cpufreqd buffer overflow detected

Bug #1162160 reported by Samuele Maggioni
264
This bug affects 57 people
Affects Status Importance Assigned to Milestone
cpufreqd (Ubuntu)
Fix Released
High
Adam Conrad
Saucy
Fix Released
High
Unassigned

Bug Description

SRU REQUEST TO SAUCY
====================

IMPACT
------

cpufreqd doesn't start at all in saucy, crashing immediately:

* Starting CPU Frequency daemon cpufreqd *** buffer overflow detected ***: /usr/sbin/cpufreqd terminated
======= Backtrace: =========
/lib/i386-linux-gnu/libc.so.6(__fortify_fail+0x63)[0xb7616bc3]
/lib/i386-linux-gnu/libc.so.6(+0x10593a)[0xb761593a]
/lib/i386-linux-gnu/libc.so.6(+0x1060e7)[0xb76160e7]
/usr/sbin/cpufreqd(main+0x31d)[0x804a10d]
/lib/i386-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0xb7529935]
/usr/sbin/cpufreqd[0x804b40d]
======= Memory map: ========
08048000-08052000 r-xp 00000000 08:05 2343 /usr/sbin/cpufreqd
08052000-08053000 r--p 0000a000 08:05 2343 /usr/sbin/cpufreqd
08053000-08054000 rw-p 0000b000 08:05 2343 /usr/sbin/cpufreqd
088fa000-0891b000 rw-p 00000000 00:00 0 [heap]
b750f000-b7510000 rw-p 00000000 00:00 0
b7510000-b76bd000 r-xp 00000000 08:05 153114 /lib/i386-linux-gnu/libc-2.17.so
b76bd000-b76bf000 r--p 001ad000 08:05 153114 /lib/i386-linux-gnu/libc-2.17.so
b76bf000-b76c0000 rw-p 001af000 08:05 153114 /lib/i386-linux-gnu/libc-2.17.so
b76c0000-b76c4000 rw-p 00000000 00:00 0
b76c4000-b76c9000 r-xp 00000000 08:05 19603 /usr/lib/libcpufreq.so.0.0.0
b76c9000-b76ca000 r--p 00004000 08:05 19603 /usr/lib/libcpufreq.so.0.0.0
b76ca000-b76cb000 rw-p 00005000 08:05 19603 /usr/lib/libcpufreq.so.0.0.0
b76cb000-b76ce000 r-xp 00000000 08:05 153098 /lib/i386-linux-gnu/libdl-2.17.so
b76ce000-b76cf000 r--p 00002000 08:05 153098 /lib/i386-linux-gnu/libdl-2.17.so
b76cf000-b76d0000 rw-p 00003000 08:05 153098 /lib/i386-linux-gnu/libdl-2.17.so
b76d2000-b76ed000 r-xp 00000000 08:05 132175 /lib/i386-linux-gnu/libgcc_s.so.1
b76ed000-b76ee000 r--p 0001a000 08:05 132175 /lib/i386-linux-gnu/libgcc_s.so.1
b76ee000-b76ef000 rw-p 0001b000 08:05 132175 /lib/i386-linux-gnu/libgcc_s.so.1
b76ef000-b76f2000 rw-p 00000000 00:00 0
b76f2000-b76f3000 r-xp 00000000 00:00 0 [vdso]
b76f3000-b7713000 r-xp 00000000 08:05 153124 /lib/i386-linux-gnu/ld-2.17.so
b7713000-b7714000 r--p 0001f000 08:05 153124 /lib/i386-linux-gnu/ld-2.17.so
b7714000-b7715000 rw-p 00020000 08:05 153124 /lib/i386-linux-gnu/ld-2.17.so
bfbe6000-bfc07000 rw-p 00000000 00:00 0 [stack]
Aborted (core dumped)

[TEST CASE]
-----------

Install cpufreqd
Observe crash

[REGRESSION POTENTIAL]
----------------------

none

[OTHER INFO]
------------

https://launchpadlibrarian.net/149166786/cpufreqd.git-b5b23525edcc09898288360c48e92b4a6c9cb0ee.patch is the fix for the crash and fixed in trusty.

Related branches

Revision history for this message
Samuele Maggioni (samuele-maggioni) wrote :
Revision history for this message
Launchpad Janitor (janitor) wrote :

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in cpufreqd (Ubuntu):
status: New → Confirmed
Revision history for this message
kakurasan (kakurasan) wrote :

Workaround: don't use "-f" option
(unnecessary if using /etc/cpufreqd.conf)

Revision history for this message
hgre (hendrik-grewe) wrote :

@kakurasan

the workaround did not work for me.

Also on 13.04 with Acer Aspire TimelineX 4830tg

Revision history for this message
Tamas Tarjanyi (tamas-tarjanyi) wrote :

To me the workaround from @kakurasan is working fine on 13.04

Thanks for the workaround @kakurasan !!!

Revision history for this message
Alfredo Pacheco Jr (alfredo-pacheco32) wrote :
Download full text (10.3 KiB)

I have upgraded to Lubuntu 13.04 on a Toshiba Satellite A135-S4427.
Cpufreqd crashes on system start up only. I then have to open the task manager, track the PID of the "running" cpufreqd, and kill it in the terminal.

Once the process is killed, I just start go to my cpufreqd icon on the bottom right bar and select performance. It starts up again, but does not crash.

The crash report, it states:

ProblemType: Crash
Architecture: i386
CrashCounter: 1
Date: Fri May 3 02:47:48 2013
DistroRelease: Ubuntu 13.04
ExecutablePath: /usr/sbin/cpufreqd
ExecutableTimestamp: 1364500746
ProcCmdline: /usr/sbin/cpufreqd -f /etc/cpufreqd.conf
ProcCwd: /
ProcEnviron:
 TERM=linux
 PATH=(custom, no user)
ProcMaps:
 08048000-08052000 r-xp 00000000 08:01 2888613 /usr/sbin/cpufreqd
 08052000-08053000 r--p 0000a000 08:01 2888613 /usr/sbin/cpufreqd
 08053000-08054000 rw-p 0000b000 08:01 2888613 /usr/sbin/cpufreqd
 0910c000-0912d000 rw-p 00000000 00:00 0 [heap]
 b757b000-b7596000 r-xp 00000000 08:01 791763 /lib/i386-linux-gnu/libgcc_s.so.1
 b7596000-b7597000 r--p 0001a000 08:01 791763 /lib/i386-linux-gnu/libgcc_s.so.1
 b7597000-b7598000 rw-p 0001b000 08:01 791763 /lib/i386-linux-gnu/libgcc_s.so.1
 b75b2000-b75b3000 rw-p 00000000 00:00 0
 b75b3000-b7760000 r-xp 00000000 08:01 794350 /lib/i386-linux-gnu/libc-2.17.so
 b7760000-b7762000 r--p 001ad000 08:01 794350 /lib/i386-linux-gnu/libc-2.17.so
 b7762000-b7763000 rw-p 001af000 08:01 794350 /lib/i386-linux-gnu/libc-2.17.so
 b7763000-b7767000 rw-p 00000000 00:00 0
 b7767000-b776c000 r-xp 00000000 08:01 2885352 /usr/lib/libcpufreq.so.0.0.0
 b776c000-b776d000 r--p 00004000 08:01 2885352 /usr/lib/libcpufreq.so.0.0.0
 b776d000-b776e000 rw-p 00005000 08:01 2885352 /usr/lib/libcpufreq.so.0.0.0
 b776e000-b7771000 r-xp 00000000 08:01 795060 /lib/i386-linux-gnu/libdl-2.17.so
 b7771000-b7772000 r--p 00002000 08:01 795060 /lib/i386-linux-gnu/libdl-2.17.so
 b7772000-b7773000 rw-p 00003000 08:01 795060 /lib/i386-linux-gnu/libdl-2.17.so
 b778c000-b778f000 rw-p 00000000 00:00 0
 b778f000-b7790000 r-xp 00000000 00:00 0 [vdso]
 b7790000-b77b0000 r-xp 00000000 08:01 795076 /lib/i386-linux-gnu/ld-2.17.so
 b77b0000-b77b1000 r--p 0001f000 08:01 795076 /lib/i386-linux-gnu/ld-2.17.so
 b77b1000-b77b2000 rw-p 00020000 08:01 795076 /lib/i386-linux-gnu/ld-2.17.so
 bfaf7000-bfb18000 rw-p 00000000 00:00 0 [stack]
ProcStatus:
 Name: cpufreqd
 State: S (sleeping)
 Tgid: 1257
 Pid: 1257
 PPid: 1237
 TracerPid: 0
 Uid: 0 0 0 0
 Gid: 0 0 0 0
 FDSize: 32
 Groups: 0
 VmPeak: 2484 kB
 VmSize: 2380 kB
 VmLck: 0 kB
 VmPin: 0 kB
 VmHWM: 524 kB
 VmRSS: 508 kB
 VmData: 168 kB
 VmStk: 136 kB
 VmExe: 40 kB
 VmLib: 1984 kB
 VmPTE: 20 kB
 VmSwap: 0 kB
 Threads: 1
 SigQ: 0/15819
 SigPnd: 0000000000000000
 ShdPnd: 0000000000000000
 SigBlk: 0000000000000000
 SigIgn: 0000000000000000
 SigCgt: 0000000000000000
 CapInh: 0000000000000000
 CapPrm: 0000001fffffffff
 CapEff: 0000001fffffffff
 CapBnd: 0000001fffffffff
 Seccomp: 0
 Cpus_allowed: 3
 Cpus_allowed_list: 0-1
 Mems_allowed: 1
 Mems_allowed_list: 0
 voluntar...

Revision history for this message
alexey (aleksey-weblancer) wrote :

@kakurasan

The workaround worked for me.
My pc: Asus K55VM Linux Mint 15 Cinnamon RC

Revision history for this message
kiawin (kiawin) wrote :

@kakurasan

The workaround worked for me, even if /etc/cpufreqd.conf exist in my system.

Dell Inspiron 15RSE (7520), Ubuntu 13.04

Revision history for this message
Paul Donohue (s-launchpad-paulsd-com) wrote :

The problem is that cpufreqd uses MAX_PATH_LEN (defined as 512 in cpufreqd.h) to set buffer sizes when it should really use PATH_MAX (defined as 4096 in /usr/include/linux/limits.h). The cpufreqd package in quantal was built on maverick using an old glibc that didn't validate the buffer size. The cpufreqd package in raring was built on raring using a new glibc that does validate the buffer size, which is why we now see this error.

Looks like the issue was fixed in upstream git long ago, but upstream git hasn't been released as a new version since then:
http://git.kamineko.org/cgi-bin/gitweb.cgi?p=cpufreqd.git;a=commitdiff;h=b5b23525edcc09898288360c48e92b4a6c9cb0ee

Revision history for this message
Paul Donohue (s-launchpad-paulsd-com) wrote :

Note that if you re-build cpufreqd 2.4.2-1 or 2.4.2-2 on quantal, the same issue appears.

dino99 (9d9)
tags: added: upgrade-software-version
Revision history for this message
yeradis (yeradis) wrote :
Download full text (7.1 KiB)

Same issue here, just a fresh install of cpufreqd .... removed when crashed xD

yeradis@EXOPG06411:~$ sudo apt-get install cpufreqd cpufrequtils indicator-cpufreq
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
  gir1.2-appindicator3-0.1 libcpufreq0
The following NEW packages will be installed:
  cpufreqd cpufrequtils gir1.2-appindicator3-0.1 indicator-cpufreq libcpufreq0
0 upgraded, 5 newly installed, 0 to remove and 0 not upgraded.
Need to get 171 kB of archives.
After this operation, 1.279 kB of additional disk space will be used.
Do you want to continue [Y/n]? Y
Get:1 http://es.archive.ubuntu.com/ubuntu/ raring/universe libcpufreq0 amd64 008-1 [13,7 kB]
Get:2 http://es.archive.ubuntu.com/ubuntu/ raring/universe cpufreqd amd64 2.4.2-2 [80,4 kB]
Get:3 http://es.archive.ubuntu.com/ubuntu/ raring/universe cpufrequtils amd64 008-1 [39,2 kB]
Get:4 http://es.archive.ubuntu.com/ubuntu/ raring/main gir1.2-appindicator3-0.1 amd64 12.10.1daily13.04.15-0ubuntu1 [3.716 B]
Get:5 http://es.archive.ubuntu.com/ubuntu/ raring/universe indicator-cpufreq all 0.2.2-0ubuntu1 [33,7 kB]
Fetched 171 kB in 0s (191 kB/s)
Preconfiguring packages ...
Selecting previously unselected package libcpufreq0.
(Reading database ... 191133 files and directories currently installed.)
Unpacking libcpufreq0 (from .../libcpufreq0_008-1_amd64.deb) ...
Selecting previously unselected package cpufreqd.
Unpacking cpufreqd (from .../cpufreqd_2.4.2-2_amd64.deb) ...
Selecting previously unselected package cpufrequtils.
Unpacking cpufrequtils (from .../cpufrequtils_008-1_amd64.deb) ...
Selecting previously unselected package gir1.2-appindicator3-0.1.
Unpacking gir1.2-appindicator3-0.1 (from .../gir1.2-appindicator3-0.1_12.10.1daily13.04.15-0ubuntu1_amd64.deb) ...
Selecting previously unselected package indicator-cpufreq.
Unpacking indicator-cpufreq (from .../indicator-cpufreq_0.2.2-0ubuntu1_all.deb) ...
Processing triggers for man-db ...
Processing triggers for ureadahead ...
ureadahead will be reprofiled on next reboot
Processing triggers for hicolor-icon-theme ...
Setting up libcpufreq0 (008-1) ...
Setting up cpufreqd (2.4.2-2) ...
 * Starting CPU Frequency daemon cpufreqd *** buffer overflow detected ***: /usr/sbin/cpufreqd terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7fef357b65cc]
/lib/x86_64-linux-gnu/libc.so.6(+0x110560)[0x7fef357b5560]
/lib/x86_64-linux-gnu/libc.so.6(+0x110b04)[0x7fef357b5b04]
/usr/sbin/cpufreqd(main+0x308)[0x402bb8]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7fef356c6ea5]
/usr/sbin/cpufreqd[0x403c9d]
======= Memory map: ========
00400000-0040b000 r-xp 00000000 08:01 800019 /usr/sbin/cpufreqd
0060a000-0060b000 r--p 0000a000 08:01 800019 /usr/sbin/cpufreqd
0060b000-0060c000 rw-p 0000b000 08:01 800019 /usr/sbin/cpufreqd
024a3000-024c4000 rw-p 00000000 00:00 0 [heap]
7fef3548f000-7fef354a3000 r-xp 00000000 08:01 2756368 ...

Read more...

Revision history for this message
yeradis (yeradis) wrote :

btw removing -f from /etc/init.d/cpufreqd works for me.

Revision history for this message
guisar (seiferth) wrote :

Sorry for being dense but I found two instances (start and reload) where -f is used, do I delete -f and the config file variable from both of these and do I also remove the -- argument before them?

Revision history for this message
Paul Donohue (s-launchpad-paulsd-com) wrote :

Yes, delete -f from both of them. You can remove the '--' as well.

Revision history for this message
Paul Donohue (s-launchpad-paulsd-com) wrote :
Revision history for this message
Ubuntu Foundations Team Bug Bot (crichton) wrote :

The attachment "Unreleased fix that was applied to upstream" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

tags: added: patch
Revision history for this message
rastrano (rastrano) wrote :

as you suggested removing -f to start-daemon command in /etc/init.d/cpufreqd worked for me . This is a serious issue, my server was stuck to 800Mhz when it can reach 2.30GHz

Revision history for this message
ViBE (vibe) wrote :
Download full text (3.5 KiB)

i cannot even install it.

 * Starting CPU Frequency daemon cpufreqd *** buffer overflow detected ***: /usr/sbin/cpufreqd terminated
======= Backtrace: =========
/lib/x86_64-linux-gnu/libc.so.6(__fortify_fail+0x5c)[0x7f0d7b7a71bc]
/lib/x86_64-linux-gnu/libc.so.6(+0x111150)[0x7f0d7b7a6150]
/lib/x86_64-linux-gnu/libc.so.6(+0x1116f4)[0x7f0d7b7a66f4]
/usr/sbin/cpufreqd(main+0x308)[0x402bb8]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xf5)[0x7f0d7b6b6ea5]
/usr/sbin/cpufreqd[0x403c9d]
======= Memory map: ========
00400000-0040b000 r-xp 00000000 08:05 11278 /usr/sbin/cpufreqd
0060a000-0060b000 r--p 0000a000 08:05 11278 /usr/sbin/cpufreqd
0060b000-0060c000 rw-p 0000b000 08:05 11278 /usr/sbin/cpufreqd
02500000-02521000 rw-p 00000000 00:00 0 [heap]
7f0d7b47f000-7f0d7b493000 r-xp 00000000 08:05 1183597 /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0d7b493000-7f0d7b693000 ---p 00014000 08:05 1183597 /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0d7b693000-7f0d7b694000 r--p 00014000 08:05 1183597 /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0d7b694000-7f0d7b695000 rw-p 00015000 08:05 1183597 /lib/x86_64-linux-gnu/libgcc_s.so.1
7f0d7b695000-7f0d7b854000 r-xp 00000000 08:05 1178372 /lib/x86_64-linux-gnu/libc-2.17.so
7f0d7b854000-7f0d7ba53000 ---p 001bf000 08:05 1178372 /lib/x86_64-linux-gnu/libc-2.17.so
7f0d7ba53000-7f0d7ba57000 r--p 001be000 08:05 1178372 /lib/x86_64-linux-gnu/libc-2.17.so
7f0d7ba57000-7f0d7ba59000 rw-p 001c2000 08:05 1178372 /lib/x86_64-linux-gnu/libc-2.17.so
7f0d7ba59000-7f0d7ba5e000 rw-p 00000000 00:00 0
7f0d7ba5e000-7f0d7ba63000 r-xp 00000000 08:05 27420 /usr/lib/libcpufreq.so.0.0.0
7f0d7ba63000-7f0d7bc62000 ---p 00005000 08:05 27420 /usr/lib/libcpufreq.so.0.0.0
7f0d7bc62000-7f0d7bc63000 r--p 00004000 08:05 27420 /usr/lib/libcpufreq.so.0.0.0
7f0d7bc63000-7f0d7bc64000 rw-p 00005000 08:05 27420 /usr/lib/libcpufreq.so.0.0.0
7f0d7bc64000-7f0d7bc67000 r-xp 00000000 08:05 1178360 /lib/x86_64-linux-gnu/libdl-2.17.so
7f0d7bc67000-7f0d7be66000 ---p 00003000 08:05 1178360 /lib/x86_64-linux-gnu/libdl-2.17.so
7f0d7be66000-7f0d7be67000 r--p 00002000 08:05 1178360 /lib/x86_64-linux-gnu/libdl-2.17.so
7f0d7be67000-7f0d7be68000 rw-p 00003000 08:05 1178360 /lib/x86_64-linux-gnu/libdl-2.17.so
7f0d7be68000-7f0d7be8b000 r-xp 00000000 08:05 1177815 /lib/x86_64-linux-gnu/ld-2.17.so
7f0d7c062000-7f0d7c065000 rw-p 00000000 00:00 0
7f0d7c087000-7f0d7c08a000 rw-p 00000000 00:00 0
7f0d7c08a000-7f0d7c08b000 r--p 00022000 08:05 1177815 /lib/x86_64-linux-gnu/ld-2.17.so
7f0d7c08b000-7f0d7c08d000 rw-p 00023000 08:05 1177815 /lib/x86_64-linux-gnu/ld-2.17.so
7fff2cdd3000-7fff2cdf4000 rw-p...

Read more...

Adam Conrad (adconrad)
Changed in cpufreqd (Ubuntu):
status: Confirmed → Fix Committed
assignee: nobody → Adam Conrad (adconrad)
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cpufreqd - 2.4.2-2ubuntu1

---------------
cpufreqd (2.4.2-2ubuntu1) trusty; urgency=medium

  * path_max.patch: Pull upstream patch to fix MAX_PATH_LEN (LP: #1162160)
 -- Adam Conrad <email address hidden> Sat, 04 Jan 2014 03:51:23 -0700

Changed in cpufreqd (Ubuntu):
status: Fix Committed → Fix Released
Andreas Moog (ampelbein)
description: updated
Changed in cpufreqd (Ubuntu):
importance: Undecided → High
Changed in cpufreqd (Ubuntu Saucy):
importance: Undecided → High
status: New → Triaged
Revision history for this message
Brian Murray (brian-murray) wrote : Please test proposed package

Hello Samuele, or anyone else affected,

Accepted cpufreqd into saucy-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/cpufreqd/2.4.2-2ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

Changed in cpufreqd (Ubuntu Saucy):
status: Triaged → Fix Committed
tags: added: verification-needed
Revision history for this message
Herbert (herbert-fischer) wrote :

It's working now. Thank you.

Changed in cpufreqd (Ubuntu Saucy):
status: Fix Committed → In Progress
assignee: nobody → Herbert (herbert-fischer)
tags: added: verification-done
removed: verification-needed
tags: added: verification-done-saucy
removed: verification-done
tags: added: verification-needed
Changed in cpufreqd (Ubuntu Saucy):
assignee: Herbert (herbert-fischer) → nobody
status: In Progress → Confirmed
Colin Watson (cjwatson)
Changed in cpufreqd (Ubuntu Saucy):
status: Confirmed → Fix Committed
tags: added: verification-done
removed: verification-done-saucy verification-needed
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package cpufreqd - 2.4.2-2ubuntu0.1

---------------
cpufreqd (2.4.2-2ubuntu0.1) saucy-proposed; urgency=medium

  * path_max.patch: Pull upstream patch to fix MAX_PATH_LEN (LP: #1162160)
 -- Andreas Moog <email address hidden> Sun, 19 Jan 2014 10:53:47 +0100

Changed in cpufreqd (Ubuntu Saucy):
status: Fix Committed → Fix Released
Revision history for this message
Colin Watson (cjwatson) wrote : Update Released

The verification of the Stable Release Update for cpufreqd has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.