Debian Bug report logs - #451428
Unaligned hp->h_addr_list in gethostbyname_r; crashes on ARM

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Jonas Häggqvist <rasher@rasher.dk>

To: submit@bugs.debian.org

Subject: nfs-kernel-server: rpc.mountd segfault on mount

Date: Thu, 15 Nov 2007 22:29:20 +0100

Package: nfs-kernel-server
Version: 1:1.0.10-6+etch.1
Severity: normal


rpc.mountd consistently segfaults for me when attempting to mount an
export. In the run below, I run mount on a remote machine to attempt
to mount it. After that, mountd segfaults.

This is on an NSLU2 with an i386 client.


# gdb /usr/sbin/rpc.mountd
GNU gdb 6.4.90-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "arm-linux-gnu"...(no debugging symbols found)
Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) run -d all -F
Starting program: /usr/sbin/rpc.mountd -d all -F
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
mountd: MNT3(/home/rasher) called
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)
(no debugging symbols found)

Program received signal SIGSEGV, Segmentation fault.
0x400b2e4c in memcpy () from /lib/libc.so.6



-- System Information:
Debian Release: 4.0
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: arm (armv5tel)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-4-ixp4xx
Locale: LANG=da_DK.UTF-8, LC_CTYPE=da_DK.UTF-8 (charmap=UTF-8)

Versions of packages nfs-kernel-server depends on:
ii  libc6    2.3.6.ds1-13etch2               GNU C Library: Shared libraries
ii  libcomer 1.39+1.40-WIP-2006.11.14+dfsg-2 common error description library
ii  libgssap 0.10-4                          A mechanism-switch gssapi library
ii  libkrb53 1.4.4-7etch4                    MIT Kerberos runtime libraries
ii  libnfsid 0.18-0                          An nfs idmapping library
ii  librpcse 0.14-2etch3                     allows secure rpc communication us
ii  libwrap0 7.6.dbs-13                      Wietse Venema's TCP wrappers libra
ii  lsb-base 3.1-23.2etch1                   Linux Standard Base 3.1 init scrip
ii  nfs-comm 1:1.0.10-6+etch.1               NFS support files common to client
ii  ucf      2.0020                          Update Configuration File: preserv

nfs-kernel-server recommends no packages.

-- no debconf information

-- 
Jonas Häggqvist
rasher(at)rasher(dot)dk

Message #10 received at 451428@bugs.debian.org (full text, mbox, reply):

From: "Steinar H. Gunderson" <sgunderson@bigfoot.com>

To: Jonas Häggqvist <rasher@rasher.dk>, 451428@bugs.debian.org

Subject: Re: Bug#451428: nfs-kernel-server: rpc.mountd segfault on mount

Date: Fri, 16 Nov 2007 08:57:10 +0100

On Thu, Nov 15, 2007 at 10:29:20PM +0100, Jonas Häggqvist wrote:
> Program received signal SIGSEGV, Segmentation fault.
> 0x400b2e4c in memcpy () from /lib/libc.so.6

Could you please make a backtrace here? Preferably in a package with
debugging symbols compiled in.

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Message #15 received at 451428@bugs.debian.org (full text, mbox, reply):

From: Jonas Häggqvist <rasher@rasher.dk>

To: 451428@bugs.debian.org

Subject: Re: Bug#451428: nfs-kernel-server: rpc.mountd segfault on mount

Date: Fri, 16 Nov 2007 12:05:17 +0100

Steinar H. Gunderson wrote:
> On Thu, Nov 15, 2007 at 10:29:20PM +0100, Jonas Häggqvist wrote:
>> Program received signal SIGSEGV, Segmentation fault.
>> 0x400b2e4c in memcpy () from /lib/libc.so.6
> 
> Could you please make a backtrace here? Preferably in a package with
> debugging symbols compiled in.

During my attempt to do so, I couldn't reproduce the problem with the
packages built with debug symbols. After reinstalling the regular
packages, I can no longer reproduce. I don't know what to blame, but
this bug should be closed at any rate.

-- 
Jonas Häggqvist
rasher(at)rasher(dot)dk

Message #20 received at 451428-done@bugs.debian.org (full text, mbox, reply):

From: "Steinar H. Gunderson" <sgunderson@bigfoot.com>

To: Jonas Häggqvist <rasher@rasher.dk>, 451428-done@bugs.debian.org

Subject: Re: Bug#451428: nfs-kernel-server: rpc.mountd segfault on mount

Date: Fri, 16 Nov 2007 13:03:22 +0100

On Fri, Nov 16, 2007 at 12:05:17PM +0100, Jonas Häggqvist wrote:
> During my attempt to do so, I couldn't reproduce the problem with the
> packages built with debug symbols. After reinstalling the regular
> packages, I can no longer reproduce. I don't know what to blame, but
> this bug should be closed at any rate.

The best bugs are the bugs that go away by themselves! :-) Thanks, closing.

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Message #25 received at 451428@bugs.debian.org (full text, mbox, reply):

From: Jonas Häggqvist <rasher@rasher.dk>

To: 451428@bugs.debian.org

Subject: Re: Bug#451428 closed by "Steinar H. Gunderson" <sgunderson@bigfoot.com> (Re: Bug#451428: nfs-kernel-server: rpc.mountd segfault on mount)

Date: Mon, 19 Nov 2007 19:43:16 +0100

> On Fri, Nov 16, 2007 at 12:05:17PM +0100, Jonas Häggqvist wrote:
>> During my attempt to do so, I couldn't reproduce the problem with the
>> packages built with debug symbols. After reinstalling the regular
>> packages, I can no longer reproduce. I don't know what to blame, but
>> this bug should be closed at any rate.
> 
> The best bugs are the bugs that go away by themselves! :-) Thanks, closing.

Unfortunately, it came back. I have a backtrace now:


GNU gdb 6.4.90-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "arm-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) set pagination 0
(gdb) run -d all -F
Starting program: /usr/sbin/rpc.mountd -d all -F
mountd: MNT3(/mnt/wd) called

Program received signal SIGSEGV, Segmentation fault.
0x400b2e4c in memcpy () from /lib/libc.so.6
(gdb) bt full
#0  0x400b2e4c in memcpy () from /lib/libc.so.6
No symbol table info available.
#1  0x0000e7d8 in hostent_dup (hp=0x4015a9bc) at hostname.c:152
	len_ent = <value optimized out>
	num_aliases = <value optimized out>
	len_aliases = <value optimized out>
	num_addr_list = 2
	len_addr_list = <value optimized out>
	pos = 44
	i = <value optimized out>
	sp = <value optimized out>
	cp = (struct hostent *) 0x2a6a0
#2  0x0000e828 in get_reliable_hostbyaddr (addr=0x24cec "ˬ\001#", len=<value optimized out>,
type=<value optimized out>) at hostname.c:241
	hp = (struct hostent *) 0x24cec
	reverse = (struct hostent *) 0x2a6c4
	forward = (struct hostent *) 0xbe8a46b0
	sp = <value optimized out>
#3  0x0000b96c in auth_authenticate (what=0x0, caller=0x24ce8, path=0xbe8a359f "/mnt/wd") at auth.c:153
	exp = <value optimized out>
	epath = "/mnt/wd", '\0' <repeats 4089 times>
	p = <value optimized out>
	hp = <value optimized out>
	addr = {s_addr = 0}
	error = <value optimized out>
#4  0x0000a460 in get_rootfh (rqstp=<value optimized out>, path=<value optimized out>,
error=0xbe8a46b0, v3=1) at mountd.c:384
	sin = (struct sockaddr_in *) 0x24ce8
	stb = {st_dev = 0, __pad1 = 0, __st_ino = 1074071904, st_mode = 1073848320, st_nlink = 1, st_uid =
36572, st_gid = 148, st_rdev = 36636, __pad2 = 38460, st_size = 35434894908, st_blksize = 13416,
st_blocks = 7491700436, st_atim = {tv_sec = 151064, tv_nsec = -1098234156}, st_mtim = {tv_sec =
1024, tv_nsec = 1074939704}, st_ctim = {tv_sec = 151064, tv_nsec = 1}, st_ino = 648816014540212}
	estb = {st_dev = 13958764120, __pad1 = 41736, __st_ino = 1, st_mode = 0, st_nlink = 1, st_uid = 0,
st_gid = 76, st_rdev = 4612203527626817536, __pad2 = 54528, st_size = 1, st_blksize = 0, st_blocks =
0, st_atim = {tv_sec = 0, tv_nsec = 0}, st_mtim = {tv_sec = 0, tv_nsec = 0}, st_ctim = {tv_sec = 0,
tv_nsec = 0}, st_ino = 0}
	exp = (nfs_export *) 0xbe8a46b0
	rpath = "/mnt/wd", '\0' <repeats 738 times>,
"\b£\001@¬s\000@\024þÿÿ\024Î\001@T9\212¾\\\212\000\000,\033}\f:\220\000\000\005\000\000\000@8\005@",
'\0' <repeats 16 times>,
"8£\001@¬s\000@\024þÿÿ\024Î\001@\2149\212¾,\216\000\000(o\203\v\024\224\000\000\005\000\000\000@8\005@",
'\0' <repeats 12 times>,
"Ü¢\001@\r\000\000\000¬Ö\001@\2149\212¾\000\000\000\000(o\203\v\024\224\000\000Ð9\212¾\000Ð\001@¼9\212¾àu\000@XÖ\001@\003\000\000\0008£\001@\001\000\000\000\000\000\000\000\001\000\000\000¬Ö\001@L\000\000\000\001\000\000\000¬Ö\001"...
	p = 0xbe8a359f "/mnt/wd"
#5  0x0000a784 in mount_mnt_3_svc (rqstp=0xbe8a4bc4, path=0xbe8a46d4, res=0xbe8a46b0) at mountd.c:349
	fh = <value optimized out>
	flavors = {0, 1, 390003, 390004, 390005}
#6  0x000120f4 in rpc_dispatch (rqstp=0xbe8a4bc4, transp=0x24cd8, dtable=<value optimized out>,
nvers=<value optimized out>, argp=0xbe8a46d4, resp=0xbe8a46b0) at rpcdispatch.c:55
	dent = (struct rpc_dentry *) 0x1e5b4
#7  0x0000b86c in mount_dispatch (rqstp=0xbe8a4bc4, transp=0x295ef00) at mount_dispatch.c:83
	argument = {dirpath = 0x24668 "/mnt/wd"}
	result = {fstatus = {fhs_status = 0, fhstatus_u = {fhs_fhandle = '\0' <repeats 16 times>,
"\224K\212¾ L\212¾\000\004\000\000\000\000\000"}}, mountlist = 0x0, exports = 0x0}
#8  0x401215ec in svc_getreq_common () from /lib/libc.so.6
No symbol table info available.
#9  0x40121630 in svc_getreqset () from /lib/libc.so.6
No symbol table info available.
#10 0x0000d2b0 in my_svc_run () at svc_run.c:90
	readfds = {fds_bits = {512, 0 <repeats 31 times>}}
	selret = 1
#11 0x0000b548 in main (argc=<value optimized out>, argv=<value optimized out>) at mountd.c:722
	fd = 123680
	export_file = 0x4001ce14 ""
	state_dir = 0xbe8a4d8c ""
	foreground = 1
	port = 35628
	descriptors = 0
	c = <value optimized out>
	sa = {__sigaction_handler = {sa_handler = 0xa290 <sig_hup>, sa_sigaction = 0xa290 <sig_hup>},
sa_mask = {__val = {0 <repeats 32 times>}}, sa_flags = 0, sa_restorer = 0x40052ac0
<nis_clone_result+96660>}
	rlim = {rlim_cur = 1024, rlim_max = 1024}


-- 
Jonas Häggqvist
rasher(at)rasher(dot)dk

Message #30 received at 451428@bugs.debian.org (full text, mbox, reply):

From: "Steinar H. Gunderson" <sgunderson@bigfoot.com>

To: Jonas Häggqvist <rasher@rasher.dk>, 451428@bugs.debian.org

Subject: Re: Bug#451428: closed by "Steinar H. Gunderson" <sgunderson@bigfoot.com> (Re: Bug#451428: nfs-kernel-server: rpc.mountd segfault on mount)

Date: Mon, 19 Nov 2007 20:56:42 +0100

On Mon, Nov 19, 2007 at 07:43:16PM +0100, Jonas Häggqvist wrote:
> Unfortunately, it came back. I have a backtrace now:

Thanks. This looks like a most real bug, probably related to structure
padding somehow, but I'm not entirely sure how to attack it. Could you by any
chance reproduce it and get a backtrace under a non-optimizing build?

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Message #35 received at 451428@bugs.debian.org (full text, mbox, reply):

From: Jonas Häggqvist <rasher@rasher.dk>

To: "Steinar H. Gunderson" <sgunderson@bigfoot.com>, 451428@bugs.debian.org

Subject: Re: Bug#451428: closed by "Steinar H. Gunderson" <sgunderson@bigfoot.com> (Re: Bug#451428: nfs-kernel-server: rpc.mountd segfault on mount)

Date: Mon, 19 Nov 2007 22:47:31 +0100

[Message part 1 (text/plain, inline)]

Steinar H. Gunderson wrote:
> On Mon, Nov 19, 2007 at 07:43:16PM +0100, Jonas Häggqvist wrote:
>> Unfortunately, it came back. I have a backtrace now:
> 
> Thanks. This looks like a most real bug, probably related to structure
> padding somehow, but I'm not entirely sure how to attack it. Could you by any
> chance reproduce it and get a backtrace under a non-optimizing build?

After a bit of convincing (nfs-utils doesn't seem to support
DEB_BUILD_OPTIONS=noopt), here it is (attached, if all goes well).

-- 
Jonas Häggqvist
rasher(at)rasher(dot)dk

[rpc.mountd.txt (text/plain, inline)]

GNU gdb 6.4.90-debian
Copyright (C) 2006 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "arm-linux-gnu"...Using host libthread_db library "/lib/libthread_db.so.1".

(gdb) run -d all -F
Starting program: /usr/sbin/rpc.mountd -d all -F
mountd: MNT3(/mnt/wd) called

Program received signal SIGSEGV, Segmentation fault.
0x400b2e4c in memcpy () from /lib/libc.so.6
(gdb) bt full
#0  0x400b2e4c in memcpy () from /lib/libc.so.6
No symbol table info available.
#1  0x00011428 in hostent_dup (hp=0x4015a9bc) at hostname.c:152
	len_ent = 20
	len_name = 12
	num_aliases = 1
	len_aliases = 4
	num_addr_list = 2
	len_addr_list = 12
	pos = 44
	i = 0
	sp = (char **) 0x30613
	cp = (struct hostent *) 0x316f8
#2  0x000117c0 in get_reliable_hostbyaddr (addr=0x2bcec "ˬ\001#", len=4, type=2) at hostname.c:241
	hp = (struct hostent *) 0x0
	reverse = (struct hostent *) 0x4015a9bc
	forward = (struct hostent *) 0xbeb4a583
	sp = (char **) 0xbeb4a58a
#3  0x0000ca34 in auth_authenticate (what=0x1aff0 "mount", caller=0x2bce8, path=0xbeb4b5d7 "/mnt/wd")
    at auth.c:153
	exp = (nfs_export *) 0x0
	epath = "/mnt/wd", '\0' <repeats 4089 times>
	p = 0x0
	hp = (struct hostent *) 0x0
	addr = {s_addr = 587311296}
	error = 1073862316
#4  0x0000b04c in get_rootfh (rqstp=0xbeb4cc38, path=0xbeb4c744, error=0xbeb4c720, v3=1)
    at mountd.c:384
	sin = (struct sockaddr_in *) 0x2bce8
	stb = {st_dev = 0, __pad1 = 0, __st_ino = 0, st_mode = 0, st_nlink = 0, st_uid = 0, 
  st_gid = 0, st_rdev = 0, __pad2 = 0, st_size = 0, st_blksize = 1075156540, 
  st_blocks = 35434894908, st_atim = {tv_sec = 13416, tv_nsec = -1095447404}, st_mtim = {tv_sec = 1, 
    tv_nsec = 179736}, st_ctim = {tv_sec = -1095448764, tv_nsec = 1024}, st_ino = 771961316853560}
	estb = {st_dev = 0, __pad1 = 0, __st_ino = 0, st_mode = 0, st_nlink = 0, st_uid = 0, 
  st_gid = 0, st_rdev = 0, __pad2 = 0, st_size = 0, st_blksize = 0, st_blocks = 0, st_atim = {
    tv_sec = 0, tv_nsec = 0}, st_mtim = {tv_sec = 0, tv_nsec = 0}, st_ctim = {tv_sec = 0, 
    tv_nsec = 0}, st_ino = 0}
	exp = (nfs_export *) 0x40123db4
	rpath = "/mnt/wd", '\0' <repeats 690 times>, "\b£\001@¬s\000@\024þÿÿ\024Î\001@\\¹´¾\b\213\000\000\\\233«\aæ\221\000\000\005\000\000\000@8\005@", '\0' <repeats 12 times>, "Ü¢\001@\002\000\000\000¬Ö\001@\\¹´¾\000\000\000\000\\\233«\aæ\221\000\000\000\000\000\000h£\001@¬s\000@\024þÿÿ\024Î\001@°¹´¾¨\216\000\000(o\203\v\225\224\000\000\005\000\000\000@8\005@", '\0' <repeats 12 times>, "Ü¢\001@\r\000\000\000¬Ö\001@°¹´¾\000\000\000\000(o\203\v\225\224\000\000ô¹´¾\000Ð\001@๴¾àu\000@XÖ\001@\003\000\000"...
	p = 0xbeb4b5d7 "/mnt/wd"
#5  0x0000aecc in mount_mnt_3_svc (rqstp=0xbeb4cc38, path=0xbeb4c744, res=0xbeb4c720) at mountd.c:349
	fh = (struct nfs_fh_len *) 0x2be18
	flavors = {0, 1, 390003, 390004, 390005}
#6  0x0001722c in rpc_dispatch (rqstp=0xbeb4cc38, transp=0x2bcd8, dtable=0x25640, nvers=3, 
    argp=0xbeb4c744, resp=0xbeb4c720) at rpcdispatch.c:55
	dent = (struct rpc_dentry *) 0x255b8
#7  0x0000c48c in mount_dispatch (rqstp=0xbeb4cc38, transp=0x2bcd8) at mount_dispatch.c:83
	argument = {dirpath = 0x2f530 "/mnt/wd"}
	result = {fstatus = {fhs_status = 0, fhstatus_u = {
      fhs_fhandle = '\0' <repeats 16 times>, "h¯\025@\bÌ´¾\224Ì´¾\000\004\000"}}, mountlist = 0x0, 
  exports = 0x0}
#8  0x401215ec in svc_getreq_common () from /lib/libc.so.6
No symbol table info available.
#9  0x40121630 in svc_getreqset () from /lib/libc.so.6
No symbol table info available.
#10 0x0000ee24 in my_svc_run () at svc_run.c:90
	readfds = {fds_bits = {512, 0 <repeats 31 times>}}
	selret = 1
#11 0x0000c344 in main (argc=4, argv=0xbeb4ce14) at mountd.c:722
	export_file = 0x1b0c0 "/etc/exports"
	state_dir = 0x1b0d0 "/var/lib/nfs"
	foreground = 1
	port = 0
	descriptors = 0
	c = -1
	sa = {__sigaction_handler = {sa_handler = 0xa65c <sig_hup>, 
    sa_sigaction = 0xa65c <sig_hup>}, sa_mask = {__val = {0 <repeats 32 times>}}, sa_flags = 0, 
  sa_restorer = 0x40052ac0 <nis_clone_result+96660>}
	rlim = {rlim_cur = 1024, rlim_max = 1024}
(gdb) quitquit
The program is running.  Exit anyway? (y or n) 

Message #40 received at 451428@bugs.debian.org (full text, mbox, reply):

From: "Steinar H. Gunderson" <sgunderson@bigfoot.com>

To: Jonas Häggqvist <rasher@rasher.dk>, 451428@bugs.debian.org, pkg-utopia-maintainers@lists.alioth.debian.org

Cc: control@bugs.debian.org

Subject: Re: Bug#451428: closed by "Steinar H. Gunderson" <sgunderson@bigfoot.com> (Re: Bug#451428: nfs-kernel-server: rpc.mountd segfault on mount)

Date: Tue, 20 Nov 2007 00:02:35 +0100

unarchive 423222
reopen 451428
reassign 451428 libnss-mdns
severity 451428 grave
retitle 451428 Unaligned hp->h_addr_list in gethostbyname_r; crashes on ARM
tags 451428 etch
forcemerge 423222 451428
thanks

On Mon, Nov 19, 2007 at 07:43:16PM +0100, Jonas Häggqvist wrote:
> Unfortunately, it came back. I have a backtrace now:

After a while of debugging on IRC (thanks!) we found out that this is a dupe
of #423222, only showing itself on arm this time instead of on sparc. While
the new upstream version fixes the problem, a fix for stable is definitely in
order -- having programs randomly crash when libnss-mdns is enabled is not
very good. :-) Thus, I'm reopening the bug again. The fix seems relatively
simple, so it should be a good candidate for a stable upload.

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Send a report that this bug log contains spam.