Bug 292008 - armv7 (native and chroot) gets SIGSEGV for: gpart show, in part for inappropriate %ld format use. [which is what was fixed]
Summary: armv7 (native and chroot) gets SIGSEGV for: gpart show, in part for inappropr...
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: bin (show other bugs)
Version: 16.0-CURRENT
Hardware: arm Any
: --- Affects Only Me
Assignee: Dag-Erling Smørgrav
URL:
Keywords: crash
Depends on:
Blocks:
 
Reported: 2025-12-28 20:41 UTC by Mark Millard
Modified: 2026-01-05 14:48 UTC (History)
2 users (show)

See Also:


Attachments
Native armv7 context's sysctl kern.geom.confxml output (18.79 KB, text/plain)
2025-12-28 20:45 UTC, Mark Millard
no flags Details
aarch64 with armv7 chroot context's sysctl kern.geom.confxml output (34.65 KB, text/plain)
2025-12-28 20:50 UTC, Mark Millard
no flags Details
aarch64 context: diff of armv7 chroot vs. aarch64 gpart show --libxo:JP output (4.89 KB, text/plain)
2025-12-28 20:59 UTC, Mark Millard
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mark Millard 2025-12-28 20:41:20 UTC
Context: official pkgbase distribution installations,
both native armv7 boot and armv7 chroot world on aarch64.
But the details backtraces differ in the native vs.
not examples involved. Also, the freebsd-arm and
freebsd-current lists had messages about this before
this submittal.

armv7 native backtrace (there was no output before
the SIGSEGV notice):

Core was generated by `gpart show'.
Program terminated with signal SIGSEGV, Segmentation fault.
Address not mapped to object.
#0  xo_format_string_direct (xop=xop@entry=0x2009b120, xbp=xbp@entry=0x2009b150, flags=flags@entry=4096, wcp=0x0, cp=0x6e480000 <error: Cannot access memory at address 0x6e480000>, len=-1, max=-1, 
    need_enc=3, have_enc=2) at /usr/src/contrib/libxo/libxo/libxo.c:2715

warning: Source file is more recent than executable.
2715		    if (*cp == '\0')
(gdb) bt
#0  xo_format_string_direct (xop=xop@entry=0x2009b120, xbp=xbp@entry=0x2009b150, flags=flags@entry=4096, wcp=0x0, cp=0x6e480000 <error: Cannot access memory at address 0x6e480000>, len=-1, max=-1, 
    need_enc=3, have_enc=2) at /usr/src/contrib/libxo/libxo/libxo.c:2715
#1  0x20150908 in xo_format_string (xop=0x2009b120, xbp=0x2009b150, flags=4096, xfp=0xbfbfd280) at /usr/src/contrib/libxo/libxo/libxo.c:2982
#2  xo_do_format_field (xop=<optimized out>, xop@entry=0x2009b120, xbp=0x2009b150, fmt=fmt@entry=0x20130635 "%s", flen=flen@entry=2, flags=4096) at /usr/src/contrib/libxo/libxo/libxo.c:3503
#3  0x2014c69c in xo_simple_field (xop=0x2009b120, encode_only=0, value=0x0, vlen=0, fmt=0x20130635 "%s", flen=2, flags=<optimized out>) at /usr/src/contrib/libxo/libxo/libxo.c:3817
#4  xo_format_value (xop=<optimized out>, xop@entry=0x2009b120, name=<optimized out>, name@entry=0x204bf931 "state}\n", nlen=<optimized out>, nlen@entry=5, value=0x0, vlen=0, fmt=0x20130635 "%s", 
    flen=2, encoding=0x0, elen=0, flags=<optimized out>) at /usr/src/contrib/libxo/libxo/libxo.c:4373
#5  0x20148710 in xo_do_emit_fields (xop=<optimized out>, xop@entry=0x2009b120, fields=<optimized out>, fields@entry=0xbfbfd7e8, max_fields=max_fields@entry=17, fmt=<optimized out>)
    at /usr/src/contrib/libxo/libxo/libxo.c:6372
#6  0x201476a0 in xo_do_emit (xop=xop@entry=0x2009b120, flags=<optimized out>, fmt=fmt@entry=0x204bf8e3 "=>{t:start/%*jd}  {t:sectors/%*jd}  {t:name/%*s}  {:scheme}  ({h:size/%ld}){t:state}\n")
    at /usr/src/contrib/libxo/libxo/libxo.c:6551
#7  0x20147840 in xo_emit (fmt=0x204bf8e3 "=>{t:start/%*jd}  {t:sectors/%*jd}  {t:name/%*s}  {:scheme}  ({h:size/%ld}){t:state}\n") at /usr/src/contrib/libxo/libxo/libxo.c:6622
#8  0x204d1fd4 in gpart_show_geom (gp=gp@entry=0x20089168, element=element@entry=0x204bfe51 "type", show_providers=show_providers@entry=0) at /usr/src/lib/geom/part/geom_part.c:654
#9  0x204d1048 in gpart_show (req=0x20089000, fl=<optimized out>) at /usr/src/lib/geom/part/geom_part.c:793
#10 0x000230dc in run_command (argc=0, argv=<optimized out>) at /usr/src/sbin/geom/core/geom.c:497
#11 0x00022308 in main (argc=1, argv=0xbfbfed90) at /usr/src/sbin/geom/core/geom.c:861

armv7 chroot on aarch64 example backtrace:

Program terminated with signal SIGSEGV, Segmentation fault.
Address not mapped to object.
#0  0x200c5ef0 in delete_config (gp=0x2053e224) at /usr/src/lib/libgeom/geom_xml2tree.c:502

warning: Source file is more recent than executable.
502 LIST_REMOVE(cf, lg_config);
(gdb) bt
#0  0x200c5ef0 in delete_config (gp=0x2053e224) at /usr/src/lib/libgeom/geom_xml2tree.c:502
#1  geom_deletetree (gmp=gmp@entry=0xffffcb48) at /usr/src/lib/libgeom/geom_xml2tree.c:524
#2  0x204d2064 in gpart_show (req=<optimized out>, fl=<optimized out>) at /usr/src/lib/geom/part/geom_part.c:797
#3  0x000230dc in run_command (argc=0, argv=<optimized out>) at /usr/src/sbin/geom/core/geom.c:497
#4  0x00022308 in main (argc=1, argv=0xffffdc70) at /usr/src/sbin/geom/core/geom.c:861

The arm7 chroot on aarch64 example outputs some
before the SIGSEGV and the sizes are messed up:

# gpart show 
=>        34  1000215149  nda0  GPT  (2)(null)
          34        2014        - free -  (2)
        2048      532480     1  efi  (517M)
      534528       32768     2  ms-reserved  (517M)
      567296   997287936     3  ms-basic-data  (517M)
   997855232     2359296     4  ms-recovery  (517M)
  1000214528         655        - free -  (2)

=>        34  2930277101  da0  GPT  (0)(null)
          34       32734       - free -  (0)
       32768      501760    1  efi  (517M)
      534528    20971520    2  freebsd-swap  (517M)
    21506048    29360128    3  freebsd-swap  (517M)
    50866176    33554432    4  freebsd-swap  (517M)
    84420608    67108864    5  freebsd-swap  (517M)
   151529472    96468992    6  freebsd-swap  (517M)
   247998464   268435456    7  freebsd-swap  (517M)
   516433920     7340032    8  freebsd-swap  (517M)
   523773952    13096960       - free -  (0)
   536870912  2357198848    9  freebsd-ufs  (517M)
  2894069760    36207375       - free -  (0)

=>        40  1953525088  da1  GPT  (0)(null)
          40      532480    1  efi  (517M)
      532520        2008       - free -  (0)
      534528     3563520    2  freebsd-swap  (517M)
     4098048     6504448       - free -  (0)
    10602496  1740636160    4  freebsd-ufs  (517M)
  1751238656     7546880    3  freebsd-swap  (517M)
  1758785536   194739592       - free -  (0)

Segmentation fault (core dumped)
Comment 1 Mark Millard 2025-12-28 20:45:57 UTC
Created attachment 266613 [details]
Native armv7 context's sysctl kern.geom.confxml output
Comment 2 Mark Millard 2025-12-28 20:50:31 UTC
Created attachment 266614 [details]
aarch64 with armv7 chroot context's sysctl kern.geom.confxml output

Note: The "sysctl kern.geom.confxml" outputs matched when
done from aarch64 and when done from the armv7 chroot. So
I supply only the one copy.
Comment 3 Mark Millard 2025-12-28 20:59:55 UTC
Created attachment 266615 [details]
aarch64 context: diff of armv7 chroot vs. aarch64 gpart show --libxo:JP output
Comment 4 Mark Millard 2025-12-28 21:15:12 UTC
Another of the backtraces reported on the lists
was:

(gdb) bt
#0  strlen () at /usr/src/lib/libc/arm/string/strlen.S:46
#1  0x20151020 in xo_format_string (xop=0x2009b120, xbp=0x2009b150, flags=4096, xfp=0xbfbfd1f8) at /usr/src/contrib/libxo/libxo/libxo.c:2966
#2  xo_do_format_field (xop=<optimized out>, xop@entry=0x2009b120, xbp=0x2009b150, fmt=fmt@entry=0xbfbfd268 "%s", flen=<optimized out>, flags=4096) at /usr/src/contrib/libxo/libxo/libxo.c:3503
#3  0x2014d0a8 in xo_simple_field (xop=0x2009b120, encode_only=0, value=0x0, vlen=0, fmt=0xbfbfd268 "%s", flen=2, flags=4096) at /usr/src/contrib/libxo/libxo/libxo.c:3817
#4  xo_format_value (xop=<optimized out>, xop@entry=0x2009b120, name=name@entry=0x204bf931 "state}\n", nlen=nlen@entry=5, value=0x0, vlen=0, fmt=0xbfbfd268 "%s", flen=2, encoding=0x0, elen=0,
 flags=4096) at /usr/src/contrib/libxo/libxo/libxo.c:4535
#5  0x20148710 in xo_do_emit_fields (xop=<optimized out>, xop@entry=0x2009b120, fields=<optimized out>, fields@entry=0xbfbfd768, max_fields=max_fields@entry=17, fmt=<optimized out>)
 at /usr/src/contrib/libxo/libxo/libxo.c:6372
#6  0x201476a0 in xo_do_emit (xop=xop@entry=0x2009b120, flags=<optimized out>, fmt=fmt@entry=0x204bf8e3 "=>{t:start/%*jd}  {t:sectors/%*jd}  {t:name/%*s}  {:scheme}  ({h:size/%ld}){t:state}\n")
 at /usr/src/contrib/libxo/libxo/libxo.c:6551
#7  0x20147840 in xo_emit (fmt=0x204bf8e3 "=>{t:start/%*jd}  {t:sectors/%*jd}  {t:name/%*s}  {:scheme}  ({h:size/%ld}){t:state}\n") at /usr/src/contrib/libxo/libxo/libxo.c:6622
#8  0x204d1fd4 in gpart_show_geom (gp=gp@entry=0x20089168, element=element@entry=0x204bfe51 "type", show_providers=show_providers@entry=0) at /usr/src/lib/geom/part/geom_part.c:654
#9  0x204d1048 in gpart_show (req=0x20089000, fl=<optimized out>) at /usr/src/lib/geom/part/geom_part.c:793
#10 0x000230dc in run_command (argc=0, argv=<optimized out>) at /usr/src/sbin/geom/core/geom.c:497
#11 0x00022308 in main (argc=1, argv=0xbfbfed10) at /usr/src/sbin/geom/core/geom.c:861
Comment 5 Mark Millard 2025-12-28 21:30:06 UTC
Some notes from the list for the native Cortex-A7
(armv7) context:

# uname -apKU
FreeBSD OPiP2E-RPi2v1p1 16.0-CURRENT FreeBSD 16.0-CURRENT main-n282732-939ac0c8fde2 GENERIC-NODEBUG arm armv7 1600007 1600007

That is an official pkgbase distribution that I installed, not
a personal build. pkgbase for main has world being a debug
build, no matter which of the kernels one choses to boot.
For pkgbase, 939ac0c8fde2 would be correct(?) for the kernel
but might not be exact for the world: /usr/src/sys/ and
/usr/src/ (without sys/) are from different times, last I
knew anyway. Changes can happen between.

During boot, the time on the Orange Pi Plus 2ed is bad so:

# ls -lodT /gpart.core 
-rw-------  1 root wheel nodump 3174400 Jan  1 00:01:01 2010 /gpart.core

Also, for pkgbase, a source file distributed can be newer
for its time stamp than the program distributed that was
based on the source file.
Comment 6 Mark Millard 2025-12-28 22:55:45 UTC
I've found a problem: use of %ld notation which is not an
invariant match to off_t and the like across FreeBSD
platforms: off_t is 64 bits across FreeBSD platforms
but long is not (and so %ld is not):

+ xo_emit("=>{t:start/%*jd} {t:sectors/%*jd} {t:name/%*s} {:scheme} ({h:size/%ld}){t:state}\n",
. . .
+ xo_emit(" {t:start/%*jd} {t:sectors/%*jd} {P:/%*s} {ne:free}- free - ({h:size/%ld})\n",
. . . 
+ xo_emit(" ({h:size/%ld})\n", pp->lg_mediasize);
. . .
+ xo_emit(" {t:start/%*jd} {t:sectors/%*jd} {P:/%*s} {ne:free}- free - ({h:size/%ld})\n",

%ld is for long but:

. . .
           Architecture   long   void *   long double   time_t
           aarch64        8      8        16            8
           aarch64c       8      16       16            8
           amd64          8      8        16            8
           armv7          4      4        8             8
           i386           4      4        12            4
. . .

The code would be broken in this way for i386 as well.
Comment 7 Johan Söllvander freebsd_committer freebsd_triage 2025-12-29 07:01:34 UTC
As I mentioned in the email chain; I'll look at this but my time is still very limited during the holidays.
Comment 8 Dag-Erling Smørgrav freebsd_committer freebsd_triage 2025-12-29 11:59:27 UTC
https://reviews.freebsd.org/D54393
Comment 9 commit-hook freebsd_committer freebsd_triage 2025-12-29 13:22:40 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=faff7013187b03f4240af6f52f608e7ebafe19f3

commit faff7013187b03f4240af6f52f608e7ebafe19f3
Author:     Dag-Erling Smørgrav <des@FreeBSD.org>
AuthorDate: 2025-12-29 13:20:52 +0000
Commit:     Dag-Erling Smørgrav <des@FreeBSD.org>
CommitDate: 2025-12-29 13:20:52 +0000

    geom_part: Fix format string issues

    This fixes a segfault on i386 and armv7 and numerous style violations.

    PR:             292008
    Fixes:          4f809ffec69c ("gpart: add libxo support for "show" subcommand + man page updates")
    Reviewed by:    js
    Differential Revision:  https://reviews.freebsd.org/D54393

 lib/geom/part/geom_part.c | 69 +++++++++++++++++++++++++++--------------------
 1 file changed, 40 insertions(+), 29 deletions(-)
Comment 10 Mark Millard 2025-12-30 05:30:33 UTC
(In reply to commit-hook from comment #9)

So far I've only looked at my armv7 chroot on aarch64
context.

The size figures now make sense, fixing the one aspect
that was %ld use looks good.

But . . .

# gpart show 
=>        34  1000215149  nda0  GPT  (0)
          34        2014        - free -  (0)
        2048      532480     1  efi  (260M)
      534528       32768     2  ms-reserved  (16M)
      567296   997287936     3  ms-basic-data  (476G)
   997855232     2359296     4  ms-recovery  (1G)
  1000214528         655        - free -  (0)

=>        34  2930277101  da0  GPT  (0)
          34       32734       - free -  (0)
       32768      501760    1  efi  (245M)
      534528    20971520    2  freebsd-swap  (10G)
    21506048    29360128    3  freebsd-swap  (14G)
    50866176    33554432    4  freebsd-swap  (16G)
    84420608    67108864    5  freebsd-swap  (32G)
   151529472    96468992    6  freebsd-swap  (46G)
   247998464   268435456    7  freebsd-swap  (128G)
   516433920     7340032    8  freebsd-swap  (4G)
   523773952    13096960       - free -  (0)
   536870912  2357198848    9  freebsd-ufs  (1T)
  2894069760    36207375       - free -  (0)

Segmentation fault (core dumped)

So there is another problem of some kind.

For reference:

Core was generated by `gpart show'.
Program terminated with signal SIGSEGV, Segmentation fault.
Address not mapped to object.
#0  0x200c5ef0 in delete_config (gp=0x2053c1dc) at /usr/src/lib/libgeom/geom_xml2tree.c:502

warning: Source file is more recent than executable.
502			LIST_REMOVE(cf, lg_config);
(gdb) bt
#0  0x200c5ef0 in delete_config (gp=0x2053c1dc) at /usr/src/lib/libgeom/geom_xml2tree.c:502
#1  geom_deletetree (gmp=gmp@entry=0xffffcb30) at /usr/src/lib/libgeom/geom_xml2tree.c:524
#2  0x204d2064 in gpart_show (req=<optimized out>, fl=<optimized out>) at /home/pkgbuild/worktrees/main/lib/geom/part/geom_part.c:808
#3  0x000230dc in run_command (argc=0, argv=<optimized out>) at /usr/src/sbin/geom/core/geom.c:497
#4  0x00022308 in main (argc=1, argv=0xffffdc5c) at /usr/src/sbin/geom/core/geom.c:861
(gdb) 

I will not have time tonight to gather more information or
too see if I can notice anything else looking odd in the
source code.

As a valid bug ws fixed, I'll generate another bugzilla.
Comment 11 Mark Millard 2025-12-30 06:07:53 UTC
(In reply to Mark Millard from comment #10)

This is an example were the pkgbase kernel
version shown by "uname -apKU" does not match
the later world source version that was used.

# grep %ld /usr/src/lib/geom/part/geom_part.c
# 

but 3088263177da in:

# uname -aoKU
FreeBSD aarch64-main-pbase 16.0-CURRENT FreeBSD 16.0-CURRENT main-n282760-3088263177da GENERIC-NODEBUG arm 1600007 1600007

in https://lists.freebsd.org/archives/dev-commits-src-main/2025-December/date.html

order predates (pretimes) the %ld replacements in geom_part.c :

git: 3088263177da - main - man pages: provide some description for extended errors Konstantin Belousov
. . .
git: faff7013187b - main - geom_part: Fix format string issues Dag-Erling Smørgrav
Comment 12 Mark Millard 2025-12-30 22:03:07 UTC
(In reply to Mark Millard from comment #10)

Just an FYI: 

This SIGSEGV does not occur on the real armv7
example boot with a armv7 kernel.

It only occurs via the likes of chroot use or
lib32 use (GEOM_LIBRARY_PATH set to find the
lib32 libraries) on aarch64.

Thus, my first guess is an aarch64  kernel armv7
compatibility bug is involved for the SIGSEGV
that now is reached.
Comment 13 Mark Millard 2025-12-31 05:28:21 UTC
Hmm . . .

/usr/include/libgeom.h: off_t                   lg_mediasize;
/usr/include/libgeom.h: u_int                   lg_sectorsize;
/usr/include/libgeom.h: off_t                   lg_stripesize;

but:

/usr/src/lib/libgeom/geom_xml2tree.c:           mt->provider->lg_mediasize = strtoumax(p, NULL, 0);
/usr/src/lib/libgeom/geom_xml2tree.c:           mt->provider->lg_sectorsize = strtoul(p, NULL, 0);
/usr/src/lib/libgeom/geom_xml2tree.c:           mt->provider->lg_stripesize = strtoumax(p, NULL, 0);

Note that "ul" in strtoul(p, NULL, 0) varies across platforms:
64 bit platforms: 64 bit, 32 bit platforms: 32 bit. But
u_int is likely always 32 bit.

For the others: off_t is 64 bit and is matched up with
strtoumax .
Comment 14 Dag-Erling Smørgrav freebsd_committer freebsd_triage 2025-12-31 09:18:46 UTC
I'll look into it, but can you please stop treating our bug tracker and mailing lists as your personal blog?  A simple “I'm still getting a segfault after the patch” would have sufficed.
Comment 15 Dag-Erling Smørgrav freebsd_committer freebsd_triage 2026-01-02 09:45:45 UTC
The remaining segfault is in libgeom and is unrelated to the libxo conversion, see bug 292127.
Comment 16 commit-hook freebsd_committer freebsd_triage 2026-01-05 14:45:50 UTC
A commit in branch stable/15 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=24808463c1f3514a53e20b7c99c2df50b48c4a47

commit 24808463c1f3514a53e20b7c99c2df50b48c4a47
Author:     Johan Söllvander <js@FreeBSD.org>
AuthorDate: 2025-12-18 15:06:09 +0000
Commit:     Johan Söllvander <js@FreeBSD.org>
CommitDate: 2026-01-05 14:40:49 +0000

    gpart: add libxo support for "show" subcommand + man page updates

    Added libxo support to `gpart show`, also updated the man
    pages for geom and gpart to show where you can expect
    libxo formatted output.

    PR:                     290629
    Sponsored by:           ConnectWise
    Reviewed by:            asomers, mckusick, phil
    Approved by:            asomers (mentor)
    Differential Revision:  https://reviews.freebsd.org/D53950

    (cherry picked from commit 4f809ffec69cd6ede3e7be9a5bc876b2e5931028)

    geom_part: Fix format string issues

    This fixes a segfault on i386 and armv7 and numerous style violations.

    PR:             292008
    Fixes:          4f809ffec69c ("gpart: add libxo support for "show" subcommand + man page updates")
    Reviewed by:    js
    Differential Revision:  https://reviews.freebsd.org/D54393

    (cherry picked from commit faff7013187b03f4240af6f52f608e7ebafe19f3)

 lib/geom/part/Makefile    |   2 +-
 lib/geom/part/geom_part.c | 107 +++++++++++++++++++++++++++++++---------------
 lib/geom/part/gpart.8     |  11 ++++-
 sbin/geom/core/geom.8     |  12 +++++-
 4 files changed, 95 insertions(+), 37 deletions(-)
Comment 17 commit-hook freebsd_committer freebsd_triage 2026-01-05 14:48:52 UTC
A commit in branch stable/14 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=76df3f6f3680556c777e2e13565c9e217c12d5b1

commit 76df3f6f3680556c777e2e13565c9e217c12d5b1
Author:     Johan Söllvander <js@FreeBSD.org>
AuthorDate: 2025-12-18 15:06:09 +0000
Commit:     Johan Söllvander <js@FreeBSD.org>
CommitDate: 2026-01-05 14:47:18 +0000

    gpart: add libxo support for "show" subcommand + man page updates

    Added libxo support to `gpart show`, also updated the man
    pages for geom and gpart to show where you can expect
    libxo formatted output.

    PR:                     290629
    Sponsored by:           ConnectWise
    Reviewed by:            asomers, mckusick, phil
    Approved by:            asomers (mentor)
    Differential Revision:  https://reviews.freebsd.org/D53950

    (cherry picked from commit 4f809ffec69cd6ede3e7be9a5bc876b2e5931028)

    geom_part: Fix format string issues

    This fixes a segfault on i386 and armv7 and numerous style violations.

    PR:             292008
    Fixes:          4f809ffec69c ("gpart: add libxo support for "show" subcommand + man page updates")
    Reviewed by:    js
    Differential Revision:  https://reviews.freebsd.org/D54393

    (cherry picked from commit faff7013187b03f4240af6f52f608e7ebafe19f3)

 lib/geom/part/Makefile    |   2 +-
 lib/geom/part/geom_part.c | 107 +++++++++++++++++++++++++++++++---------------
 lib/geom/part/gpart.8     |  11 ++++-
 sbin/geom/core/geom.8     |  12 +++++-
 4 files changed, 95 insertions(+), 37 deletions(-)