sh (pid 1081) segfaults for page address 00000000 at pc 00000000

[Cristian Ionescu-Idbohrn]

On Tue, 27 Jan 2009, Denys Vlasenko wrote:

> Need more info.

Ok.

> What is your .config?

Attached.

> Does it happen with the same .config on x86?

Difficult.  Detected the bug on an embedded system.  Complex chain of
applications and scripts forking wildly :)  Stopped the shell with a
sigsegv handler and gdb remote attached to the process.  Produced a
backtrace and sent it to the list.  Not useful?  Can I improve it?

I tried a few simple scenarios on x86.  Couldn't reproduce.

> What is a most minimal .config it happens on
> (switch off applets/options and try again, until you
> are sure any of the remaining options is needed
> for this bug to happen)

That's difficult too :(  The embedded system may get crippled to such
degree that nothing will work.  Best way to get to the bottom of this is
the hard way, I'm afraid.  The next thing on my list is to try to generate
a coredump and dig into that with gdb.  Painful, but doable.  Got a >200k
printf trace of shell evaluations though, if it's of any use, showing
something like this:

/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 16: [1086] evalcommand arg: /etc/conf.d/udhcpc.conf
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1086] evalcommand arg: [
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1086] evalcommand arg: AXIS,Network Video Encoder,Q7401,HEAD 081117
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1086] evalcommand arg: ]
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1103] evalcommand arg: echo
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1103] evalcommand arg: AXIS,Network Video Encoder,Q7401,HEAD 081117
]: line 84: [1101] evalcommand arg: date
/etc/init.d/sysklogd[1099]: line 84: [1101] evalcommand arg: +%T
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1104] evalcommand arg: tr
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1104] evalcommand arg: -d
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/ssh (pid 1099) segfaults h/dhcp_command_line.sh: line 28: [1104] evalcommand arg: [.,_\-\+0-9a-zA-Z[:space:]]
/etc/init.d/sysklogd[1099]: line 84: [1099] evalcommand arg: echo
/etc/init.d/sysklogd[1099]: line 84: [1099] evalcommand arg: -e
/etc/init.d/sysklogd[1099]: line 84: [1099] evalcommand arg: \033[31;01m15:49:00 /etc/init.d/sysklogd: +++ checking busybox 'test' with 'cat'\033[0m
15:49:00 /etc/init.d/sysklogd: +++ checking busybox 'test' with 'cat'
/etc/init.d/sysklogd[1099]: line 84: [1105] evalcommand arg: cat
/etc/init.d/sysklogd[1099]: line 84: [1105] evalcommand arg: /etc/123
cat: can't open '/etc/123': No such file or directory
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1086] evalcommand arg: [
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1086] evalcommand arg:
/usr/share/udhcpc/default.script[1086]: /lib/rcscripts/sh/dhcp_command_line.sh: line 28: [1086] evalcommand arg: ]

catched on a serial console.

> What is your gcc/ld versions?

Cross crisv32 tool chain.

$ gcc-cris --version
cris-axis-elf-gcc (GCC) 3.2.1 Axis release R64/1.64

$ ld-cris --version
GNU ld version 2.12.1

> Which libc do you build against? Version?

uClibc-0.9.29

> Does it happen with if [ "$(/bin/true)" ]; then ...?

I can test that tomorrow at work.
Tried with:

	if [ "$(cat /etc/123 >/dev/null)" ]; then

/etc/123 does not exist.  No segfault there.

> Does it happen with just [ "$(/bin/true)" ] executed?

Will test that tomorrow at work.


Cheers,

-- 
Cristian
-------------- next part --------------
A non-text attachment was scrubbed...
Name: .config.gz
Type: application/octet-stream
Size: 5445 bytes
Desc: 
Url : http://lists.busybox.net/pipermail/busybox/attachments/20090127/7910774e/attachment.obj