mw crash

mw crash

[Chris Healy]

I mistakenly used the wrong set of command line arguments when using
the mw command and it resulted in the following crash:

barebox@ZII RDU2 Board:/ mw -b -l /dev/pic_eeprom_rdu 0x50 3
unable to handle NULL pointer dereference at address 0x00000000
pc : [<8fe45134>]    lr : [<8fe45107>]
sp : 8ffef870  ip : 4ff9def8  fp : 00000000
r10: 00000006  r9 : 00000000  r8 : ffffffff
r7 : 8ffef91c  r6 : 8ffef91c  r5 : 00000000  r4 : 00000004
r3 : 00000050  r2 : 00000003  r1 : 00000003  r0 : 00000000
Flags: Nzcv  IRQs off  FIQs off  Mode SVC_32
[<8fe45134>] (memcpy_sz+0x48/0x54) from [<8fe46119>] (mem_write+0x39/0x44)
[<8fe46119>] (mem_write+0x39/0x44) from [<8fe42f35>] (devfs_write+0x21/0x2a)
[<8fe42f35>] (devfs_write+0x21/0x2a) from [<8fe44ea1>] (__write+0x79/0x94)
[<8fe44ea1>] (__write+0x79/0x94) from [<8fe45587>] (write+0x2b/0x48)
[<8fe45587>] (write+0x2b/0x48) from [<8fe2c813>] (do_mem_mw+0x10f/0x14c)
[<8fe2c813>] (do_mem_mw+0x10f/0x14c) from [<8fe0324d>]
(execute_command+0x21/0x48)
[<8fe0324d>] (execute_command+0x21/0x48) from [<8fe087eb>]
(run_list_real+0x55b/0x618)
[<8fe087eb>] (run_list_real+0x55b/0x618) from [<8fe08161>]
(parse_stream_outer+0xd9/0x164)
[<8fe08161>] (parse_stream_outer+0xd9/0x164) from [<8fe08a6b>]
(run_shell+0x33/0x60)
[<8fe08a6b>] (run_shell+0x33/0x60) from [<8fe0324d>] (execute_command+0x21/0x48)
[<8fe0324d>] (execute_command+0x21/0x48) from [<8fe087eb>]
(run_list_real+0x55b/0x618)
[<8fe087eb>] (run_list_real+0x55b/0x618) from [<8fe08509>]
(run_list_real+0x279/0x618)

[<8fe4cbe9>] (unwind_backtrace+0x1/0x58) from [<8fe00d39>] (panic+0x1d/0x34)
[<8fe00d39>] (panic+0x1d/0x34) from [<8fe4b20d>] (do_exception+0xd/0x10)
[<8fe4b20d>] (do_exception+0xd/0x10) from [<8fe4b26d>] (do_data_abort+0x21/0x2c)
[<8fe4b26d>] (do_data_abort+0x21/0x2c) from [<8fe4ab34>] (do_abort_6+0x48/0x54)


I haven't dug in to figure it out but I figured it would be good to report.

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

Re: mw crash

[Uwe Kleine-König]

On Thu, Feb 23, 2017 at 03:24:33PM -0800, Chris Healy wrote:
> I mistakenly used the wrong set of command line arguments when using
> the mw command and it resulted in the following crash:
> 
> barebox@ZII RDU2 Board:/ mw -b -l /dev/pic_eeprom_rdu 0x50 3

That was interpreted as

> unable to handle NULL pointer dereference at address 0x00000000
> pc : [<8fe45134>]    lr : [<8fe45107>]
> sp : 8ffef870  ip : 4ff9def8  fp : 00000000
> r10: 00000006  r9 : 00000000  r8 : ffffffff
> r7 : 8ffef91c  r6 : 8ffef91c  r5 : 00000000  r4 : 00000004
> r3 : 00000050  r2 : 00000003  r1 : 00000003  r0 : 00000000
> Flags: Nzcv  IRQs off  FIQs off  Mode SVC_32
> [<8fe45134>] (memcpy_sz+0x48/0x54) from [<8fe46119>] (mem_write+0x39/0x44)

The failing instruction is

	strd r2, r3, [r5]

(assuming it compiles for you in the same way as for me).

So your command seems to be interpreted as

	mw -q 0 0x0000000300000050

Hmm, I cannot reproduce that, for me the above command is interpreted as

	mw -l 0 0x50 3

So at least doing

diff --git a/commands/mw.c b/commands/mw.c
index bb6a16ef3d45..2c8ec456076c 100644
--- a/commands/mw.c
+++ b/commands/mw.c
@@ -42,6 +42,7 @@ static int do_mem_mw(int argc, char *argv[])
 	int mode = O_RWSIZE_4;
 	loff_t adr;
 	int swab = 0;
+	char *endp;
 
 	if (mem_parse_options(argc, argv, "bwlqd:x", &mode, NULL, &filename,
 			&swab) < 0)
@@ -50,7 +51,11 @@ static int do_mem_mw(int argc, char *argv[])
 	if (optind + 1 >= argc)
 		return COMMAND_ERROR_USAGE;
 
-	adr = strtoull_suffix(argv[optind++], NULL, 0);
+	adr = strtoull_suffix(argv[optind++], &endp, 0);
+	if (*endp != '\0') {
+		pr_err("Failed to parse address\n");
+		return 1;
+	}
 
 	fd = open_and_lseek(filename, mode | O_WRONLY, adr);
 	if (fd < 0)

consistently (i.e. also for the other mem commands and the values) and
teaching mem_parse_options to error out if more than one of -b -w -l -q
is given would help.

Best regards
Uwe

-- 
Pengutronix e.K.                           | Uwe Kleine-König            |
Industrial Linux Solutions                 | http://www.pengutronix.de/  |

_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox