mudflap problem, and a decode script

[Eyal Lebedinsky <eyal at eyal dot emu dot id dot au>]

I am still trying to understand what is going on here.
I am getting a lot of reports that I find not correct
after carefull tracking. I notice a common pattern to
these problems and hope that showing it may attract
some helful comments.

Below is the report. You will notice that we have a
violation at 0x083c4fb0. This memory region was
malloced, then freed, then malloced again at the
same place. Notice that the earlier allocation
(object 2) has a check=0r/2w while the current
has check=1r/0w. Is it possible that a write to
this region was credited to the wrong object?
It is unusual for my program to allocate an object,
write to it, then free it without ever reading from
it. And I am rather sure that each member of this
struct was initialised as it was allocated.

As always, it may very well be a real bug in my
program that I did not locate yet, but after spending
a nice bit of time on this, I am questioning how
reliable I should consider mudflap (after all it
is under active development). I would have looked
at the code deeper if I had some doco to go by, I
hope to learn more as I go.

As an aside, a workmate developed this simple script
to decode the mudflap reports hex -> file:line. This
is driving gdb which does the actual work. Use it
and improve it. Naturally, the best solution is to
get a readable report in the first place, but this
will do me for a while.

mudflap violation 1 (check/read): time=1050364629.752808 ptr=083c4fb0
size=8 pc=409ad99e location=`queue.c:411 (skqupt)'
      /ssa/builds/a4mfn/bin/libssaiok.so(skqupt+0x1a0) [0x409ad99e]
      /ssa/builds/a4mfn/bin/libssaiok.so [0x40a31625]
      /ssa/builds/a4mfn/bin/libssaiok.so [0x40a4aab6]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx094+0x4f3b) [0x40a66b75]
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401eba16]
      /ssa/builds/a4mfn/bin/libssan3tb.so(n3gn21+0x842) [0x401fa9ee]
      /ssa/builds/a4mfn/bin/genelx(n3gn01+0x51b8) [0x80500e8]
      /ssa/builds/a4mfn/bin/libssaiok.so(skmain+0xecf) [0x40999820]
      /ssa/builds/a4mfn/bin/genelx(main+0x4e9) [0x804b864]
      /lib/libc.so.6(__libc_start_main+0xbb) [0x40b5c14f]
      /ssa/builds/a4mfn/bin/genelx(free+0x31) [0x804b0f1]
Nearby object 1: checked region begins 0B into and ends 7B into
mudflap object 08396288: name=`malloc region'
bounds=[083c4fb0,083c5017] size=104 area=heap check=1r/0w liveness=1
watching=0
alloc time=1050364629.749779 pc=40b2cfb2
      /usr/local/gcc-mudflap/lib/libmudflap.so.0(__real_malloc+0x142)
[0x40b2cfb2]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx062+0x1725) [0x409c046b]
      /ssa/builds/a4mfn/bin/libssaiok.so(skquit+0x1cc) [0x409b3584]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx091+0xd24b) [0x40a5c94b]
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401e8c6c]
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401eb85d]
      /ssa/builds/a4mfn/bin/libssan3tb.so(n3gn21+0x842) [0x401fa9ee]
      /ssa/builds/a4mfn/bin/genelx(n3gn01+0x51b8) [0x80500e8]
      /ssa/builds/a4mfn/bin/libssaiok.so(skmain+0xecf) [0x40999820]
      /ssa/builds/a4mfn/bin/genelx(main+0x4e9) [0x804b864]
      /lib/libc.so.6(__libc_start_main+0xbb) [0x40b5c14f]
      /ssa/builds/a4mfn/bin/genelx(free+0x31) [0x804b0f1]
Nearby object 2: checked region begins 0B into and ends 7B into
mudflap object 083ceca0: name=`malloc region'
bounds=[083c4fb0,083c5017] size=104 area=heap check=0r/2w liveness=2
watching=0
alloc time=1050364629.746654 pc=40b2cfb2
      /usr/local/gcc-mudflap/lib/libmudflap.so.0(__real_malloc+0x142)
[0x40b2cfb2]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx062+0x1725) [0x409c046b]
      /ssa/builds/a4mfn/bin/libssaiok.so(skquit+0x1cc) [0x409b3584]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx091+0xd24b) [0x40a5c94b]
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401e8c6c]
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401eac02]
      /ssa/builds/a4mfn/bin/libssan3tb.so(n3gn21+0x7d8) [0x401fa984]
      /ssa/builds/a4mfn/bin/genelx(n3gn01+0x51b8) [0x80500e8]
      /ssa/builds/a4mfn/bin/libssaiok.so(skmain+0xecf) [0x40999820]
      /ssa/builds/a4mfn/bin/genelx(main+0x4e9) [0x804b864]
      /lib/libc.so.6(__libc_start_main+0xbb) [0x40b5c14f]
      /ssa/builds/a4mfn/bin/genelx(free+0x31) [0x804b0f1]
dealloc time=1050364629.748719 pc=40b2d098
      /usr/local/gcc-mudflap/lib/libmudflap.so.0(__real_free+0x88)
[0x40b2d098]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx061+0xf2b) [0x409be973]
      /ssa/builds/a4mfn/bin/libssaiok.so(skquds+0x8d6) [0x409b179a]
      /ssa/builds/a4mfn/bin/libssaiok.so [0x40a349e7]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx098+0xcb) [0x40a4c828]
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401e8f34]
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401eb64e]
      /ssa/builds/a4mfn/bin/libssan3tb.so(n3gn21+0x7d8) [0x401fa984]
      /ssa/builds/a4mfn/bin/genelx(n3gn01+0x51b8) [0x80500e8]
      /ssa/builds/a4mfn/bin/libssaiok.so(skmain+0xecf) [0x40999820]
      /ssa/builds/a4mfn/bin/genelx(main+0x4e9) [0x804b864]
      /lib/libc.so.6(__libc_start_main+0xbb) [0x40b5c14f]
      /ssa/builds/a4mfn/bin/genelx(free+0x31) [0x804b0f1]
number of nearby objects: 2


The same report, decoded:
=========================

mudflap violation 1 (check/read): time=1050364629.752808 ptr=083c4fb0
size=8 pc=409ad99e location=`queue.c:411 (skqupt)'
      /ssa/builds/a4mfn/bin/libssaiok.so(skqupt+0x1a0) [0x409ad99e]
{queue.c:411}
      /ssa/builds/a4mfn/bin/libssaiok.so [0x40a31625] {qsort.h:348}
      /ssa/builds/a4mfn/bin/libssaiok.so [0x40a4aab6] {sort.c:1444}
      /ssa/builds/a4mfn/bin/libssaiok.so(skx094+0x4f3b) [0x40a66b75]
{sort.c:2206}
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401eba16] {geneln.c:2492}
      /ssa/builds/a4mfn/bin/libssan3tb.so(n3gn21+0x842) [0x401fa9ee]
{geneln.c:3332}
      /ssa/builds/a4mfn/bin/genelx(n3gn01+0x51b8) [0x80500e8]
{genel.c:337}
      /ssa/builds/a4mfn/bin/libssaiok.so(skmain+0xecf) [0x40999820]
{main.c:1041}
      /ssa/builds/a4mfn/bin/genelx(main+0x4e9) [0x804b864] {genel.c:85}
      /lib/libc.so.6(__libc_start_main+0xbb) [0x40b5c14f] {no debugging
symbols found)...(gdb}
      /ssa/builds/a4mfn/bin/genelx(free+0x31) [0x804b0f1] {Could not
resolve symbol}
Nearby object 1: checked region begins 0B into and ends 7B into
mudflap object 08396288: name=`malloc region'
bounds=[083c4fb0,083c5017] size=104 area=heap check=1r/0w liveness=1
watching=0
alloc time=1050364629.749779 pc=40b2cfb2
      /usr/local/gcc-mudflap/lib/libmudflap.so.0(__real_malloc+0x142)
[0x40b2cfb2]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx062+0x1725) [0x409c046b]
{res.c:579}
      /ssa/builds/a4mfn/bin/libssaiok.so(skquit+0x1cc) [0x409b3584]
{queue.c:791}
      /ssa/builds/a4mfn/bin/libssaiok.so(skx091+0xd24b) [0x40a5c94b]
{sort.c:1923}
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401e8c6c] {geneln.c:2232}
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401eb85d] {geneln.c:2470}
      /ssa/builds/a4mfn/bin/libssan3tb.so(n3gn21+0x842) [0x401fa9ee]
{geneln.c:3332}
      /ssa/builds/a4mfn/bin/genelx(n3gn01+0x51b8) [0x80500e8]
{genel.c:337}
      /ssa/builds/a4mfn/bin/libssaiok.so(skmain+0xecf) [0x40999820]
{main.c:1041}
      /ssa/builds/a4mfn/bin/genelx(main+0x4e9) [0x804b864] {genel.c:85}
      /lib/libc.so.6(__libc_start_main+0xbb) [0x40b5c14f] {no debugging
symbols found)...(gdb}
      /ssa/builds/a4mfn/bin/genelx(free+0x31) [0x804b0f1] {Could not
resolve symbol}
Nearby object 2: checked region begins 0B into and ends 7B into
mudflap object 083ceca0: name=`malloc region'
bounds=[083c4fb0,083c5017] size=104 area=heap check=0r/2w liveness=2
watching=0
alloc time=1050364629.746654 pc=40b2cfb2
      /usr/local/gcc-mudflap/lib/libmudflap.so.0(__real_malloc+0x142)
[0x40b2cfb2]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx062+0x1725) [0x409c046b]
{res.c:579}
      /ssa/builds/a4mfn/bin/libssaiok.so(skquit+0x1cc) [0x409b3584]
{queue.c:791}
      /ssa/builds/a4mfn/bin/libssaiok.so(skx091+0xd24b) [0x40a5c94b]
{sort.c:1923}
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401e8c6c] {geneln.c:2232}
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401eac02] {geneln.c:2387}
      /ssa/builds/a4mfn/bin/libssan3tb.so(n3gn21+0x7d8) [0x401fa984]
{geneln.c:3326}
      /ssa/builds/a4mfn/bin/genelx(n3gn01+0x51b8) [0x80500e8]
{genel.c:337}
      /ssa/builds/a4mfn/bin/libssaiok.so(skmain+0xecf) [0x40999820]
{main.c:1041}
      /ssa/builds/a4mfn/bin/genelx(main+0x4e9) [0x804b864] {genel.c:85}
      /lib/libc.so.6(__libc_start_main+0xbb) [0x40b5c14f] {no debugging
symbols found)...(gdb}
      /ssa/builds/a4mfn/bin/genelx(free+0x31) [0x804b0f1] {Could not
resolve symbol}
dealloc time=1050364629.748719 pc=40b2d098
      /usr/local/gcc-mudflap/lib/libmudflap.so.0(__real_free+0x88)
[0x40b2d098]
      /ssa/builds/a4mfn/bin/libssaiok.so(skx061+0xf2b) [0x409be973]
{res.c:495}
      /ssa/builds/a4mfn/bin/libssaiok.so(skquds+0x8d6) [0x409b179a]
{queue.c:639}
      /ssa/builds/a4mfn/bin/libssaiok.so [0x40a349e7] {sort.c:402}
      /ssa/builds/a4mfn/bin/libssaiok.so(skx098+0xcb) [0x40a4c828]
{sort.c:1511}
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401e8f34] {geneln.c:2253}
      /ssa/builds/a4mfn/bin/libssan3tb.so [0x401eb64e] {geneln.c:2447}
      /ssa/builds/a4mfn/bin/libssan3tb.so(n3gn21+0x7d8) [0x401fa984]
{geneln.c:3326}
      /ssa/builds/a4mfn/bin/genelx(n3gn01+0x51b8) [0x80500e8]
{genel.c:337}
      /ssa/builds/a4mfn/bin/libssaiok.so(skmain+0xecf) [0x40999820]
{main.c:1041}
      /ssa/builds/a4mfn/bin/genelx(main+0x4e9) [0x804b864] {genel.c:85}
      /lib/libc.so.6(__libc_start_main+0xbb) [0x40b5c14f] {no debugging
symbols found)...(gdb}
      /ssa/builds/a4mfn/bin/genelx(free+0x31) [0x804b0f1] {Could not
resolve symbol}
number of nearby objects: 2

--
Eyal Lebedinsky (eyal at eyal dot emu dot id dot au) <http://samba.org/eyal/>

Attachment: mfdecode.pl
Description: Perl program