[PATCH 1/2] Make 'clear_dive()' free the primary dive computer data properly

[Rick Walsh]

On 10 June 2016 at 09:53, Linus Torvalds <torvalds at linux-foundation.org>
wrote:

> On Thu, Jun 9, 2016 at 4:19 PM, Rick Walsh <rickmwalsh at gmail.com> wrote:
> >> From: Linus Torvalds <torvalds at linux-foundation.org>
> >> Subject: [PATCH 1/2] Make 'clear_dive()' free the primary dive computer
> data properly
> >
> > This change leads to an invalid pointer error when cancelling a planned
> > dive.
>
> Hmm. Running under valgrind shows that MainWindow::setupForAddAndPlan()
> does a
>
>      clear_dive(&displayed_dive);
>
> and it 's the
>
>      free((void *)dc->model);
>
> in there that causes problems.
>
> You have a slightly different thing, with the call sequence being
> copy_dive -> clear_dive. But I suspect the causes are the same:
> there's a "struct dive" that hasn't been fully initialized and has a
> bogus dc->model in itr.
>
> I'll try to see what I can get, but can you let me know exactly what
> your sequence was? I tried opening an empty file, then plan a dive and
> cancel it immediately. That didn't fail, but the *second* time I did
> it I got the problem.
>
My exact sequence was: start Subsurface with my default dive log; ctrl L
(plan dive); hit cancel

It doesn't appear to matter whether or not I enter any plan details, or
leave it as the default 15 metres for 20 min dive.

It's failed every time I've tried this morning.

I tried again with an empty log book, and got a crash with a slightly
different backtrace (no logged dive profile to plot) but I think the same
issue:

*** Error in `/home/rick/src/subsurface/build/subsurface': munmap_chunk():
invalid pointer: 0x0000000000803f5d ***
======= Backtrace: =========
/lib64/libc.so.6(+0x77d75)[0x7ffff0e4fd75]
/lib64/libc.so.6(cfree+0x1a8)[0x7ffff0e5b888]
/home/rick/src/subsurface/build/subsurface[0x6946b6]
/home/rick/src/subsurface/build/subsurface(clear_dive+0x7f)[0x69044d]
/home/rick/src/subsurface/build/subsurface(_ZN10MainWindow18setupForAddAndPlanEPKc+0x20)[0x512b1a]
/home/rick/src/subsurface/build/subsurface(_ZN10MainWindow30on_actionDivePlanner_triggeredEv+0x94)[0x512ea2]
/home/rick/src/subsurface/build/subsurface[0x5bae05]
/home/rick/src/subsurface/build/subsurface(_ZN10MainWindow11qt_metacallEN11QMetaObject4CallEiPPv+0x5c)[0x5bb1aa]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.subsurface-divelog.org/pipermail/subsurface/attachments/20160610/e5e145e7/attachment-0001.html>