Bug#1020559: libc6: After upgrading libc6 expr is crashing with "stack smashing detected"
Am 24.09.22 um 04:24 schrieb Vasudev Kamath: Hi Aurelien, Old libc is because I reverted it as some scripts I use and autoconf as well were breaking. I assume I have mentioned in report that a downgrade solved crash. If I missed sorry about that. Sorry for top posting as I’m replying from my pho e Sent from my iPhone On 24-Sep-2022, at 03:21, Aurelien Jarno wrote: Hi, On 2022-09-23 21:28, Bernhard Übelacker wrote: On Fri, 23 Sep 2022 14:45:07 +0530 Vasudev Kamath wrote: Package: libc6 Version: 2.34-8 I upgraded libc6 to latest released 2.35-1 Module ld-linux-x86-64.so.2 with build-id a03c3b14d371da908a3f22007b3f0c73d1f9f634 Module libc.so.6 with build-id ef3afb43092687d7fcc8167fabdee73f4a3287f1 Module libgmp.so.10 with build-id 25c73b398493c695a013a6d9d493a8316aac0fa0 Module expr with build-id b919757cbc30fbb64b14498222499d972fd80acd Versions of packages libc6 suggests: ii debconf [debconf-2.0] 1.5.79 pn glibc-doc ii libc-l10n 2.35-1 ii libnss-nis 3.1-4 ii libnss-nisplus 1.3-4 ii locales2.35-1 Hello Vasudev, I wonder if this libc6 installation is completed. Because the bug report mentions version 2.34-8 from testing, but e.g. locales and libc-l10n is 2.35-1. Also searching for a package containing the debug information for the build-id from the modules listing returns currently the version 2.34-8 from testing. But the build-id for ld-linux-x86-64.so.2 points to 2.35-1. Maybe the libc package installation got interrupted? Good catch. I also noticed that the libraries seems to be located in /usr/lib/x86_64-linux-gnu/, which is typical of a usrmerge system, but reportbug says "merged-usr: no". Vasudev, you should probably check that you do not have too versions of the glibc on your system, one in /lib/x86_64-linux-gnu/ and another one in /usr/lib/x86_64-linux-gnu/ without the /lib -> usr/lib symlink. Regards Aurelien -- Aurelien Jarno GPG: 4096R/1DDD8C9B aurel...@aurel32.net http://www.aurel32.net Hello Vasudev, ok, reverting back would explain reportbug using version 2.34-8. But was this core taken at a time where all libc packages should have been at 2.35-1 ? Then I don't understand that "Module" line, which shows the build-id from 2.34-8. And if I understand you right the stack smashing is from "autoreconf --version". But I could not find it executing any "expr" processes in my test VM. Kind regards, Bernhard
Bug#1020559: libc6: After upgrading libc6 expr is crashing with "stack smashing detected"
On Fri, 23 Sep 2022 14:45:07 +0530 Vasudev Kamath wrote: Package: libc6 Version: 2.34-8 I upgraded libc6 to latest released 2.35-1 Module ld-linux-x86-64.so.2 with build-id a03c3b14d371da908a3f22007b3f0c73d1f9f634 Module libc.so.6 with build-id ef3afb43092687d7fcc8167fabdee73f4a3287f1 Module libgmp.so.10 with build-id 25c73b398493c695a013a6d9d493a8316aac0fa0 Module expr with build-id b919757cbc30fbb64b14498222499d972fd80acd Versions of packages libc6 suggests: ii debconf [debconf-2.0] 1.5.79 pn glibc-doc ii libc-l10n 2.35-1 ii libnss-nis 3.1-4 ii libnss-nisplus 1.3-4 ii locales2.35-1 Hello Vasudev, I wonder if this libc6 installation is completed. Because the bug report mentions version 2.34-8 from testing, but e.g. locales and libc-l10n is 2.35-1. Also searching for a package containing the debug information for the build-id from the modules listing returns currently the version 2.34-8 from testing. But the build-id for ld-linux-x86-64.so.2 points to 2.35-1. Maybe the libc package installation got interrupted? Kind regards, Bernhard [1] /usr/lib/debug/.build-id/ef/3afb43092687d7fcc8167fabdee73f4a3287f1.debug https://packages.debian.org/search?searchon=contents=3afb43092687d7fcc8167fabdee73f4a3287f1=filename=testing=any [2] /usr/lib/debug/.build-id/a0/3c3b14d371da908a3f22007b3f0c73d1f9f634.debug https://packages.debian.org/search?searchon=contents=3c3b14d371da908a3f22007b3f0c73d1f9f634=filename=unstable=any
Bug#948287: bash: *** stack smashing detected *** ( SIGABRT crash )
Dear Maintainer, encountered again such a crash of a bash that was started while the old libc6 was installed, then installed a libc6 update, and then the "old" bash crashed after a tab completion. libc6:amd64 (2.30-8, 2.31-3) bash:amd64 (5.0-6, 5.0-7) Kind regards, Bernhard $ cp log*** stack smashing detected ***: terminated Connection to ... closed. # coredumpctl gdb PID: 4738 (bash) UID: 1000 (benutzer) GID: 1000 (benutzer) Signal: 6 (ABRT) Timestamp: Fri 2020-08-14 17:50:14 CEST (37s ago) Command Line: -bash Executable: /usr/bin/bash Stack trace of thread 4738: #0 0x7f4c0d38e781 n/a (/usr/lib/x86_64-linux-gnu/libc-2.30.so (deleted) + 0x3b781) #1 0x7f4c0d45fd7d n/a (/usr/lib/x86_64-linux-gnu/libc-2.30.so (deleted) + 0x10cd7d)
Bug#948584: libc6: Mounting nfsv4-export from my NAS there is a segfault in libc
Dear Maintainer, I could reproduce the crash now in an minimal unstable VM with the given config and the command line from the coredumpctl output. It seems that the function conf_parse_line is not prepared for missing quotation marks for the argument in the section head [1]. Therefore, if quotes are ommitted, the variable arg gets not filled, and therefore the cb->arg contains then a null pointer [2], that leads given to strcasecmp to the crash. @Miriam: I guess the crash should go away if change the config like following? - [ Server mirunas.mirulan.net ] - [ MountPoint /media/MiruNAS/Medienwerkstatt ] + [ Server "mirunas.mirulan.net" ] + [ MountPoint "/media/MiruNAS/Medienwerkstatt" ] Kind regards, Bernhard [1] https://sources.debian.org/src/nfs-utils/1:1.3.4-2.5/support/nfs/conffile.c/#L274 [2] https://sources.debian.org/src/nfs-utils/1:1.3.4-2.5/support/nfs/conffile.c/#L582
Bug#948584: libc6: Mounting nfsv4-export from my NAS there is a segfault in libc
Hello Miriam, thanks for the backtraces, just the one from "coredumctl gdb" is enough. Have you by any chance a file "/etc/nfsmount.conf" at this system? If there are no secrets inside, could you attach that too? Kind regards, Bernhard
Bug#948584: libc6: Mounting nfsv4-export from my NAS there is a segfault in libc
Hello Miriam, if possible, you could install the additional package systemd-coredump. Then in the output of 'journalctl --no-pager' at the bottom should the known 'segfault at' line appear. This and the following lines at that time would be of interest. This would get better if the additional nfs-common-dbgsym could be installed [1] (from a separate repo). If additonal to the above steps the package gdb is installed, 'coredumpctl gdb' with the command 'bt full' at the gdb prompt would yield even better information. Kind regards, Bernhard [1] https://wiki.debian.org/HowToGetABacktrace#Installing_the_debugging_symbols
Bug#946606: libc-bin: catchsegv does not handle backtraces with parentheses
Dear Maintainer,
sorry, did attempt to output the build-id unconditionally,
fixed in attached patch version.
Kind regards,
Bernhard
>From 0a4a73d4eeaa45acdbeb6ea8fea878e134cbc11b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernhard=20=C3=9Cbelacker?=
Date: Wed, 11 Dec 2019 19:56:39 +0100
Subject: Make catchsegv work again after format changed and add build-ids.
https://sourceware.org/bugzilla/show_bug.cgi?id=21830
---
debug/backtracesymsfd.c | 32 +-
debug/catchsegv.sh | 50 -
2 files changed, 70 insertions(+), 12 deletions(-)
diff --git a/debug/backtracesymsfd.c b/debug/backtracesymsfd.c
index 5751d62f..9bc058fb 100644
--- a/debug/backtracesymsfd.c
+++ b/debug/backtracesymsfd.c
@@ -35,13 +35,14 @@
void
__backtrace_symbols_fd (void *const *array, int size, int fd)
{
- struct iovec iov[9];
+ struct iovec iov[12];
int cnt;
for (cnt = 0; cnt < size; ++cnt)
{
char buf[WORD_WIDTH];
char buf2[WORD_WIDTH];
+ char buf3[WORD_WIDTH];
Dl_info info;
struct link_map *map;
size_t last = 0;
@@ -96,6 +97,35 @@ __backtrace_symbols_fd (void *const *array, int size, int fd)
- (char *) iov[last].iov_base);
++last;
+ /* Even when we have a symbol name, print the file offset to
+ make processing in addr2line possible. */
+ if (info.dli_sname != NULL)
+ {
+ iov[last].iov_base = (void *) ",";
+ iov[last].iov_len = 1;
+ ++last;
+
+ if (array[cnt] >= (void *) map->l_addr)
+ {
+ iov[last].iov_base = (void *) "+0x";
+ diff = array[cnt] - (void *) map->l_addr;
+ }
+ else
+ {
+ iov[last].iov_base = (void *) "-0x";
+ diff = (void *) map->l_addr - array[cnt];
+ }
+ iov[last].iov_len = 3;
+ ++last;
+
+ iov[last].iov_base = _itoa_word ((unsigned long int) diff,
+ [WORD_WIDTH], 16, 0);
+ iov[last].iov_len = ([WORD_WIDTH]
+ - (char *) iov[last].iov_base);
+ ++last;
+
+ }
+
iov[last].iov_base = (void *) ")";
iov[last].iov_len = 1;
++last;
diff --git a/debug/catchsegv.sh b/debug/catchsegv.sh
index 245c100f..fd6a232a 100755
--- a/debug/catchsegv.sh
+++ b/debug/catchsegv.sh
@@ -52,6 +52,7 @@ Written by Ulrich Drepper.'
fi
segv_output=`mktemp ${TMPDIR:-/tmp}/segv_output.XX` || exit
+used_libs=`mktemp ${TMPDIR:-/tmp}/used_libs.XX` || exit
# Redirect stderr to avoid termination message from shell.
(exec 3>&2 2>/dev/null
@@ -87,21 +88,48 @@ if test -s "$segv_output"; then
sed '/Backtrace/q' "$segv_output"
sed '1,/Backtrace/d' "$segv_output" |
(while read line; do
- line=`echo $line | sed "s@^$prog\\(\\[.*\\)@\1@"`
case "$line" in
- \[*) addr=`echo "$line" | sed 's/^\[\(.*\)\]$/\1/'`
- complete=`addr2line -f -e "$prog" $addr 2>/dev/null`
- if test $? -eq 0; then
- echo "`echo "$complete"|sed 'N;s/\(.*\)\n\(.*\)/\2(\1)/;'`$line"
- else
- echo "$line"
- fi
- ;;
- *) echo "$line"
- ;;
+ *\(*\)\[*\])
+ lib=`echo $line | sed "s@^\(.*\)(\(.*\))\[\(.*\)\]\\$@\1@"`
+ offs=`echo $line | sed "s@^\(.*\)(\(.*\))\[\(.*\)\]\\$@\2@"`
+ addr=`echo $line | sed "s@^\(.*\)(\(.*\))\[\(.*\)\]\\$@\3@"`
+ func=""
+ case "$offs" in
+ *,*) func=`echo $offs | sed "s@\(.*\),\(.*\)\\$@\1,@"`
+offs=`echo $offs | sed "s@\(.*\),\(.*\)\\$@\2@"`
+;;
+ esac
+ case "$offs" in
+ +*) case "$prog" in
+ */$lib)
+ lib="$prog"
+ ;;
+ esac
+ complete=`addr2line -p -i -f -e "$lib" $offs 2>/dev/null`
+ if test $? -eq 0; then
+ echo " [$addr] $complete $lib($func$offs)"
+ else
+ echo " $line"
+ fi
+ ;;
+ *) echo " $line"
+ ;;
+ esac
+ echo "$lib" >> "$used_libs"
+ ;;
+*) echo "$line"
+ ;;
esac
done)
+ objdumptest=`objdump --version 2>/dev/null`
+ if test $? -eq 0; then
+echo "\nBuild-IDs:"
+sort -u "$used_libs" | while read lib; do
+ objdump -s -j .note.gnu.build-id "$lib"
+done
+ fi
fi
rm -f "$segv_output"
+rm -f "$used_libs"
exit $exval
--
2.24.0
Bug#946606: libc-bin: catchsegv does not handle backtraces with parentheses
Dear Maintainer,
while I was at it, I attempted to change the output to
deliver the before mentioned information for addr2line too.
Attached is a improved patch, that would now output following:
Backtrace:
[0x55f317f9175b] main at
/usr/share/doc/libsoxr-dev/examples/3-options-input-fn.c:79 (discriminator 4)
/tmp/tmp.sSrfzsTKpn/3-options-input-fn(+0x175b)
[0x7fd67920fbbb] __libc_start_main at
/root/source/glibc/try1/glibc-2.29/csu/../csu/libc-start.c:342
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb,+0x26bbb)
[0x55f317f911ba] _start at ??:? /tmp/tmp.sSrfzsTKpn/3-options-input-fn(+0x11ba)
At the end there is another small change to add the build-ids
of the in the backtrace involved binaries to the output.
Kind regards,
Bernhard
>From cb1fdbd4e5a7fbeb1de27b72a7945a0b4789d251 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernhard=20=C3=9Cbelacker?=
Date: Wed, 11 Dec 2019 19:56:39 +0100
Subject: Make catchsegv work again after format changed and add build-ids.
https://sourceware.org/bugzilla/show_bug.cgi?id=21830
---
debug/backtracesymsfd.c | 32 +-
debug/catchsegv.sh | 51 -
2 files changed, 71 insertions(+), 12 deletions(-)
diff --git a/debug/backtracesymsfd.c b/debug/backtracesymsfd.c
index 5751d62f..9bc058fb 100644
--- a/debug/backtracesymsfd.c
+++ b/debug/backtracesymsfd.c
@@ -35,13 +35,14 @@
void
__backtrace_symbols_fd (void *const *array, int size, int fd)
{
- struct iovec iov[9];
+ struct iovec iov[12];
int cnt;
for (cnt = 0; cnt < size; ++cnt)
{
char buf[WORD_WIDTH];
char buf2[WORD_WIDTH];
+ char buf3[WORD_WIDTH];
Dl_info info;
struct link_map *map;
size_t last = 0;
@@ -96,6 +97,35 @@ __backtrace_symbols_fd (void *const *array, int size, int fd)
- (char *) iov[last].iov_base);
++last;
+ /* Even when we have a symbol name, print the file offset to
+ make processing in addr2line possible. */
+ if (info.dli_sname != NULL)
+ {
+ iov[last].iov_base = (void *) ",";
+ iov[last].iov_len = 1;
+ ++last;
+
+ if (array[cnt] >= (void *) map->l_addr)
+ {
+ iov[last].iov_base = (void *) "+0x";
+ diff = array[cnt] - (void *) map->l_addr;
+ }
+ else
+ {
+ iov[last].iov_base = (void *) "-0x";
+ diff = (void *) map->l_addr - array[cnt];
+ }
+ iov[last].iov_len = 3;
+ ++last;
+
+ iov[last].iov_base = _itoa_word ((unsigned long int) diff,
+ [WORD_WIDTH], 16, 0);
+ iov[last].iov_len = ([WORD_WIDTH]
+ - (char *) iov[last].iov_base);
+ ++last;
+
+ }
+
iov[last].iov_base = (void *) ")";
iov[last].iov_len = 1;
++last;
diff --git a/debug/catchsegv.sh b/debug/catchsegv.sh
index 245c100f..8d8a38f0 100755
--- a/debug/catchsegv.sh
+++ b/debug/catchsegv.sh
@@ -52,6 +52,7 @@ Written by Ulrich Drepper.'
fi
segv_output=`mktemp ${TMPDIR:-/tmp}/segv_output.XX` || exit
+used_libs=`mktemp ${TMPDIR:-/tmp}/used_libs.XX` || exit
# Redirect stderr to avoid termination message from shell.
(exec 3>&2 2>/dev/null
@@ -87,21 +88,49 @@ if test -s "$segv_output"; then
sed '/Backtrace/q' "$segv_output"
sed '1,/Backtrace/d' "$segv_output" |
(while read line; do
- line=`echo $line | sed "s@^$prog\\(\\[.*\\)@\1@"`
case "$line" in
- \[*) addr=`echo "$line" | sed 's/^\[\(.*\)\]$/\1/'`
- complete=`addr2line -f -e "$prog" $addr 2>/dev/null`
- if test $? -eq 0; then
- echo "`echo "$complete"|sed 'N;s/\(.*\)\n\(.*\)/\2(\1)/;'`$line"
- else
- echo "$line"
- fi
- ;;
- *) echo "$line"
- ;;
+ *\(*\)\[*\])
+ lib=`echo $line | sed "s@^\(.*\)(\(.*\))\[\(.*\)\]\\$@\1@"`
+ offs=`echo $line | sed "s@^\(.*\)(\(.*\))\[\(.*\)\]\\$@\2@"`
+ addr=`echo $line | sed "s@^\(.*\)(\(.*\))\[\(.*\)\]\\$@\3@"`
+ func=""
+ case "$offs" in
+ *,*) func=`echo $offs | sed "s@\(.*\),\(.*\)\\$@\1,@"`
+offs=`echo $offs | sed "s@\(.*\),\(.*\)\\$@\2@"`
+;;
+ esac
+ case "$offs" in
+ +*) case "$prog" in
+ */$lib)
+ lib="$prog"
+ ;;
+ esac
+ complete=`addr2line -p -i -f -e "$lib" $offs 2>/dev/null`
+ if test $? -eq 0; then
+ echo " [$addr] $complete $lib($func$offs)"
+ else
+ echo " $line"
+ fi
+ ;;
+ *) echo " $line"
+ ;;
+ esac
+ echo "$lib" >> "$used_libs"
+ ;;
+*) echo "$line"
+ ;;
esac
done)
fi
rm -f "$segv_output"
+objdumptest=`objdump --version 2>/dev/null`
+if test $? -eq 0; then
+ echo "\nBuild-IDs:"
+ sort -u /tmp/used_libs.kUDu9V | while read lib; do
+objdump -s -j .note.gnu.build-id "$lib"
+ done
+fi
+rm
Bug#946606: libc-bin: catchsegv does not handle backtraces with parentheses
Package: libc-bin Version: 2.29-3 Severity: wishlist Tags: upstream patch Dear Maintainer, since upstream commit in 2012 [1] the function __backtrace_symbols_fd seems to outputs in one of this formats: program(+)[] program(function+)[] Therefore the /usr/bin/catchsegv cannot find the backtrace lines and produces less useful outputs (see below) There exists an upstream bug about the issue [2]. Attached patch is an attempt to parse the offset instead of the address, which seems now less important due to ASLR. Known symbols are currently written by __backtrace_symbols_fd as such with the offset in relation to the function instead of the library section. To get for these also sourcefile and line information either __backtrace_symbols_fd needs to be changed to output the library section offset to the backtrace too, or addr2line (binutils) needs a change to lookup the symbol and calculate from there, but both would be different issues. What do you think? Kind regards, Bernhard Current: Backtrace: /tmp/tmp.sSrfzsTKpn/3-options-input-fn(+0x175b)[0x557275eb775b] /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb)[0x7f4f8194ebbb] /tmp/tmp.sSrfzsTKpn/3-options-input-fn(+0x11ba)[0x557275eb71ba] With proposed changes: Backtrace: [0x5578ceb0575b] main at /usr/share/doc/libsoxr-dev/examples/3-options-input-fn.c:79 (discriminator 4) /tmp/tmp.sSrfzsTKpn/3-options-input-fn(+0x175b) /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb)[0x7fcf5f243bbb] [0x5578ceb051ba] _start at ??:? /tmp/tmp.sSrfzsTKpn/3-options-input-fn(+0x11ba) [1] https://sourceware.org/git/?p=glibc.git;a=commit;h=1d6c3d237d10606121c959b9bd2ae722f79ea899 [2] https://sourceware.org/bugzilla/show_bug.cgi?id=21830 -- System Information: Debian Release: bullseye/sid APT prefers testing-debug APT policy: (500, 'testing-debug'), (500, 'proposed-updates-debug'), (500, 'testing') Architecture: amd64 (x86_64) Kernel: Linux 5.3.0-2-amd64 (SMP w/12 CPU cores) Locale: LANG=de_DE.UTF-8, LC_CTYPE=de_DE.UTF-8 (charmap=UTF-8), LANGUAGE=de_DE.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages libc-bin depends on: ii libc6 2.29-3 Versions of packages libc-bin recommends: ii manpages 5.04-1 libc-bin suggests no packages. -- no debconf information >From fca03cd9af5ffaea1e4968fa27a7b28ee80903ef Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Bernhard=20=C3=9Cbelacker?= Date: Wed, 11 Dec 2019 19:56:39 +0100 Subject: Make catchsegv work again after format changed. https://sourceware.org/bugzilla/show_bug.cgi?id=21830 --- debug/catchsegv.sh | 34 +++--- 1 file changed, 23 insertions(+), 11 deletions(-) diff --git a/debug/catchsegv.sh b/debug/catchsegv.sh index 245c100f..da87122c 100755 --- a/debug/catchsegv.sh +++ b/debug/catchsegv.sh @@ -87,18 +87,30 @@ if test -s "$segv_output"; then sed '/Backtrace/q' "$segv_output" sed '1,/Backtrace/d' "$segv_output" | (while read line; do - line=`echo $line | sed "s@^$prog\\(\\[.*\\)@\1@"` case "$line" in - \[*) addr=`echo "$line" | sed 's/^\[\(.*\)\]$/\1/'` - complete=`addr2line -f -e "$prog" $addr 2>/dev/null` - if test $? -eq 0; then - echo "`echo "$complete"|sed 'N;s/\(.*\)\n\(.*\)/\2(\1)/;'`$line" - else - echo "$line" - fi - ;; - *) echo "$line" - ;; + *\(*\)\[*\]) + lib=`echo $line | sed "s@^\(.*\)(\(.*\))\[\(.*\)\]\\$@\1@"` + offs=`echo $line | sed "s@^\(.*\)(\(.*\))\[\(.*\)\]\\$@\2@"` + addr=`echo $line | sed "s@^\(.*\)(\(.*\))\[\(.*\)\]\\$@\3@"` + case "$offs" in + +*) case "$prog" in + */$lib) + lib="$prog" + ;; + esac + complete=`addr2line -p -i -f -e "$lib" $offs 2>/dev/null` + if test $? -eq 0; then + echo " [$addr] $complete $lib($offs)" + else + echo " $line" + fi + ;; + *) echo " $line" +;; + esac + ;; +*) echo "$line" + ;; esac done) fi -- 2.24.0
Bug#913929: Bug #913929: pldd never stops
Dear Maintainer, this looks like a matching upstream bug: https://sourceware.org/bugzilla/show_bug.cgi?id=18035 Kind regards, Bernhard
