[BusyBox] Busybox' "sh" shell on PowerPC

[Erik Andersen]

On Wed Mar 28, 2001 at 11:59:02AM +0200, Michael Shmulevich wrote:
> Hello,
> 
> I am seeing weird problems with "sh" on PowerPC platform.
> The executable is dynamically linked against glibc 2.1.3, process
> -/bin/sh is run from inittab.
> 
> Problems:
> 1. when passing empty command like
> ~ # <Enter>
> the shell dies with segmentation fault. I have tracked the problem to 
> the point of sh.c line 1785:
> 
>            {
>                free(command);
>                command = (char *) xcalloc(BUFSIZ, sizeof(char));
>                next_command = NULL;
>            }
> 
> free() does the segmentation. command is not NULL, it was allocated, was 
> not free()'d before but still, doing free() causes segmentation.
> Anyway, why we want to free() and then allocate again with exactly the 
> same size?

Oddly enough I have now been able to reproduce this problem on 
a powerpc box.

    [andersee at voltaire busybox]$ dpkg -l gcc libc6 | tail -2
    ii  gcc            2.95.3-5       The GNU C compiler.
    ii  libc6          2.2.2-1        GNU C Library: Shared libraries and Timezone
    [andersee at voltaire busybox]$ gdb ./busybox
    [--------------snip------------------]
    BusyBox v0.51pre (2001.04.03-21:18+0000) Built-in shell (lash)
    Enter 'help' for a list of built-in commands.

    /home/andersee/busybox $ lkj
    sh: lkj: No such file or directory
    /home/andersee/busybox $ lkjlkj
    sh: lkjlkj: No such file or directory
    /home/andersee/busybox $

    Program received signal SIGSEGV, Segmentation fault.
    0xff36ac0 in free () from /lib/libc.so.6
    (gdb) up
    #1  0xff36984 in free () from /lib/libc.so.6
    (gdb)
    #2  0x100242ac in busy_loop (input=0xffde778) at sh.c:1807
    1807                                    free(command);
    (gdb) p command
    $1 = 0x1004c8d0 ""
    (gdb) p *command
    $2 = 0 '\000'

Hmm.  Nothing wrong looking there.  Very odd. 

<sound of much debugging>

Well, dmalloc isn't helping at all.  I don't see anything wrong.
Sigh.  Trying electric-fence now.

<sound of more debugging>

Ah-ha!  I can now even reproduce it on x86 too!

    [andersen at slag busybox]$ cat /proc/cpuinfo  | grep -C2 name
    cpu family      : 6
    model           : 2
    model name      : AMD Athlon(tm) Processor
    stepping        : 2
    cpu MHz         : 704.943

    [andersen at slag busybox]$ gdb -n ./busybox
    [--------------snip------------------]
    BusyBox v0.51pre (2001.04.03-22:30+0000) Built-in shell (lash)
    Enter 'help' for a list of built-in commands.


      Electric Fence 2.0.5 Copyright (C) 1987-1998 Bruce Perens.
    /home/andersen/CVS/busybox $ lkjlkj
    sh: lkjlkj: No such file or directory
    /home/andersen/CVS/busybox $ lkjlkj
    sh: lkjlkj: No such file or directory
    /home/andersen/CVS/busybox $

    Program received signal SIGSEGV, Segmentation fault.
    0x806c880 in trim (s=0x400fd000 "") at libbb/trim.c:37
    37              while (isspace(s[strlen(s)-1]))
    (gdb) p strlen(s)
    $1 = 0

Eureka!  A real live bug!  Many thanks to the powerpc folks for 
helping us find it!  Fixing it now in CVS.

I think we are now ready for a bug-fix release.

 -Erik

--
Erik B. Andersen   email:  andersen at lineo.com
--This message was written using 73% post-consumer electrons--