nfcDemoApp Segmentation Fault

[wjzhang99]

We are having a critical issue with the libnfc-nci library. The nfcDemoApp application runs into a segmentation fault and crashes intermittently after it detects an NFC tag. I believe the crash happened during nfcTag_readNdef() function call.  We are using Linux kernel 4.9.87 and nci library Rev 2.4 with the patch you provided to us last time. We had same issue with nci library Rev 2.2. Attached is the application log as well as debugger log .

Thank you and look forward to hearing from you soon.

William

[Kan_Li]

Hi William,

Would you please specify the platform running nfcDemoApp?

and if possible, please replicate this issue after updating libnfc-nci.conf file to enable more logs:

APPL_TRACE_LEVEL=0xFF

PROTOCOL_TRACE_LEVEL=0xFF

Thanks for your patience!

Have a great day,
Kan

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[wjzhang99]

Hi Kan,

I am not sure if that problem has been fixed. But I am getting a similar crash today:

*** Error in `nfcDemoApp': malloc(): memory corruption (fast): 0x74801a58 *** 

I don't see any option to attach a file. Here is last part of the log with settings mentioned above:

Record Found :
NDEF Content Max size : '46 bytes'
NDEF Actual Content size : '46 bytes'
ReadOnly : 'TRUE'
NxpFunc: nativeNfcTag_doReadNdef: enter
NxpNciX: len = 14 > 00000B260140CD4B330C080104E0
NxpTml: PN54X - I2C Write successful.....

NxpTml: PN54X - Posting Fresh Write message.....

NxpTml: PN54X - Tml Writer Thread Running................

NxpHal: write successful status = 0x0
NxpFunc: Nfc: nfa_sys_ptim_start_timer 76f3d630

NxpFunc: Nfc: ptim timer start

NxpTml: PN54X - I2C Read successful.....

NxpNciR: len = 6 > 600603010001
NxpTml: PN54X - Posting read message.....

NxpHal: read successful status = 0x0
NxpFunc: NfcAdaptation::HalDeviceContextDataCallback: len=6
NxpFunc: Nfc: Process Event mt:3

NxpFunc: Nfc: NFC received ntf gid:0

NxpFunc: Nfc: nci_proc_core_ntf opcode:0x6

NxpFunc: Nfc: nfc_ncif_send_data :0, num_buff:1 qc:0

NxpTml: PN54X - Read requested.....

NxpTml: PN54X - Invoking I2C Read.....

NxpTml: PN54X - I2C Read successful.....

NxpNciR: len = 14 > 00000B0000CD4B330C080104E000
NxpTml: PN54X - Posting read message.....

NxpHal: read successful status = 0x0
NxpHal: > Going through workaround - data of ISO 15693
NxpFunc: NfcAdaptation::HalDeviceContextDataCallback: len=13
NxpFunc: Nfc: Process Event mt:0

NxpFunc: Nfc: NFC received data

NxpFunc: Nfc: nfc_ncif_proc_data 0x00000a

NxpFunc: Nfc: nfc_ncif_proc_data len:10

NxpFunc: Nfc: rw_i93_data_cback () event = 0x6003

NxpFunc: Nfc: RW I93 state: 8

NxpFunc: Nfc: nfa_rw_cback: event=0xac

NxpFunc: Nfc: nfa_sys_ptim_stop_timer 76f3d630

NxpFunc: Nfc: ptim timer stop

NxpFunc: Nfc: Stopped presence check timer (if started)

NxpFunc: Nfc: nfa_dm_act_conn_cback_notify (): event:0xF

NxpFunc: nfaConnectionCallback: event= 15
NxpFunc: nfaConnectionCallback: NFA_PRESENCE_CHECK_EVT
NxpFunc: Nfc: ptim timer stop

NxpTml: PN54X - Read requested.....

NxpTml: PN54X - Invoking I2C Read.....

NxpFunc: Nfc: NFA_RwReadNDef

NxpFunc: Nfc: NFA got event 0x0600

NxpFunc: Nfc: nfa_rw_handle_event event: 0x600, flags: 00000065

NxpFunc: Nfc: nfa_rw_handle_op_req: op=0x01

NxpFunc: Nfc: nfa_sys_ptim_stop_timer 76f3d630

NxpFunc: Nfc: ptim timer stop

NxpFunc: Nfc: Stopped presence check timer (if started)

NxpFunc: Nfc: nfa_rw_read_ndef

NxpFunc: Nfc: RW_I93ReadNDef ()

NxpFunc: Nfc: rw_i93_get_next_blocks ()

NxpFunc: Nfc: rw_i93_send_cmd_read_multi_blocks ()

NxpFunc: Nfc: nfc_ncif_send_data :0, num_buff:1 qc:0

NxpFunc: NfcAdaptation::HalWrite
NxpTml: PN54X - Write requested.....

NxpTml: PN54X - Invoking I2C Write.....

NxpNciX: len = 15 > 00000C2223CD4B330C080104E0011F
NxpTml: PN54X - I2C Write successful.....

NxpTml: PN54X - Posting Fresh Write message.....

NxpTml: PN54X - Tml Writer Thread Running................

NxpHal: write successful status = 0x0
NxpTml: PN54X - I2C Read successful.....

NxpNciR: len = 6 > 600603010001
NxpTml: PN54X - Posting read message.....

NxpHal: read successful status = 0x0
NxpFunc: NfcAdaptation::HalDeviceContextDataCallback: len=6
NxpFunc: Nfc: Process Event mt:3

NxpFunc: Nfc: NFC received ntf gid:0

NxpFunc: Nfc: nci_proc_core_ntf opcode:0x6

NxpFunc: Nfc: nfc_ncif_send_data :0, num_buff:1 qc:0

NxpTml: PN54X - Read requested.....

NxpTml: PN54X - Invoking I2C Read.....

NxpFunc: presenceCheckThread: Presence Check Re-Scheduled
NxpFunc: Nfc: rw_i93_process_timeout () event=108

NxpFunc: Nfc: rw_i93_process_timeout (): retry_count = 1

NxpFunc: Nfc: nfc_ncif_send_data :0, num_buff:1 qc:0

NxpFunc: NfcAdaptation::HalWrite
NxpTml: PN54X - Write requested.....

NxpTml: PN54X - Invoking I2C Write...[ 281.055448] pn54x_dev_release : closing 10,57
..

NxpNciX: len = 15 > 00000C2223CD4B330C080104E0011F
NxpTml: PN54X - I2C Write successful.....

NxpTml: PN54X - Posting Fresh Write message.....

NxpTml: PN54X - Tml Writer Thread Running................

NxpHal: write successful status = 0x0
NxpTml: PN54X - I2C Read successful.....

NxpNciR: len = 4 > 00000102
NxpTml: PN54X - Posting read message.....

NxpHal: read successful status = 0x0
NxpFunc: NfcAdaptation::HalDeviceContextDataCallback: len=4
NxpFunc: Nfc: Process Event mt:0

NxpFunc: Nfc: NFC received data

NxpFunc: Nfc: nfc_ncif_proc_data 0x000001

NxpFunc: Nfc: nfc_ncif_proc_data len:1

NxpFunc: Nfc: rw_i93_data_cback () event = 0x6003

NxpFunc: Nfc: RW I93 state: 4

NxpFunc: Nfc: rw_i93_sm_read_ndef ()

NxpFunc: Nfc: NDEF read segment read (1)/total (46)

NxpFunc: Nfc: nfa_rw_cback: event=0xa1

NxpFunc: Nfc: GKI_exception(): Task State Table

NxpFunc: Nfc: TASK ID [0] task name [NFCA_THREAD] state [0]

NxpFunc: Nfc: TASK ID [1] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [2] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [3] task name [NFC_TASK] state [1]

NxpFunc: Nfc: TASK ID [4] task name [NFCA_TASK] state [1]

NxpFunc: Nfc: TASK ID [5] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [6] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [7] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [8] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [9] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [10] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [11] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [12] task name [(null)] state [0]

NxpFunc: Nfc: TASK ID [13] task name [(null)] state [0]

NxpFunc: Nfc: GKI_exception 65535 Free - Buf Corrupted

NxpFunc: Nfc: ********************************************************************

NxpFunc: Nfc: * GKI_exception(): 65535 Free - Buf Corrupted

NxpFunc: Nfc: ********************************************************************

NxpFunc: Nfc: GKI_exception 65535 Free - Buf Corrupted done

NxpFunc: Nfc: rw_i93_get_next_blocks ()

NxpFunc: Nfc: rw_i93_send_cmd_read_multi_blocks ()

NxpFunc: Nfc: nfc_ncif_send_data :0, num_buff:0 qc:0

NxpTml: PN54X - Read requested.....

NxpTml: PN54X - Invoking I2C Read.....

NxpTml: PN54X - I2C Read successful.....

NxpNciR: len = 6 > 600603010001
NxpTml: PN54X - Posting read message.....

*** Error in `nfcDemoApp': malloc(): memory corruption (fast): 0x74801a58 ***
NxpFunc: received SIGABRT

NxpFunc: Nfc: NFA_HciW4eSETransaction_Complete; type=0

NxpFunc: Nfc: NFA_HciW4eSETransaction_Complete; End

Aborted (core dumped)

[Kan_Li]

Hi William,

Could you see "Use advanced editor" option as below? You may use it to attach the log, or directly send it to me via the private ticket you created in SDFC.

Thanks for your patience!

Have a great day,
Kan

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[wjzhang99]

Hi Kan

I tried to add "--enable-debug" option to the original configure command:

"./configure --host=arm-none-linux"  for cross-compiling. Then rebuilt the library and demo app. So far for last 3 days I have not seen the crash happened again. I will do more testing before we make conclusion.

Thank you.

William 

[wjzhang99]

Attached a log file to the previous post.

[wjzhang99]

Hi Kan

We are working on imx6 based platform. I tried with these 2 settings and have not seen any crashes so far. That seems to fix the issue. Can you explain a little bit of what these settings do?

Thanks.

William