[alsa-devel] alsactl segfault

[Takashi Iwai]

On Fri, 09 Sep 2016 23:33:04 +0200,
Orion Poplawski wrote:
> 
> There are reports of alsactl segfaulting:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=1335431
> https://bugzilla.redhat.com/show_bug.cgi?id=1283737
> 
> Core was generated by `/usr/sbin/alsactl -s -n 19 -c -E
> ALSA_CONFIG_PATH=/etc/alsa/alsactl.conf --init'.
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  free_list (list=list at entry=0x20) at daemon.c:74
> 74		for (i = 0; i < list->size; i++)
> 
> Thread 1 (Thread 0x7fd798589700 (LWP 1015)):
> #0  free_list (list=list at entry=0x20) at daemon.c:74
>         i = 0
> #1  0x000055e3c8704935 in card_free (card=0x55e3ca6c5018) at daemon.c:83
>         c = 0x0
> #2  0x000055e3c87054a4 in state_daemon (file=0x55e3c8705ced
> "/var/lib/alsa/asound.state", cardname=0x0, period=300, pidfile=0x55e3c8705cbc
> "/var/run/alsactl.pid") at daemon.c:455
>         count = 2
>         pcount = <optimized out>
>         psize = <optimized out>
>         i = 1
>         j = <optimized out>
>         k = <optimized out>
>         changed = 0
>         last_write = 1463036017
>         now = 1463037368
>         revents = 0
>         cards = 0x55e3ca6c5010
>         pfd = <optimized out>
>         pfdn = <optimized out>
>         __FUNCTION__ = "state_daemon"
> #3  0x000055e3c86f90e7 in main (argc=<optimized out>, argv=<optimized out>) at
> alsactl.c:370
>         devfiles = {0x55e3c8705d08 "/dev/snd/controlC", 0x55e3c8705db3
> "/dev/snd/pcmC", 0x55e3c8705dc1 "/dev/snd/midiC", 0x55e3c8705dd0
> "/dev/snd/hwC", 0x0}
>         cfgfile = 0x55e3c8705ced "/var/lib/alsa/asound.state"
>         initfile = 0x7ffc87ee1f80 "/lib/alsa/init/00main"
>         pidfile = 0x55e3c8705cbc "/var/run/alsactl.pid"
>         cardname = 0x0
>         ncardname = "(\201Z\230\327\177\000\000\000\000\000\000\000\000\000"
>         cmd = 0x7ffc87ee1f96 "rdaemon"
>         tmp = <optimized out>
>         removestate = 0
>         init_fallback = 1
>         period = 300
>         background = 0
>         daemoncmd = <optimized out>
>         use_nice = 19
>         sched_idle = 1
>         o = <optimized out>
>         j = <optimized out>
>         k = <optimized out>
>         res = 0
>         long_option = 0x0
>         short_option = 0x0
> 
> Any idea what might be causing this?  Any other debug info that would be
> helpful?  It doesn't crash all the time.

The patch below should fix the issue.  Give it a try.


Takashi

---
diff --git a/alsactl/daemon.c b/alsactl/daemon.c
index 127701efaf0f..4f0a935a3987 100644
--- a/alsactl/daemon.c
+++ b/alsactl/daemon.c
@@ -451,8 +451,10 @@ save:
 out:
 	free(pfd);
 	remove(pidfile);
-	for (i = 0; i < count; i++)
-		card_free(&cards[i]);
-	free(cards);
+	if (cards) {
+		for (i = 0; i < count; i++)
+			card_free(&cards[i]);
+		free(cards);
+	}
 	return 0;
 }