Bug#1099509: di: segfaults with `-I` flag

[Jan Christoph Uhde]

Package: di
Version: 5.0.12-1
Severity: normal

Dear Maintainer,


di fails like:

» /usr/bin/di -I ext3,ext4,ntfs
Segmentation fault

[Tue Mar 4 09:50:07 2025] Code: cf 6b 10 00 48 8d 3d 55 c9 10 00 e8 20 60 f9 ff 48 85 ff 0f 84 bf 00 00 00 55 48 8d 77 f0 53 48 83 ec 18 48 8b 1d 16 4a 14 00 <48> 8b 47 f8 64 8b 2b a8 02 75 5b 48 8b 15 a4 49 14 00 64 48 83 3a
[Tue Mar 4 09:51:03 2025] di[111406]: segfault at fffffffffffffff7 ip 00007effef8ff3ea sp 00007ffc9d6d2060 error 5 in libc.so.6[a23ea,7effef885000+165000] likely on CPU 0 (core 0, socket 0)
[Tue Mar 4 09:51:03 2025] Code: cf 6b 10 00 48 8d 3d 55 c9 10 00 e8 20 60 f9 ff 48 85 ff 0f 84 bf 00 00 00 55 48 8d 77 f0 53 48 83 ec 18 48 8b 1d 16 4a 14 00 <48> 8b 47 f8 64 8b 2b a8 02 75 5b 48 8b 15 a4 49 14 00 64 48 83 3a

mprotect(0x7f72bb30a000, 53248, PROT_READ) = 0
mprotect(0x7f72bb36d000, 8192, PROT_READ) = 0
mprotect(0x7f72bb38e000, 4096, PROT_READ) = 0
mprotect(0x7f72bb3bd000, 8192, PROT_READ) = 0
mprotect(0x7f72bb5c4000, 4096, PROT_READ) = 0
mprotect(0x55c2df8b8000, 4096, PROT_READ) = 0
mprotect(0x7f72bb625000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x7f72bb5c6000, 147302) = 0
getrandom("\x67\xb4\x1f\xa8\xac\xb7\x32\xbc", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55c2ed22a000
brk(0x55c2ed24b000) = 0x55c2ed24b000
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=3425136, ...}) = 0
mmap(NULL, 3425136, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f72bae00000
close(3) = 0
openat(AT_FDCWD, "/etc/mtab", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(3, "sysfs /sys sysfs rw,nosuid,nodev"..., 1024) = 1024
brk(0x55c2ed26c000) = 0x55c2ed26c000
read(3, "nosuid,nodev,noexec,relatime 0 0"..., 1024) = 1024
brk(0x55c2ed28d000) = 0x55c2ed28d000
read(3, "/smb/hammer autofs rw,relatime"..., 1024) = 1024
brk(0x55c2ed2ae000) = 0x55c2ed2ae000
brk(0x55c2ed2cf000) = 0x55c2ed2cf000
read(3, "ev/nvme1n1p1 /boot/efi vfat rw,r"..., 1024) = 1024
read(3, "node64,noswap 0 0\ntmpfs /run/cre"..., 1024) = 1024
brk(0x55c2ed2f0000) = 0x55c2ed2f0000
read(3, "=barz,uid=1000,forceuid,gid=10"..., 1024) = 952
read(3, "", 1024) = 0
close(3) = 0
newfstatat(AT_FDCWD, "/dev/mapper/nvme990pro-root", {st_mode=S_IFBLK|0660, st_rdev=makedev(0xfd, 0x1), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/nvme1n1p3", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x103, 0x4), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sda1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x1), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/mapper/nvme990pro-var", {st_mode=S_IFBLK|0660, st_rdev=makedev(0xfd, 0x2), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/mapper/nvme990pro-home", {st_mode=S_IFBLK|0660, st_rdev=makedev(0xfd, 0x4), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/nvme1n1p1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x103, 0x2), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sdf1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x51), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sdb2", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x12), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sdc1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x21), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sdd1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x31), ...}, 0) = 0
newfstatat(AT_FDCWD, "//bar.foo.org/pliers", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "//bar.foo.org/hammer", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "//bar.foo.org/wrench", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "//bar.foo.org/nail", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "//baz.foo.org/cutter", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
geteuid() = 1000
getegid() = 1000
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xfffffffffffffff7} ---
+++ killed by SIGSEGV +++
Segmentation fault


(gdb) run
Starting program: /usr/bin/di -I ext4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7e381a2 in __GI___libc_free (mem=0xffffffffffffffff) at ./malloc/malloc.c:3453
warning: 3453 ./malloc/malloc.c: No such file or directory
(gdb) bt full
#0 0x00007ffff7e381a2 in __GI___libc_free (mem=0xffffffffffffffff) at ./malloc/malloc.c:3453
ar_ptr = <optimized out>
p = <optimized out>
err = <optimized out>
#1 0x00007ffff7d4bad6 in mp_clear () from /lib/x86_64-linux-gnu/libtommath.so.1
No symbol table info available.
#2 0x00007ffff7f8feb7 in ?? () from /lib/x86_64-linux-gnu/libdi.so.5
No symbol table info available.
#3 0x00007ffff7f91198 in di_get_all_disk_info () from /lib/x86_64-linux-gnu/libdi.so.5
No symbol table info available.
#4 0x0000555555556314 in ?? ()
No symbol table info available.
#5 0x00007ffff7dbeca8 in __libc_start_call_main (main=***@entry=0x555555556220, argc=***@entry=3, argv=***@entry=0x7fffffffa8b8) at ../sysdeps/nptl/libc_start_call_main.h:58
self = <optimized out>
result = <optimized out>
unwind_buf = {
cancel_jmp_buf = {{
jmp_buf = {140737488332984, 8060722622596814274, 0, 140737488333016, 140737354125312, 93824992255064, -8060722621245778494, -8060705340304353854},
mask_was_saved = 0
}},
priv = {
pad = {0x0, 0x0, 0x7fffffffa8b8, 0x3},
data = {
prev = 0x0,
cleanup = 0x0,
canceltype = -22344
}
}
}
not_first_call = <optimized out>
#6 0x00007ffff7dbed65 in __libc_start_main_impl (main=0x555555556220, argc=3, argv=0x7fffffffa8b8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffa8a8)
at ../csu/libc-start.c:360
No locals.
#7 0x0000555555556791 in ?? ()
No symbol table info available.


-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (600, 'unstable'), (500, 'unstable-debug')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.12.16-amd64 (SMP w/48 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages di depends on:
ii libc6 2.40-7
ii libdi5 5.0.12-1

di recommends no packages.

[Michael Ablassmeier]

hi Brad,

hope all is well.
Ive received following bug report for the debian package 5.0.12.
Chances this is fixed in 5.0.13 ive uploaded recently?

----- Forwarded message from Jan Christoph Uhde <***@obiwahn.org> -----

From: Jan Christoph Uhde <***@obiwahn.org>
Date: Tue, 04 Mar 2025 10:07:44 +0100
To: Debian Bug Tracking System <***@bugs.debian.org>
Subject: Bug#1099509: di: segfaults with `-I` flag
Reply-To: Jan Christoph Uhde <***@obiwahn.org>, ***@bugs.debian.org

Package: di
Version: 5.0.12-1
Severity: normal

Dear Maintainer,


di fails like:

» /usr/bin/di -I ext3,ext4,ntfs
Segmentation fault

[Tue Mar 4 09:50:07 2025] Code: cf 6b 10 00 48 8d 3d 55 c9 10 00 e8 20 60 f9 ff 48 85 ff 0f 84 bf 00 00 00 55 48 8d 77 f0 53 48 83 ec 18 48 8b 1d 16 4a 14 00 <48> 8b 47 f8 64 8b 2b a8 02 75 5b 48 8b 15 a4 49 14 00 64 48 83 3a
[Tue Mar 4 09:51:03 2025] di[111406]: segfault at fffffffffffffff7 ip 00007effef8ff3ea sp 00007ffc9d6d2060 error 5 in libc.so.6[a23ea,7effef885000+165000] likely on CPU 0 (core 0, socket 0)
[Tue Mar 4 09:51:03 2025] Code: cf 6b 10 00 48 8d 3d 55 c9 10 00 e8 20 60 f9 ff 48 85 ff 0f 84 bf 00 00 00 55 48 8d 77 f0 53 48 83 ec 18 48 8b 1d 16 4a 14 00 <48> 8b 47 f8 64 8b 2b a8 02 75 5b 48 8b 15 a4 49 14 00 64 48 83 3a

mprotect(0x7f72bb30a000, 53248, PROT_READ) = 0
mprotect(0x7f72bb36d000, 8192, PROT_READ) = 0
mprotect(0x7f72bb38e000, 4096, PROT_READ) = 0
mprotect(0x7f72bb3bd000, 8192, PROT_READ) = 0
mprotect(0x7f72bb5c4000, 4096, PROT_READ) = 0
mprotect(0x55c2df8b8000, 4096, PROT_READ) = 0
mprotect(0x7f72bb625000, 8192, PROT_READ) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
munmap(0x7f72bb5c6000, 147302) = 0
getrandom("\x67\xb4\x1f\xa8\xac\xb7\x32\xbc", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x55c2ed22a000
brk(0x55c2ed24b000) = 0x55c2ed24b000
openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=3425136, ...}) = 0
mmap(NULL, 3425136, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f72bae00000
close(3) = 0
openat(AT_FDCWD, "/etc/mtab", O_RDONLY|O_CLOEXEC) = 3
fstat(3, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
read(3, "sysfs /sys sysfs rw,nosuid,nodev"..., 1024) = 1024
brk(0x55c2ed26c000) = 0x55c2ed26c000
read(3, "nosuid,nodev,noexec,relatime 0 0"..., 1024) = 1024
brk(0x55c2ed28d000) = 0x55c2ed28d000
read(3, "/smb/hammer autofs rw,relatime"..., 1024) = 1024
brk(0x55c2ed2ae000) = 0x55c2ed2ae000
brk(0x55c2ed2cf000) = 0x55c2ed2cf000
read(3, "ev/nvme1n1p1 /boot/efi vfat rw,r"..., 1024) = 1024
read(3, "node64,noswap 0 0\ntmpfs /run/cre"..., 1024) = 1024
brk(0x55c2ed2f0000) = 0x55c2ed2f0000
read(3, "=barz,uid=1000,forceuid,gid=10"..., 1024) = 952
read(3, "", 1024) = 0
close(3) = 0
newfstatat(AT_FDCWD, "/dev/mapper/nvme990pro-root", {st_mode=S_IFBLK|0660, st_rdev=makedev(0xfd, 0x1), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/nvme1n1p3", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x103, 0x4), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sda1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x1), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/mapper/nvme990pro-var", {st_mode=S_IFBLK|0660, st_rdev=makedev(0xfd, 0x2), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/mapper/nvme990pro-home", {st_mode=S_IFBLK|0660, st_rdev=makedev(0xfd, 0x4), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/nvme1n1p1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x103, 0x2), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sdf1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x51), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sdb2", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x12), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sdc1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x21), ...}, 0) = 0
newfstatat(AT_FDCWD, "/dev/sdd1", {st_mode=S_IFBLK|0660, st_rdev=makedev(0x8, 0x31), ...}, 0) = 0
newfstatat(AT_FDCWD, "//bar.foo.org/pliers", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "//bar.foo.org/hammer", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "//bar.foo.org/wrench", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "//bar.foo.org/nail", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
newfstatat(AT_FDCWD, "//baz.foo.org/cutter", 0x7fff825086f0, 0) = -1 ENOENT (No such file or directory)
geteuid() = 1000
getegid() = 1000
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0xfffffffffffffff7} ---
+++ killed by SIGSEGV +++
Segmentation fault


(gdb) run
Starting program: /usr/bin/di -I ext4
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7e381a2 in __GI___libc_free (mem=0xffffffffffffffff) at ./malloc/malloc.c:3453
warning: 3453 ./malloc/malloc.c: No such file or directory
(gdb) bt full
#0 0x00007ffff7e381a2 in __GI___libc_free (mem=0xffffffffffffffff) at ./malloc/malloc.c:3453
ar_ptr = <optimized out>
p = <optimized out>
err = <optimized out>
#1 0x00007ffff7d4bad6 in mp_clear () from /lib/x86_64-linux-gnu/libtommath.so.1
No symbol table info available.
#2 0x00007ffff7f8feb7 in ?? () from /lib/x86_64-linux-gnu/libdi.so.5
No symbol table info available.
#3 0x00007ffff7f91198 in di_get_all_disk_info () from /lib/x86_64-linux-gnu/libdi.so.5
No symbol table info available.
#4 0x0000555555556314 in ?? ()
No symbol table info available.
#5 0x00007ffff7dbeca8 in __libc_start_call_main (main=***@entry=0x555555556220, argc=***@entry=3, argv=***@entry=0x7fffffffa8b8) at ../sysdeps/nptl/libc_start_call_main.h:58
self = <optimized out>
result = <optimized out>
unwind_buf = {
cancel_jmp_buf = {{
jmp_buf = {140737488332984, 8060722622596814274, 0, 140737488333016, 140737354125312, 93824992255064, -8060722621245778494, -8060705340304353854},
mask_was_saved = 0
}},
priv = {
pad = {0x0, 0x0, 0x7fffffffa8b8, 0x3},
data = {
prev = 0x0,
cleanup = 0x0,
canceltype = -22344
}
}
}
not_first_call = <optimized out>
#6 0x00007ffff7dbed65 in __libc_start_main_impl (main=0x555555556220, argc=3, argv=0x7fffffffa8b8, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffa8a8)
at ../csu/libc-start.c:360
No locals.
#7 0x0000555555556791 in ?? ()
No symbol table info available.


-- System Information:
Debian Release: trixie/sid
APT prefers unstable
APT policy: (600, 'unstable'), (500, 'unstable-debug')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 6.12.16-amd64 (SMP w/48 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages di depends on:
ii libc6 2.40-7
ii libdi5 5.0.12-1

di recommends no packages.

di suggests no packages.

-- no debconf information

----- End forwarded message -----

[Jan Christoph Uhde]

Unfortunately I am not too good in C debugging. Maybe something in the option parsing is already broken.


» LD_PRELOAD=/usr/lib/x86_64-linux-gnu/libasan.so.8:./libdi.so.5 ./di -I ext4
FilesystemMountSizeUsedAvail%UsedType

=================================================================
==129349==ERROR: LeakSanitizer: detected memory leaks

Direct leak of 5 byte(s) in 1 object(s) allocated from:
#0 0x7fa7574f4c77 in malloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:69
#1 0x7fa757c8a7d6 in parseList /home-nvme/foo/di-5.0.13/dioptions.c:549
#2 0x7fa757c8ad84 in processOptionsVal /home-nvme/foo/di-5.0.13/dioptions.c:478
#3 0x7fa757c8965f in process_opt /home-nvme/foo/di-5.0.13/getoptn.c:261
#4 0x7fa757c8965f in getoptn /home-nvme/foo/di-5.0.13/getoptn.c:354
#5 0x7fa757c8b8b4 in processArgs /home-nvme/foo/di-5.0.13/dioptions.c:407
#6 0x7fa757c8e4a8 in di_get_options /home-nvme/foo/di-5.0.13/dioptions.c:281
#7 0x7fa757c81c98 in di_process_options /home-nvme/foo/di-5.0.13/dilib.c:204
#8 0x55ed95ea23a1 in main /home-nvme/foo/di-5.0.13/di.c:163
#9 0x7fa757233ca7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58

SUMMARY: AddressSanitizer: 5 byte(s) leaked in 1 allocation(s).


otherwise this is the best bt i can offer:


#8 __GI___libc_free (mem=0x55555555d624) at ./malloc/malloc.c:3476
ar_ptr = 0x7ffff7f7dac0 <main_arena>
p = 0x55555555d614
err = 2
#9 0x00007ffff7fb4834 in dinum_clear (r=0x7fffffffa490) at /home-nvme/foo/di-5.0.13/dimath.h:118
No locals.
#10 checkDiskQuotas (di_data=***@entry=0x55555555c430) at /home-nvme/foo/di-5.0.13/dilib.c:1161
i = <optimized out>
j = 0
uid = 1000
gid = 1000
diqinfo = {
filesystem = 0xffffffffffffffff <error: Cannot access memory at address 0xffffffffffffffff>,
mountpt = 0x3000055e3f0 <error: Cannot access memory at address 0x3000055e3f0>,
fstype = 0x0,
uid = 1432437704,
gid = 21845,
values = {{{
_mp_alloc = 46,
_mp_size = 0,
_mp_d = 0x55555555d624
}}, {{
_mp_alloc = 1432438072,
_mp_size = 21845,
_mp_d = 0x1
}}, {{
_mp_alloc = -134500720,
_mp_size = 32767,
_mp_d = 0x7ffff7fb4163 <di_sort_disk_info+787>
}}, {{
_mp_alloc = 0,
_mp_size = 0,
_mp_d = 0x55555555d624
}}, {{
_mp_alloc = 0,
_mp_size = 19,
_mp_d = 0x5555556158a0
}}}
}
diopts = 0x55555555c5e0
#11 0x00007ffff7fb61b8 in di_get_all_disk_info (tdi_data=***@entry=0x55555555c430) at /home-nvme/foo/di-5.0.13/dilib.c:337
di_data = 0x55555555c430
diopts = 0x55555555c5e0
hasLoop = <optimized out>
#12 0x0000555555556310 in main (argc=3, argv=0x7fffffffa848) at /home-nvme/foo/di-5.0.13/di.c:189
di_data = 0x55555555c430
exitflag = <optimized out>