Re: environment corrupt; missing value for QT_IM_MO

[Christoph Moench-Tegeder]

## Andriy Gapon (a...@freebsd.org):

> It did not make sense to me that libcrypto would have such a bug and then I
> noticed that libcrypto.so.7 was involved.

Now that you mention libcrypto... There was a similar (the same?) issue
about a year ago in VirtualBox, which ended up being linked against
base system (libcrypto.so.7) and ports (libcrypto.so.8) openssl.
At the risk of citing myself:
https://lists.freebsd.org/pipermail/freebsd-emulation/2015-March/012390.html
Sorry, I didn't spot this thread earlier...

Regards,
Christoph

-- 
Spare Space
___
freebsd-current@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"

Re: environment corrupt; missing value for QT_IM_MO

[Andriy Gapon]

On 19/01/2016 15:16, Andriy Gapon wrote:
> So, it's "QT_IM_MODULE=xim" with 4 bytes (corresponding to "DULE") replaced 
> with
> zeroes.  This is 100% reproducible in my current environment, so it could be a
> deterministic write to a wrong offset.

Okay, I've debugged and fixed the problem, but I do not have any exciting
discoveries.  just another lesson that problems with an environment (in the
general sense of that word) could manifest themselves in very strange ways.

In the following debugging session it's LSCOLORS variable that was corrupted:

(gdb) p environ[81]
$3 = 0x7fffef32 "LSCOLORS"
(gdb) p environ[82]
$4 = 0x0
(gdb) x/s 0x7fffef32
0x7fffef32: "LSCOLORS"
(gdb) x/s 0x7fffef3a
0x7fffef3a: ""
(gdb) x/s 0x7fffef3b
0x7fffef3b: ""
(gdb) x/s 0x7fffef3c
0x7fffef3c: ""
(gdb) x/s 0x7fffef3d
0x7fffef3d: ""
(gdb) x/s 0x7fffef3e
0x7fffef3e: "xcxdxbxegedabagacad"
(gdb) watch -l *(int *)0x7fffef3a
Hardware watchpoint 2: -location *(int *)0x7fffef3a

Old value = 1719158077
New value = 0
OPENSSL_ia32_cpuid () at /usr/src/secure/lib/libcrypto/amd64/x86_64cpuid.S:45
45  movl%eax,%r11d
(gdb) p/x 1719158077
$7 = 0x6678453d
(gdb) bt
#0  OPENSSL_ia32_cpuid () at 
/usr/src/secure/lib/libcrypto/amd64/x86_64cpuid.S:45
#1  0x0008160e5b1d in OPENSSL_cpuid_setup () at
/usr/src/secure/lib/libcrypto/../../../crypto/openssl/crypto/cryptlib.c:699
#2  0x000815fe7dde in _init () from /lib/libcrypto.so.7
#3  0x7fffdae0 in ?? ()
#4  0x0008006049c8 in objlist_call_init (list=,
lockstate=0x7fffdb68) at /usr/src/libexec/rtld-elf/rtld.c:2438
#5  0x00080060407f in _rtld (sp=, exit_proc=0x7fffe130,
objp=0x7fffe138) at /usr/src/libexec/rtld-elf/rtld.c:665
#6  0x000800602439 in .rtld_start () at
/usr/src/libexec/rtld-elf/amd64/rtld_start.S:39
(kgdb) list
40  movq%rbx,%r8
41
42  xorl%eax,%eax
43  movl%eax,8(%rdi)
44  cpuid
45  movl%eax,%r11d
46
47  xorl%eax,%eax
48  cmpl$1970169159,%ebx
49  setne   %al
(kgdb) p/x $rdi
$11 = 0x7fffef32

It did not make sense to me that libcrypto would have such a bug and then I
noticed that libcrypto.so.7 was involved.  The current version is
libcrypto.so.8, but I have forgotten to run make delete-old-libs, so I had both
installed.  And it turned out that libreoffice executable was linked to both
because one of libraries, libtspi.so.1 from trousers-tddl-0.3.10_7, hadn't been
updated since libcrypto.so.8 was introduced.

-- 
Andriy Gapon
___
freebsd-current@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"

Re: environment corrupt; missing value for QT_IM_MO

[Andriy Gapon]

On 05/01/2016 21:36, Ryan Stone wrote:
> On Tue, Jan 5, 2016 at 3:54 AM, Andriy Gapon  wrote:
> 
>> Is there a limit on the environment's size?
>>
> 
> If memory serves, this is bounded by ARG_MAX in sys/syslimits.h.  The value
> is not tunable as far as I know, so if you want to experiment with changing
> it you will have to change syslimits.h and recompile your kernel.

The total arguments and environment size seems to be much smaller than ARG_MAX
of 256K.

-- 
Andriy Gapon
___
freebsd-current@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"

Re: environment corrupt; missing value for QT_IM_MO

[Andriy Gapon]

On 05/01/2016 10:54, Andriy Gapon wrote:
> On 05/01/2016 10:45, Andriy Gapon wrote:
>>
>> Very weird, this suddenly started happening to me but with libreoffice.  I 
>> can
>> not correlate the problem with any actions /  events.
>>
>> stderr:
>> soffice.bin: environment corrupt; missing value for QT_IM_MO
>>
>> gdb:
>> Core was generated by `soffice.bin'.
>> Program terminated with signal SIGABRT, Aborted.
>> #0  thr_kill () at thr_kill.S:3
>> 3   RSYSCALL(thr_kill)
>> [Current thread is 2 (Thread 816615000 (LWP 102134))]
>> (gdb) bt
>> #0  thr_kill () at thr_kill.S:3
>> #1  0x000800dc5ddb in __raise (s=6) at /usr/src/lib/libc/gen/raise.c:52
>> #2  0x000800dc5d49 in abort () at /usr/src/lib/libc/stdlib/abort.c:65
>> #3  0x000805231318 in tools::extendApplicationEnvironment() () from
>> /usr/local/lib/libreoffice/program/libtllo.so
>>
>> Smells like a possible bug in libc...
> 
> Is there a limit on the environment's size?
> QT_IM_MODULE is reported by ps as the last variable.

I have taken another look at the problem and I've discovered that the affected
variable is corrupted in a peculiar way:
(kgdb) p environ[61]
$23 = 0x7fffef45 "QT_IM_MO"
(kgdb) x/s 0x7fffef45
0x7fffef45: "QT_IM_MO"
(kgdb) x/s 0x7fffef4d
0x7fffef4d: ""
(kgdb) x/s 0x7fffef4e
0x7fffef4e: ""
(kgdb) x/s 0x7fffef4f
0x7fffef4f: ""
(kgdb) x/s 0x7fffef50
0x7fffef50: ""
(kgdb) x/s 0x7fffef51
0x7fffef51: "=xim"
(kgdb) p environ[62]
$42 = 0x0

So, it's "QT_IM_MODULE=xim" with 4 bytes (corresponding to "DULE") replaced with
zeroes.  This is 100% reproducible in my current environment, so it could be a
deterministic write to a wrong offset.


-- 
Andriy Gapon
___
freebsd-current@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"

Re: environment corrupt; missing value for QT_IM_MO

[Andriy Gapon]

On 05/01/2016 10:45, Andriy Gapon wrote:
> 
> Very weird, this suddenly started happening to me but with libreoffice.  I can
> not correlate the problem with any actions /  events.
> 
> stderr:
> soffice.bin: environment corrupt; missing value for QT_IM_MO
> 
> gdb:
> Core was generated by `soffice.bin'.
> Program terminated with signal SIGABRT, Aborted.
> #0  thr_kill () at thr_kill.S:3
> 3   RSYSCALL(thr_kill)
> [Current thread is 2 (Thread 816615000 (LWP 102134))]
> (gdb) bt
> #0  thr_kill () at thr_kill.S:3
> #1  0x000800dc5ddb in __raise (s=6) at /usr/src/lib/libc/gen/raise.c:52
> #2  0x000800dc5d49 in abort () at /usr/src/lib/libc/stdlib/abort.c:65
> #3  0x000805231318 in tools::extendApplicationEnvironment() () from
> /usr/local/lib/libreoffice/program/libtllo.so
> 
> Smells like a possible bug in libc...

Is there a limit on the environment's size?
QT_IM_MODULE is reported by ps as the last variable.

ps axwwlee -p 4629
 UID  PID PPID CPU PRI NIVSZ   RSS MWCHAN STAT TT TIME COMMAND
1001 46291   0  21  0 351744 28428 select Ss-  0:09.37
KDE_SESSION_VERSION=4 VENDOR=amd GS_LIB=/home/avg/.fonts GTK_IM_MODULE=xim
LOGNAME=avg LC_CTYPE=uk_UA.UTF-8 LC_MESSAGES=C LSCOLORS=Exfxcxdxbxegedabagacad
JAVA_VERSION=1.5 LANG=uk_UA.UTF-8 PAGER=more XDM_MANAGED=method=classic
OSTYPE=FreeBSD LC_TIME=en_GB.US-ASCII CDIFFCOLORS=1:36:31:35
XDG_DATA_DIRS=/usr/local/share::/usr/share:/usr/local/share:/usr/local/share/gnome
DESKTOP_SESSION=custom MACHTYPE=x86_64 CLICOLOR= MAIL=/var/mail/avg
PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin:/usr/local/gnu-autotools/bin:/usr/games:/home/avg/bin:.
QT_PLUGIN_PATH=/usr/home/avg/.kde4/lib/kde4/plugins/:/usr/local/lib/kde4/plugins/
 EDITOR=vim
HOST=trant GTK2_RC_FILES=/home/avg/.gtkrc-2.0-kde4 JAVA_OS=native
KDE_SESSION_UID=1001 DISPLAY=:0 DM_CONTROL=/var/run/xdmctl OLDPWD=/home/avg
SSH_AUTH_SOCK=/tmp/ssh-CI9wwUUaf762/agent.4579 PWD=/home/avg
XDG_CURRENT_DESKTOP=KDE _=/home/avg/.xsession GROUP=staff
DBUS_SESSION_BUS_ADDRESS=unix:path=/tmp/dbus-11hLaxhk4u,guid=fe710affe5d1ea53e5034d0d56898723
USER=avg HOME=/home/avg EXINIT=set autoindent LC_COLLATE=uk_UA.UTF-8
LC_NUMERIC=C CHARSET=UTF-8 LC_MONETARY=C SHELL=/usr/local/bin/zsh
HOSTTYPE=FreeBSD IBM_NOLDT=1 MM_CHARSET=UTF-8 LD_BIND_NOW=true
KDE_FULL_SESSION=true MORE=-e -R -Pm?f%f:stdin .?lbLine %lb:?pb%pb\\%:?bbByte
%bb:-... ?eEND CDROM=/dev/cd0
XDG_CONFIG_DIRS=:/etc/xdg:/usr/local/etc/xdg:/usr/local/etc/xdg/xfce4
XDG_SESSION_COOKIE=3440bb84087c22a5d5d65b192c69-1451853601.307276-216584541
SSH_AGENT_PID=4580 BLOCKSIZE=K QT_IM_MODULE=xim kdeinit4: kdeinit4 Running...
(kdeinit4)


-- 
Andriy Gapon
___
freebsd-current@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"

Re: environment corrupt; missing value for QT_IM_MO

[Ryan Stone]

On Tue, Jan 5, 2016 at 3:54 AM, Andriy Gapon  wrote:

> Is there a limit on the environment's size?
>

If memory serves, this is bounded by ARG_MAX in sys/syslimits.h.  The value
is not tunable as far as I know, so if you want to experiment with changing
it you will have to change syslimits.h and recompile your kernel.
___
freebsd-current@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/freebsd-current
To unsubscribe, send any mail to "freebsd-current-unsubscr...@freebsd.org"