tree f62a5b36748b1302223f99e0bc716a4a2490b6de
parent 83cf8189e5f9d414efb5c5fa73227e977cf5f84d
author Tim Lee <timlee660101@gmail.com> 1602561178 +0800
committer Gunnar Mills <gmills@us.ibm.com> 1605193558 +0000

update_service: fix segmentation violation when updating images

Symptom:
Before repo this issue symptom, we need to enable bmcweb debug option.
Due to this issue is relevant to timing about callback function lifecycle.
Thus, enable debugging will increae issue repo rate almost 100%.

Bmcweb.service was terminated abnormal after updating images via Redfish curl command.
According debug log, bmcweb.service exited with status=11/SEGV (Segmentation Violation).
That's usually a bug in a program such as pointer, null pointer, arrays and so on.
The default action for a program upon receiving SIGSEGV is abnormal termination.

Coredump analysis:
From the backtrace result that is point to softwareInterfaceAdded() of caller:
at/home/tim/git/runbmc/openbmc/olympus-build/tmp/work/armv7a-openbmc-linux-gnueabi/bmcweb/
1.0+gitAUTOINC+72d566d9eb-r0/recipe-sysroot/usr/include/c++/10.1.0/bits/shared_ptr.h:149
at/home/tim/git/runbmc/openbmc/olympus-build/tmp/work/armv7a-openbmc-linux-gnueabi/bmcweb/
1.0+gitAUTOINC+72d566d9eb-r0/git/redfish-core/include/../lib/update_service.hpp:315

SEGV happen after executing line 84 in softwareInterfaceAdded()
line: 83 // Found our interface, disable callbacks
line: 84    fwUpdateMatcher = nullptr;
line: 86 // Retrieve service and activate
line: 87 crow::connections::systemBus->async_method_call(

Root cause:
From coredump and backtrace result that segmentation violation issue in softwareInterfaceAdded().
softwareInterfaceAdded() is a callback function will be called by monitorForSoftwareAvailable().
When there is a signal relate to member is InterfacesAdded in object path /xyz/operbmc_project/software.
However, this callback function pointer will set to NULL poniter in itself callback function.
Thus, there is possible to hit SEGV issue when accessing to NULL function pointer.

Solution:
Set fwUpdateMatcher as nullptr should remove it from softwareInterfaceAdded().
And that will be set as nullptr by call cleanUp() in monitorForSoftwareAvailable() after got response.
Thus, it save to remove this line and avoid this SEGV then cause bmcweb.service terminated abnormal.

Tested:
Update BMC image using UpdateService POST action:
curl -k -H "X-Auth-Token: $token" -H "Content-Type: application/octet-stream" -X POST -T
tim/obmc-phosphor-image-olympus-nuvoton-20200921031720.static.mtd.tar https://${bmc}/redfish/v1/UpdateService

Update BMC image using UpdateService.SimpleUpdate POST action:
curl -k -H "X-Auth-Token: $token" -X POST https://${bmc}/redfish/v1/UpdateService/Actions/UpdateService.SimpleUpdate
-d '{"ImageURI":"tftp://10.103.61.175/obmc-phosphor-image-olympus-nuvoton-20200921031720.static.mtd.tar"}'

Signed-off-by: Tim Lee <timlee660101@gmail.com>
Change-Id: I01dcf56893b5ca64fe1d45f29f3f858761ccf2a8