segmentation fault when calling mm_object_get_modem

Héctor Jiménez Méndez hector.jimenez.m at gmv.com
Thu Jun 15 11:45:46 UTC 2023 

Hi.

We are using ModemManager 1.18.8 library and sometimes we got segmentation fault when calling mm_object_get_modem function. It happens from time to time, no clues about circumstances, as our code is continuously inquiring for modem object in this function:

MMModemPtr ModemManagerFacade::getModemPtr(const std::string &imei)
{
    MMObject *object = getObject(imei);
    if (object == nullptr) {
        return MMModemPtr(nullptr, &g_object_unref);
    }

    return MMModemPtr(mm_object_get_modem(object), &g_object_unref);
}

It returns a MMModemPtr type, which is a unique pointer:
using MMModemPtr = std::unique_ptr<MMModem, decltype(&g_object_unref)>;///< MMModem Unique pointer with custom deleter

and it's checked every time that function is called as in:
    MMModemPtr modem = getModemPtr(imei);
    if (modem == nullptr) {
        return DPY_UNAVAILABLE;
    }

MMobject is stored in a map
    std::map<std::string, MMObject*> mImeiToObjectMap;

and obtained in
MMObject* ModemManagerFacade::getObject(std::string imei)
{
    /* Some previous checkings ...
...and*/
    auto it = mImeiToObjectMap.find(imei);
    if (it == mImeiToObjectMap.end()) {
        return nullptr;
    }
    return (it->second);
}

But I don't think MMobject pointer is the problem as it's checked inside mm_object_get_modem function:
MMModem *
mm_object_get_modem (MMObject *self)
{
    MMModem *modem;

    g_return_val_if_fail (MM_IS_OBJECT (MM_GDBUS_OBJECT (self)), NULL);

    modem = (MMModem *)mm_gdbus_object_get_modem (MM_GDBUS_OBJECT (self));
    g_warn_if_fail (MM_IS_MODEM (modem));
    return modem;
}

and the backtrace shows that the program terminates after calling mm_gdbus_object_get_modem

Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000ffffad048ab8 in g_hash_table_lookup () from /usr/lib/libglib-2.0.so.0
[Current thread is 1 (LWP 10802)]
(gdb) bt
#0  0x0000ffffad048ab8 in g_hash_table_lookup () from /usr/lib/libglib-2.0.so.0
#1  0x0000ffffad2f5824 in ?? () from /usr/lib/libgio-2.0.so.0
#2  0x0000ffffad4629dc in mm_gdbus_object_get_modem () from /usr/lib/libmm-glib.so.0
#3  0x0000ffffad422e2c in mm_object_get_modem () from /usr/lib/libmm-glib.so.0
#4  0x0000aaaabff73124 in ModemManagerFacade::getModemPtr(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) ()
#5  0x0000aaaabff745f0 in ModemManagerFacade::getDominantTechnologySignalQuality(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, dpyModem::SignalQuality&, bool&) ()
#6  0x0000aaaabff5d97c in ModemManagerDevice::update_signalQuality() ()
#7  0x0000aaaabffbb050 in ModemSupervisor::updateModemParameters() ()
#8  0x0000aaaabffbbc44 in ModemSupervisor::checkModemStatus(boost::system::error_code const&, dpyModem::ModemState) ()
#9  0x0000aaaabffbcfe8 in boost::asio::detail::wait_handler<boost::_bi::bind_t<void, boost::_mfi::mf2<void, ModemSupervisor, boost::system::error_code const&, dpyModem::ModemState>, boost::_bi::list3<boost::_bi::value<ModemSupervisor*>, boost::arg<1> (*)(), boost::_bi::value<dpyModem::ModemState> > > >::do_complete(void*, boost::asio::detail::scheduler_operation*, boost::system::error_code const&, unsigned long) ()
#10 0x0000aaaabff0de38 in boost::asio::detail::scheduler::do_run_one(boost::asio::detail::conditionally_enabled_mutex::scoped_lock&, boost::asio::detail::scheduler_thread_info&, boost::system::error_code const&) ()
#11 0x0000aaaabffe704c in ModemService::operator()(boost::application::basic_context&) ()
#12 0x0000aaaabffd019c in int boost::application::launch<boost::application::common, boost::application::auto_handler<ModemService>, boost::application::basic_context>(boost::application::auto_handler<ModemService>&, boost::application::basic_context&, boost::system::error_code&) ()
#13 0x0000aaaabfedc9a0 in main ()

Any ideas about why this can be happening? Has it ever been seen before?

Thank you!

[Logo]<https://www.gmv.com/>
Héctor Jiménez Méndez
Firmware engineer

T. 983 54 65 54
M. 696 297 286

Juan de Herrera, nº 17, P.T.B.
47151 Boecillo, Valladolid | Spain
[cid:image002.jpg at 01D99F89.0F4ED1E0]<http://www.gmv.com/communication/blog>
[cid:image003.jpg at 01D99F89.0F4ED1E0]<http://www.facebook.com/infoGMV>
[cid:image004.jpg at 01D99F89.0F4ED1E0]<http://www.twitter.com/infoGMV>
[cid:image005.jpg at 01D99F89.0F4ED1E0]<http://www.youtube.com/infoGMV>
[cid:image006.jpg at 01D99F89.0F4ED1E0]<https://www.instagram.com/companygmv/>
[cid:image007.jpg at 01D99F89.0F4ED1E0]<https://www.linkedin.com/company/gmv>
www.gmv.com<http://www.gmv.com/>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20230615/f1ba0a2e/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 32181 bytes
Desc: image001.jpg
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20230615/f1ba0a2e/attachment-0007.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.jpg
Type: image/jpeg
Size: 12212 bytes
Desc: image002.jpg
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20230615/f1ba0a2e/attachment-0008.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.jpg
Type: image/jpeg
Size: 12347 bytes
Desc: image003.jpg
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20230615/f1ba0a2e/attachment-0009.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image004.jpg
Type: image/jpeg
Size: 12322 bytes
Desc: image004.jpg
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20230615/f1ba0a2e/attachment-0010.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image005.jpg
Type: image/jpeg
Size: 12329 bytes
Desc: image005.jpg
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20230615/f1ba0a2e/attachment-0011.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image006.jpg
Type: image/jpeg
Size: 12373 bytes
Desc: image006.jpg
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20230615/f1ba0a2e/attachment-0012.jpg>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image007.jpg
Type: image/jpeg
Size: 12317 bytes
Desc: image007.jpg
URL: <https://lists.freedesktop.org/archives/modemmanager-devel/attachments/20230615/f1ba0a2e/attachment-0013.jpg>

More information about the ModemManager-devel mailing list