Ubuntu
nut package

Stack smashing in gamatronic driver

Bug #1976307 reported by Claudio Matsuoka on 2022-05-30

This bug affects 1 person

Affects		Status	Importance	Assigned to	Milestone
	nut (Ubuntu)	New	Undecided	Unassigned

Bug Description

The gamatronic UPS driver in nut 2.7.4-14ubuntu2 randomly crashes after a memory violation attempt. This usually happens after many hours of operation, typically after 20h or more, and started after the update to jammy. No similar problems happened on focal.

116159.602986 UPS<--PC: "0,599,1,1237,0015,00172,020,,,,,,,,"
116159.603047 PC-->UPS: "^P003ST5"
116159.603130 send returned: 8
116160.836034 UPS<--PC: "0,0,0,0,0,0,0,0,0,0,0,0,0,0,0"
116160.836062 PC-->UPS: "^P003ST1"
116160.836143 send returned: 8
116162.085828 UPS<--PC: "0,0,0,00000,999,100,0273,0004,00"
116162.085881 PC-->UPS: "^P003ST4"
116162.085973 send returned: 8
116163.308513 UPS<--PC: "600,1,1237,0015,00173,,,,,,"
116163.308537 PC-->UPS: "^P003ST2"
116163.308614 send returned: 8
116164.513013 UPS<--PC: "000,1,600,1294,,,,,,,,,,"
116164.513076 PC-->UPS: "^P003ST3"
116164.513159 send returned: 8
116165.785520 UPS<--PC: "0,599,1,1237,0015,00174,021,,,,,,,,"
*** stack smashing detected ***: terminated
Aborted

Broadcast message from nut@hiccup (somewhere) (Mon May 30 16:49:10 2022):

Communications with UPS nhs@localhost lost

The driver is being used with the following device:

device.mfr: NHS Sistemas de Energia
device.model: PDV SENOIDAL 1400 VA
device.type: ups
driver.name: gamatronic
driver.parameter.pollinterval: 2
driver.parameter.port: /dev/ttyACM0
driver.parameter.synchronous: no
driver.version: 2.7.4
driver.version.internal: 0.02

Additional contextual information:

Description: Ubuntu 22.04 LTS
Release: 22.04

nut-server:
  Installed: 2.7.4-14ubuntu2
  Candidate: 2.7.4-14ubuntu2
  Version table:
*** 2.7.4-14ubuntu2 500
        500 http://us.archive.ubuntu.com/ubuntu jammy/main amd64 Packages
        100 /var/lib/dpkg/status

What you expected to happen: process not crashing
What happened instead: process crashed (boo)

Revision history for this message

Claudio Matsuoka (cmatsuoka) wrote on 2022-05-30:

core dump Edit (42.3 KiB, application/octet-stream)

Revision history for this message

Lucas Kanashiro (lucaskanashiro) wrote on 2022-05-31:

Thanks for reporting this bug Claudio.

As you might have expected I was not able to reproduce it locally. After checking the the core dump, we can see the crash happened when executing the sec_poll function in drivers/gamatronic.c file. I went through the upstream history of this file and I found some commits in the latest version (2.8.0) which might fix this issue for you.

Since version 2.8.0 is not even in Debian yet, I prepared a "dirty" package (removed some docs and manpages) and put it in this PPA:

https://launchpad.net/~lucaskanashiro/+archive/ubuntu/nut

Could you please try to test it and see if it fixes this issue for you? If yes, we can try to dig into those upstream commits and then find what is needed to SRU to jammy.

Revision history for this message

Claudio Matsuoka (cmatsuoka) wrote on 2022-05-31:

Thanks Lucas. I'm installing the version you prepared and will run it for a few days to see if it's stable, and then report back.

Revision history for this message

Claudio Matsuoka (cmatsuoka) wrote on 2022-06-18 (last edit on 2022-06-19):

I've been running this version for a couple of weeks now and it seems to be stable, with caveats: I need to start the gamatronic daemon manually, and sometimes it crashes on start. Once it initializes correctly, it's rock solid. I'll investigate the crash, maybe it's something easy to fix.