In command.c:663:
gdb_outf(" halt: %s", on_or_off(target_mem_access_needs_halt(target)));
there is no check that target is non-NULL.
So "monitor rtt status" causes a crash if no target is connected (target is NULL).
Apologies for the silence following your report, we just got to looking at this and fixing it - please see #2255 which should fully fix this bug and also generally improve the usability and friendliness of the RTT command.
Reproducible on BMDA v2.0.0-569-g c49024f configured with meson setup build -Db_sanitize=address,undefined and built with gcc (Gentoo 15.2.1_p20260214 p5), say mon rtt status before scanning.
$ ./build/blackmagic -v 7 -s 066EFF494849877187165342
Black Magic Debug App v2.0.0-569-gc49024f
for Black Magic Probe, ST-Link v2 and v3, CMSIS-DAP, J-Link, FTDI (MPSSE) and WCH-Link
Using 0483:3752 066EFF494849877187165342 STMicroelectronics
STM32 STLink ---
ST-Link firmware version: V2J43M28
Leaving MASS Mode
Setting V6ONLY to off for dual stack listening.
Listening on TCP port: 2000
Got connection
gdb_packet_ack: ACK
gdb_packet_receive: qSupported:multiprocess+;swbreak+;hwbreak+;qRelocInsn+;fork-events+;vfork-events+;exec-events+;vContSupported+;QThreadEvents+;QThreadOptions+;no-resumed+;memory-tagging+;xmlRegisters=i386;error-message+
gdb_packet_send: PacketSize=400;qXfer:memory-map:read+;qXfer:features:read+;vContSupported+;QStartNoAckMode+
gdb_packet_get_ack: ACK
gdb_packet_ack: ACK
gdb_packet_receive: vCont?
gdb_packet_send: vCont;c;C;s;S;t
gdb_packet_get_ack: ACK
gdb_packet_ack: ACK
gdb_packet_receive: vMustReplyEmpty
gdb_packet_send:
gdb_packet_get_ack: ACK
gdb_packet_ack: ACK
gdb_packet_receive: QStartNoAckMode
Enabling NoAckMode
gdb_packet_send: OK
gdb_packet_receive: !
gdb_packet_send: OK
gdb_packet_receive: Hg0
gdb_packet_send: OK
gdb_packet_receive: qXfer:features:read:target.xml:0,3fb
gdb_packet_send: E01
gdb_packet_receive: qTStatus
*** Unsupported packet: qTStatus
gdb_packet_send:
gdb_packet_receive: ?
gdb_packet_send: W00
gdb_packet_receive: qRcmd,72747420737461747573
gdb_packet_send: O7274743A206F666620666F756E643A206E6F206964656E743A20
gdb_packet_send: O6F6666
../src/target/target.c:394:17: runtime error: member access within null pointer of type 'struct target_s'
AddressSanitizer:DEADLYSIGNAL
=================================================================
==1552908==ERROR: AddressSanitizer: SEGV on unknown address 0x0000000000bb (pc 0x55b371cd13ea bp 0x7ffc1a487d40 sp 0x7ffc1a487d30 T0)
==1552908==The signal is caused by a READ memory access.
==1552908==Hint: address points to the zero page.
#0 0x55b371cd13ea in target_mem_access_needs_halt ../src/target/target.c:394
#1 0x55b371cb0815 in cmd_rtt ../src/command.c:663
#2 0x55b371cb1d17 in command_process ../src/command.c:189
#3 0x55b371cb3b20 in exec_q_rcmd ../src/gdb_main.c:424
#4 0x55b371cb3c33 in exec_command ../src/gdb_main.c:405
#5 0x55b371cb58e9 in handle_q_packet ../src/gdb_main.c:666
#6 0x55b371cb58e9 in gdb_main_loop ../src/gdb_main.c:379
#7 0x55b371cad28c in bmp_poll_loop ../src/main.c:61
#8 0x55b371cad28c in main ../src/main.c:76
#9 0x7f913ec343fa in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
#10 0x7f913ec344aa in __libc_start_main_impl ../csu/libc-start.c:360
#11 0x55b371cae734 in _start (/home/altracer/git/blackmagic-debug/blackmagic/build/blackmagic+0x15d734) (BuildId: 8a83957b1d1eacf4a82fff85d1013261eefd01f0)
==1552908==Register values:
rax = 0x0000000000000000 rbx = 0x0000000000000000 rcx = 0x00007f913ee1ae5b rdx = 0x0000000000000000
rdi = 0x000055b371cd13a6 rsi = 0x00007ffc1a487d20 rbp = 0x00007ffc1a487d40 rsp = 0x00007ffc1a487d30
r8 = 0x00007ffc1a48773a r9 = 0x000000000000008b r10 = 0x0000000000000000 r11 = 0x0000000000000206
r12 = 0x000055b371d8ea20 r13 = 0x0000000000000002 r14 = 0x0000000000000006 r15 = 0x00007ffc1a487f44
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV ../src/target/target.c:394 in target_mem_access_needs_halt
==1552908==ABORTING
Cannot catch an MPU fault on blackpill-f411ce (even though I set it up using my old commits) but there is a NULL-adjacent dereference:
Breakpoint 1, target_mem_access_needs_halt (target=target@entry=0x0) at ../src/target/target.c:394
394 return !(target->target_options & TOPT_NON_HALTING_MEM_IO);
(gdb) bt
#0 target_mem_access_needs_halt (target=target@entry=0x0) at ../src/target/target.c:394
#1 0x080047d6 in cmd_rtt (target=0x0, argc=2, argv=0x20000e80) at ../src/command.c:663
#2 0x08004b76 in command_process (target=0x0, cmd_buffer=cmd_buffer@entry=0x20000eb0 "rtt")
at ../src/command.c:189
#3 0x080051a0 in exec_q_rcmd (packet=<optimized out>, length=<optimized out>) at ../src/gdb_main.c:424
#4 0x080051f4 in exec_command (
packet=packet@entry=0x20001198 <packet_buffer> "O6F66663A206F6E20666F756E643A206E6F206964656E743A20s:read+;vContSupported+", length=26, exec=0x802ddc8 <q_commands>) at ../src/gdb_main.c:405
#5 0x08005946 in handle_v_packet (packet=<optimized out>) at ../src/gdb_main.c:900
#6 gdb_main_loop (tc=tc@entry=0x2000100c <gdb_controller>, packet=0x20001198 <packet_buffer>,
in_syscall=in_syscall@entry=false) at ../src/gdb_main.c:383
#7 0x080059e6 in gdb_main (packet=<optimized out>) at ../src/gdb_main.c:945
#8 0x08005fea in bmp_poll_loop () at ../src/main.c:61
#9 main () at ../src/main.c:76
(gdb) disas
Dump of assembler code for function target_mem_access_needs_halt:
=> 0x0800aa48 <+0>: ldrb.w r0, [r0, #95] @ 0x5f
0x0800aa4c <+4>: eor.w r0, r0, #64 @ 0x40
0x0800aa50 <+8>: ubfx r0, r0, #6, #1
0x0800aa54 <+12>: bx lr
End of assembler dump.
Fixed by 2255, as a breakpoint on target_mem_access_needs_halt doesn't hit, and ASan doesn't abort under the same circumstances.
No due date set.
No dependencies set.
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?