Bettercap: wifi.recon/wifi.deauth fatal error: unexpected signal during runtime execution

[picatz]

Description

While testing the wifi.recon module I noticed while I went to exit the bettercap session I got the following error:

Stopping modules and cleaning session state ...
fatal error: unexpected signal during runtime execution
[signal SIGSEGV: segmentation violation code=0x1 addr=0x328 pc=0x7fff75eed924]

runtime stack:
runtime.throw(0x46c7f98, 0x2a)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/panic.go:605 +0x95
runtime.sigpanic()
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/signal_unix.go:351 +0x2b8

goroutine 48 [syscall, locked to thread]:
runtime.cgocall(0x45108e0, 0xc4200b9960, 0x46c68ea)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/cgocall.go:132 +0xe4 fp=0xc4200b9920 sp=0xc4200b98e0 pc=0x4004564
....

Environment

macOS and go version 1.9.2

Steps to Reproduce

Turn on wifi.recon.

wifi.recon on

Add a ticker for every 5 seconds using the wifi.deauth module:

set ticker.period 5; set ticker.commands "wifi.deauth XX:XX:XX:XX:XX:XX"; ticker on

Wait for the line: [11:51:56] [sys.log] [inf] Deauthing 3 clients from AP XXXXX ...

exit

Then I got a unexpected signal during runtime execution.

Expected behavior:
For things to cleanup smoothly without the panic/error.

Actual behavior:
Got an error.

[picatz]

Note

This could be some sort of just weird timing bug/error.

Full Error

Stopping modules and cleaning session state ...
fatal error: unexpected signal during runtime execution
[signal SIGSEGV: segmentation violation code=0x1 addr=0x328 pc=0x7fff75eed924]

runtime stack:
runtime.throw(0x46c7f98, 0x2a)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/panic.go:605 +0x95
runtime.sigpanic()
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/signal_unix.go:351 +0x2b8

goroutine 48 [syscall, locked to thread]:
runtime.cgocall(0x45108e0, 0xc4200b9960, 0x46c68ea)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/cgocall.go:132 +0xe4 fp=0xc4200b9920 sp=0xc4200b98e0 pc=0x4004564
github.com/google/gopacket/pcap._Cfunc_pcap_sendpacket(0x0, 0xc4206b4512, 0x22, 0x0)
    github.com/google/gopacket/pcap/_obj/_cgo_gotypes.go:527 +0x4d fp=0xc4200b9960 sp=0xc4200b9920 pc=0x4271ced
github.com/google/gopacket/pcap.(*Handle).WritePacketData.func1(0x0, 0xc4206b4512, 0x22, 0xc4206b4512)
    /Users/picat/go/src/github.com/google/gopacket/pcap/pcap.go:857 +0x72 fp=0xc4200b9998 sp=0xc4200b9960 pc=0x42776b2
github.com/google/gopacket/pcap.(*Handle).WritePacketData(0xc4205327d0, 0xc4206b4512, 0x22, 0x22, 0x4b067e0, 0xc4206ccaa0)
    /Users/picat/go/src/github.com/google/gopacket/pcap/pcap.go:857 +0x46 fp=0xc4200b99c8 sp=0xc4200b9998 pc=0x4275166
github.com/bettercap/bettercap/modules.(*WiFiRecon).injectPacket(0xc4202f07e0, 0xc4206b4512, 0x22, 0x22)
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:337 +0x51 fp=0xc4200b9a18 sp=0xc4200b99c8 pc=0x44f4991
github.com/bettercap/bettercap/modules.(*WiFiRecon).sendDeauthPacket(0xc4202f07e0, 0xc42048a688, 0x6, 0x6, 0xc42048a758, 0x6, 0x6)
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:358 +0x15e fp=0xc4200b9ac8 sp=0xc4200b9a18 pc=0x44f4c2e
github.com/bettercap/bettercap/modules.(*WiFiRecon).startDeauth.func1()
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:403 +0x99 fp=0xc4200b9b38 sp=0xc4200b9ac8 pc=0x44ff909
github.com/bettercap/bettercap/modules.(*WiFiRecon).onChannel(0xc4202f07e0, 0x24, 0xc4200b9d00)
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:380 +0x153 fp=0xc4200b9bc8 sp=0xc4200b9b38 pc=0x44f4ec3
github.com/bettercap/bettercap/modules.(*WiFiRecon).startDeauth(0xc4202f07e0, 0xc42067e940, 0x6, 0x6, 0x0, 0x0)
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:401 +0x2f2 fp=0xc4200b9d40 sp=0xc4200b9bc8 pc=0x44f5272
github.com/bettercap/bettercap/modules.NewWiFiRecon.func5(0xc42030cb10, 0x1, 0x1, 0x1, 0xc42030cb10)
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:95 +0xa1 fp=0xc4200b9d90 sp=0xc4200b9d40 pc=0x44ff7d1
github.com/bettercap/bettercap/session.(*Session).Run(0xc4200c60f0, 0xc420402c20, 0x1d, 0x0, 0x0)
    /Users/picat/go/src/github.com/bettercap/bettercap/session/session.go:476 +0x2d9 fp=0xc4200b9f40 sp=0xc4200b9d90 pc=0x4288db9
github.com/bettercap/bettercap/modules.(*Ticker).Start.func1()
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/ticker.go:90 +0x191 fp=0xc4200b9fe0 sp=0xc4200b9f40 pc=0x44ff261
runtime.goexit()
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/asm_amd64.s:2337 +0x1 fp=0xc4200b9fe8 sp=0xc4200b9fe0 pc=0x405c0f1
created by github.com/bettercap/bettercap/session.(*SessionModule).SetRunning
    /Users/picat/go/src/github.com/bettercap/bettercap/session/module.go:150 +0x1a0

goroutine 1 [semacquire]:
sync.runtime_SemacquireMutex(0xc42037293c, 0x4273a00)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/sema.go:71 +0x3d
sync.(*Mutex).Lock(0xc420372938)
    /usr/local/Cellar/go/1.9.2/libexec/src/sync/mutex.go:134 +0xee
github.com/google/gopacket/pcap.(*Handle).Close(0xc420372910)
    /Users/picat/go/src/github.com/google/gopacket/pcap/pcap.go:468 +0x90
github.com/bettercap/bettercap/packets.(*Queue).Stop(0xc4202f0990)
    /Users/picat/go/src/github.com/bettercap/bettercap/packets/queue.go:214 +0x84
github.com/bettercap/bettercap/session.(*Session).Close(0xc4200c60f0)
    /Users/picat/go/src/github.com/bettercap/bettercap/session/session.go:247 +0x12b
main.main()
    /Users/picat/go/src/github.com/bettercap/bettercap/main.go:102 +0x1380

goroutine 5 [syscall, 2 minutes]:
os/signal.signal_recv(0x0)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/sigqueue.go:131 +0xa7
os/signal.loop()
    /usr/local/Cellar/go/1.9.2/libexec/src/os/signal/signal_unix.go:22 +0x22
created by os/signal.init.0
    /usr/local/Cellar/go/1.9.2/libexec/src/os/signal/signal_unix.go:28 +0x41

goroutine 6 [chan receive]:
github.com/bettercap/bettercap/packets.(*Queue).worker(0xc4202f0990)
    /Users/picat/go/src/github.com/bettercap/bettercap/packets/queue.go:141 +0x89
created by github.com/bettercap/bettercap/packets.NewQueue
    /Users/picat/go/src/github.com/bettercap/bettercap/packets/queue.go:71 +0x31c

goroutine 18 [syscall, locked to thread]:
github.com/google/gopacket/pcap._Cfunc_pcap_wait(0x6000400, 0x26ac, 0x0)
    github.com/google/gopacket/pcap/_obj/_cgo_gotypes.go:763 +0x4d
github.com/google/gopacket/pcap.(*Handle).waitForPacket.func1(0x6000400, 0x26ac, 0x0)
    /Users/picat/go/src/github.com/google/gopacket/pcap/pcap_unix.go:68 +0x68
github.com/google/gopacket/pcap.(*Handle).waitForPacket(0xc420372910)
    /Users/picat/go/src/github.com/google/gopacket/pcap/pcap_unix.go:70 +0x75
github.com/google/gopacket/pcap.(*Handle).getNextBufPtrLocked(0xc420372910, 0xc4200bbeb0, 0x4b166e1, 0xc4207a20b0)
    /Users/picat/go/src/github.com/google/gopacket/pcap/pcap.go:419 +0x51
github.com/google/gopacket/pcap.(*Handle).ReadPacketData(0xc420372910, 0x4006c50, 0xc42039c058, 0xc4203a0b90, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ...)
    /Users/picat/go/src/github.com/google/gopacket/pcap/pcap.go:327 +0x77
github.com/google/gopacket.(*PacketSource).NextPacket(0xc42035fce0, 0xc4200bbfb8, 0xc4206da780, 0x0, 0x0)
    /Users/picat/go/src/github.com/google/gopacket/packet.go:795 +0x6a
github.com/google/gopacket.(*PacketSource).packetsToChannel(0xc42035fce0)
    /Users/picat/go/src/github.com/google/gopacket/packet.go:812 +0x5d
created by github.com/google/gopacket.(*PacketSource).Packets
    /Users/picat/go/src/github.com/google/gopacket/packet.go:835 +0x99

goroutine 35 [chan receive]:
github.com/bettercap/bettercap/session.(*Session).startNetMon.func1(0xc4200c60f0)
    /Users/picat/go/src/github.com/bettercap/bettercap/session/session.go:282 +0x92
created by github.com/bettercap/bettercap/session.(*Session).startNetMon
    /Users/picat/go/src/github.com/bettercap/bettercap/session/session.go:281 +0x3f

goroutine 34 [chan receive, 2 minutes]:
github.com/bettercap/bettercap/session.(*Session).setupSignals.func1(0xc42036b1a0, 0xc4200c60f0)
    /Users/picat/go/src/github.com/bettercap/bettercap/session/session.go:305 +0x38
created by github.com/bettercap/bettercap/session.(*Session).setupSignals
    /Users/picat/go/src/github.com/bettercap/bettercap/session/session.go:304 +0x113

goroutine 11 [select]:
github.com/evilsocket/readline.(*CancelableStdin).ioloop(0xc42036afc0)
    /Users/picat/go/src/github.com/evilsocket/readline/std.go:93 +0xea
created by github.com/evilsocket/readline.NewCancelableStdin
    /Users/picat/go/src/github.com/evilsocket/readline/std.go:86 +0xe7

goroutine 14 [select, 2 minutes, locked to thread]:
runtime.gopark(0x46db7c0, 0x0, 0x46664e9, 0x6, 0x18, 0x1)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/proc.go:287 +0x12c
runtime.selectgo(0xc420042f50, 0xc4200788a0)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/select.go:395 +0x1149
runtime.ensureSigM.func1()
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/signal_unix.go:511 +0x1fe
runtime.goexit()
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/asm_amd64.s:2337 +0x1

goroutine 15 [chan receive, 2 minutes]:
github.com/evilsocket/readline.DefaultOnWidthChanged.func1.1(0xc42036b0e0)
    /Users/picat/go/src/github.com/evilsocket/readline/utils_unix.go:75 +0x55
created by github.com/evilsocket/readline.DefaultOnWidthChanged.func1
    /Users/picat/go/src/github.com/evilsocket/readline/utils_unix.go:73 +0xb5

goroutine 19 [sleep]:
time.Sleep(0x3b9aca00)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/time.go:65 +0x130
github.com/bettercap/bettercap/modules.(*Discovery).Start.func1()
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/net_recon.go:110 +0x59
created by github.com/bettercap/bettercap/session.(*SessionModule).SetRunning
    /Users/picat/go/src/github.com/bettercap/bettercap/session/module.go:150 +0x1a0

goroutine 88 [sleep]:
time.Sleep(0xee6b280)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/time.go:65 +0x130
github.com/bettercap/bettercap/modules.(*WiFiRecon).channelHopper(0xc4202f07e0)
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:547 +0x1f9
created by github.com/bettercap/bettercap/modules.(*WiFiRecon).Start.func1
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:590 +0x3c6

goroutine 89 [sleep]:
time.Sleep(0x12a05f200)
    /usr/local/Cellar/go/1.9.2/libexec/src/runtime/time.go:65 +0x130
github.com/bettercap/bettercap/modules.(*WiFiRecon).stationPruner(0xc4202f07e0)
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:565 +0x26b
created by github.com/bettercap/bettercap/modules.(*WiFiRecon).Start.func1
    /Users/picat/go/src/github.com/bettercap/bettercap/modules/wifi_recon.go:594 +0x62

[evilsocket]

It's a timing bug due to the fact that the pcap native API is waiting to read from a handle while the process is exiting, at some point that handle is closed and depending on the status of the pcap library the pcap_wait function might crash.

A fix would be, in the Stop method of the WiFiRecon module, to use a WaitGroup to wait for all the r/w operations on that handle to complete (and of course use that sync mechanism across the module accordingly).

[evilsocket]

@picatz it should be fixed by https://github.com/bettercap/bettercap/commit/b1dc729c79ce5238079bce742d7e9800848c75dd , can you check please?

[Matrix86]

I tried it some times and it seems happen no more to me, but waiting for the @picatz 's answer!

[evilsocket]

been testing the whole day and it seems fixed, I'm closing this for now @picatz pleast let us know if you experience the issue again after the fixes.

[picatz]

Tested this. Looks great! 👍