 /lib/udev/usb_modeswitch
f before =0x9b66f68
f after =0x9b66f68
f before =0x9b66f68
f after =0x9b66f68
f before =0x9b66f68
f after =0xb66f68

Where is 9?

and fuck you Mathieu Trudel-Lapierre :
--- usb_modeswitch_dispatcher.c.orig 2014-02-20 15:08:44.665397121 +0700
+++ usb_modeswitch_dispatcher.c 2014-02-20 17:04:27.269572144 +0700
@@ -838,7 +838,7 @@
 {
     char* back = s + strlen(s);

- while(isspace(*--back));
+ while(back>=s && isspace(*--back));

     *(back+1) = '\0';

WTF: bus_id[strlen(bus_id)] = '\0';

Mathieu, please use php and never use c.