Wifi bug

[Hannu Nyman]

Felix Fietkau kirjoitti 27.9.2021 klo 13.59:
> On a crash, it should drop a .core file to /tmp. Please copy that to
> your build host and use ./scripts/remote-gdb to obtain a backtrace from
> it. I'd like to know, which line of code in netifd it crashes on, so I
> can fix it. So far the bug has not shown up in my own tests...
>
> - Felix


This is probably what you are looking for...
To me it looks like it might actually be a list handling bug in libubox.


perus at ub2104:/Openwrt/r7800$ 
./build_dir/toolchain-arm_cortex-a15+neon-vfpv4_gcc-11.2.0_musl_eabi/gdb-10.1/gdb/gdb 
./staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/root-ipq806x/sbin/netifd 
netifd.1632756907.1577.11.core
GNU gdb (GDB) 10.1
Copyright (C) 2020 Free Software Foundation, Inc.
...
Type "apropos word" to search for commands related to "word"...
Reading symbols from 
./staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/root-ipq806x/sbin/netifd...

warning: Can't open file /sbin/netifd during file-backed mapping note processing
...
warning: Can't open file /lib/libc.so during file-backed mapping note processing
[New LWP 1577]

warning: Could not load shared library symbols for 8 libraries, e.g. 
/lib/libubox.so.20210819.
Use the "info sharedlibrary" command to see the complete listing.
Do you need "set solib-search-path" or "set sysroot"?
Core was generated by `/sbin/netifd'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xb6ea058c in ?? ()
(gdb) bt
#0  0xb6ea058c in ?? ()
#1  0x0001edc0 in device_broadcast_cb (ctx=<optimized out>, list=<optimized out>)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/netifd-2021-09-21-08e954e1/device.c:497
#2  0xb6f2f228 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)
(gdb) set solib-search-path 
./staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/
host/         packages/     pkginfo/      root-ipq806x/ stamp/        usr/
(gdb) set solib-search-path 
./staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/usr/lib/
Reading symbols from 
/Openwrt/r7800/staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/usr/lib/libubox.so.20210819...
Reading symbols from 
/Openwrt/r7800/staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/usr/lib/libubus.so.20210630...
Reading symbols from 
/Openwrt/r7800/staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/usr/lib/libuci.so...
Reading symbols from 
/Openwrt/r7800/staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/usr/lib/libjson-c.so.5.1.0...
Reading symbols from 
/Openwrt/r7800/staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/usr/lib/libblobmsg_json.so.20210819...
Reading symbols from 
/Openwrt/r7800/staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/usr/lib/libnl-tiny.so...
(gdb) bt
#0  0xb6ea058c in __safe_list_del_iterator (i=0xbee1ed0c)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/libubox-2021-08-19-d716ac4b/safe_list.c:49
#1  __safe_list_move_iterator (i=0xbee1ed0c, list=0xb6f2f220)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/libubox-2021-08-19-d716ac4b/safe_list.c:58
#2  safe_list_for_each (head=head at entry=0xb6f2f220, cb=cb at entry=0x1ed94 
<device_broadcast_cb>, ctx=0xbee1ed3c,
     ctx at entry=0xbee1ed34)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/libubox-2021-08-19-d716ac4b/safe_list.c:73
#3  0x000210d0 in device_broadcast_event (dev=0xb6f2f200, ev=<optimized out>)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/netifd-2021-09-21-08e954e1/device.c:506
#4  0x000289a4 in handle_hotplug_msg (size=<optimized out>, data=<optimized out>)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/netifd-2021-09-21-08e954e1/system-linux.c:777
#5  handle_hotplug_event (u=0x46ea4 <hotplug_event>, events=<optimized out>)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/netifd-2021-09-21-08e954e1/system-linux.c:793
#6  0xb6e9e9f4 in uloop_run_events (timeout=<optimized out>)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/libubox-2021-08-19-d716ac4b/uloop.c:198
#7  uloop_run_timeout (timeout=timeout at entry=-1)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/libubox-2021-08-19-d716ac4b/uloop.c:555
#8  0x00013ae8 in uloop_run ()
     at 
/Openwrt/r7800/staging_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/usr/include/libubox/uloop.h:111
#9  main (argc=1, argv=<optimized out>)
     at 
/Openwrt/r7800/build_dir/target-arm_cortex-a15+neon-vfpv4_musl_eabi/netifd-2021-09-21-08e954e1/main.c:339
(gdb)



There is also a few seconds' gap in the system log, when netifd starts again:


Mon Sep 27 18:35:06 2021 kern.warn kernel: [  178.272585] ath10k_pci 
0000:01:00.0: peer-unmap-event: unknown peer id 0
Mon Sep 27 18:35:06 2021 kern.warn kernel: [  178.272647] ath10k_pci 
0000:01:00.0: peer-unmap-event: unknown peer id 0
Mon Sep 27 18:35:07 2021 daemon.notice netifd: Network device 'wlan0' link is 
down
Mon Sep 27 18:35:12 2021 user.notice : Added device handler type: bonding
Mon Sep 27 18:35:12 2021 user.notice : Added device handler type: 8021ad
Mon Sep 27 18:35:12 2021 user.notice : Added device handler type: 8021q
Mon Sep 27 18:35:12 2021 user.notice : Added device handler type: macvlan
Mon Sep 27 18:35:12 2021 user.notice : Added device handler type: veth
Mon Sep 27 18:35:12 2021 user.notice : Added device handler type: bridge
Mon Sep 27 18:35:12 2021 user.notice : Added device handler type: Network device
Mon Sep 27 18:35:12 2021 user.notice : Added device handler type: tunnel
Mon Sep 27 18:35:12 2021 kern.info kernel: [  184.243388] br-lan: port 
1(eth1.1) entered disabled state
Mon Sep 27 18:35:12 2021 kern.info kernel: [  184.250759] device eth1.1 left 
promiscuous mode
Mon Sep 27 18:35:12 2021 kern.info kernel: [  184.250779] device eth1 left 
promiscuous mode
Mon Sep 27 18:35:12 2021 kern.info kernel: [  184.254230] br-lan: port 
1(eth1.1) entered disabled state
Mon Sep 27 18:35:13 2021 daemon.err odhcp6c[1865]: Failed to send RS 
(Permission denied)
Mon Sep 27 18:35:13 2021 daemon.err odhcp6c[1865]: Failed to send RELEASE 
message to ff02::1:2 (Permission denied)
Mon Sep 27 18:35:13 2021 kern.info kernel: [  184.415654] ipq806x-gmac-dwmac 
37200000.ethernet eth0: Link is Down

Hannu