Debian Bug report logs - #684580
torsocks: segfault in libtorsocks.so

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Damyan Ivanov <dmn@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: torsocks: segfault in libtorsocks.so

Date: Sat, 11 Aug 2012 15:07:40 +0300

Package: torsocks
Version: 1.2-3
Severity: important

Trying to run cvs via torsocks causes a segfault in libtorsocks.so:

 $ torsocks cvs up
 zsh: segmentation fault  torsocks cvs up

The backtrace is:

Program received signal SIGSEGV, Segmentation fault.
0x00007ffff7bd4694 in find_socks_request ()
   from /usr/lib/torsocks/libtorsocks.so
(gdb) bt
#0  0x00007ffff7bd4694 in find_socks_request ()
   from /usr/lib/torsocks/libtorsocks.so
#1  0x00007ffff7bcfbeb in torsocks_close_guts ()
   from /usr/lib/torsocks/libtorsocks.so
#2  0x00007ffff7055be1 in ?? () from /lib/x86_64-linux-gnu/libbsd.so.0
#3  0x00007ffff7055f3d in arc4random () from /lib/x86_64-linux-gnu/libbsd.so.0
#4  0x0000555555567f30 in main ()

To reproduce try running:

 torsocks cvs -d :pserver:anonymous@anonscm.debian.org:/cvs/webwml checkout webwml/english/doc


I didn't try to rebuild the package with 'nostrip' flag (no time right now), 
but I checked if there is a torsocks-dbg package. That might be helpful :)


Thanks!
    dam

-- System Information:
Debian Release: wheezy/sid
  APT prefers unstable
  APT policy: (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 3.5-trunk-amd64 (SMP w/4 CPU cores)
Locale: LANG=bg_BG.UTF-8, LC_CTYPE=bg_BG.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages torsocks depends on:
ii  libc6  2.13-35

Versions of packages torsocks recommends:
ii  tor  0.2.3.20-rc-1

torsocks suggests no packages.

-- no debconf information

Message #10 received at 684580@bugs.debian.org (full text, mbox, reply):

From: intrigeri <intrigeri@debian.org>

To: Damyan Ivanov <dmn@debian.org>

Cc: 684580@bugs.debian.org

Subject: Re: Bug#684580: torsocks: segfault in libtorsocks.so

Date: Sat, 11 Aug 2012 14:54:48 +0200

Hi Damyan,

Damyan Ivanov wrote (11 Aug 2012 12:07:40 GMT) :

> Trying to run cvs via torsocks causes a segfault in libtorsocks.so:

Thank you for this detailed bug report.
I can reproduce it with the example you provide.

> I didn't try to rebuild the package with 'nostrip' flag (no time
> right now),

Another test that could be useful would be to try compiling without
the 0002-If-a-symbol-cannot-be-found-also-try-by-prefixing-it.patch
Debian -specific patch. Not that I don't entirely trust it, but it is
handling real black magic.

> but I checked if there is a torsocks-dbg package. That might be
> helpful :)

Sure.

Message #15 received at 684580@bugs.debian.org (full text, mbox, reply):

From: Jérémy Bobbio <lunar@debian.org>

To: 684580@bugs.debian.org

Subject: Re: Bug#684580: torsocks: segfault in libtorsocks.so

Date: Sat, 11 Aug 2012 17:29:15 +0200

[Message part 1 (text/plain, inline)]

On Sat, Aug 11, 2012 at 03:07:40PM +0300, Damyan Ivanov wrote:
> Trying to run cvs via torsocks causes a segfault in libtorsocks.so:
> 
>  $ torsocks cvs up
>  zsh: segmentation fault  torsocks cvs up
> 
> The backtrace is:
> 
> Program received signal SIGSEGV, Segmentation fault.
> 0x00007ffff7bd4694 in find_socks_request ()
>    from /usr/lib/torsocks/libtorsocks.so
> (gdb) bt
> #0  0x00007ffff7bd4694 in find_socks_request ()
>    from /usr/lib/torsocks/libtorsocks.so
> #1  0x00007ffff7bcfbeb in torsocks_close_guts ()
>    from /usr/lib/torsocks/libtorsocks.so
> #2  0x00007ffff7055be1 in ?? () from /lib/x86_64-linux-gnu/libbsd.so.0
> #3  0x00007ffff7055f3d in arc4random () from /lib/x86_64-linux-gnu/libbsd.so.0
> #4  0x0000555555567f30 in main ()
> 
> To reproduce try running:
> 
>  torsocks cvs -d :pserver:anonymous@anonscm.debian.org:/cvs/webwml checkout webwml/english/doc

First, the problem does not appear when using CVS from Squeeze (that's
version 1:1.12.13-12+squeeze1). So it looks like it is triggered by a
change in the behaviour there, or some other change in the toolchain.

The segfault appears because at some point "requests" (defined at
socks.c:87) is not NULL, but no connections have been made yet.

This is strange, because it is defined to be NULL and so should be when
the library gets loaded. If I force it to NULL by modifying
torsocks_init(), then I have no segfaults, by CVS fails with the
following:

    cvs [checkout aborted]: internal error: testing support for unknown request?

The patch is the following:

--- a/src/torsocks.c
+++ b/src/torsocks.c
@@ -187,6 +187,7 @@ void torsocks_init(void)
         show_msg(MSGERR, "Fatal error: exiting\n");
         exit(1);
     }
+    requests = NULL;
 
     pthread_mutex_unlock(&torsocks_init_mutex);
 

This is a weird issue. Maybe we should ask CVS maintainers if they have
a clue…

Cheers,
-- 
Jérémy Bobbio                        .''`. 
jeremy.bobbio@irq7.fr               : :   :             lunar@debian.org
                                    `. `'` 
                                      `-

[signature.asc (application/pgp-signature, inline)]

Message #24 received at 684580@bugs.debian.org (full text, mbox, reply):

From: intrigeri <intrigeri@boum.org>

To: 684580@bugs.debian.org, Jérémy Bobbio <lunar@debian.org>, Damyan Ivanov <dmn@debian.org>

Subject: Re: Bug#684580: torsocks: segfault in libtorsocks.so

Date: Fri, 13 Dec 2013 14:43:24 +0100

Hi,

Jérémy Bobbio wrote (11 Aug 2012 15:29:15 GMT) :
> On Sat, Aug 11, 2012 at 03:07:40PM +0300, Damyan Ivanov wrote:
>> Trying to run cvs via torsocks causes a segfault in libtorsocks.so:
>> 
>>  $ torsocks cvs up
>>  zsh: segmentation fault  torsocks cvs up
>> 
>> The backtrace is:
>> 
>> Program received signal SIGSEGV, Segmentation fault.
>> 0x00007ffff7bd4694 in find_socks_request ()
>>    from /usr/lib/torsocks/libtorsocks.so
>> (gdb) bt
>> #0  0x00007ffff7bd4694 in find_socks_request ()
>>    from /usr/lib/torsocks/libtorsocks.so
>> #1  0x00007ffff7bcfbeb in torsocks_close_guts ()
>>    from /usr/lib/torsocks/libtorsocks.so
>> #2  0x00007ffff7055be1 in ?? () from /lib/x86_64-linux-gnu/libbsd.so.0
>> #3  0x00007ffff7055f3d in arc4random () from /lib/x86_64-linux-gnu/libbsd.so.0
>> #4  0x0000555555567f30 in main ()
>> 
>> To reproduce try running:
>> 
>>  torsocks cvs -d :pserver:anonymous@anonscm.debian.org:/cvs/webwml checkout webwml/english/doc

> First, the problem does not appear when using CVS from Squeeze (that's
> version 1:1.12.13-12+squeeze1). So it looks like it is triggered by a
> change in the behaviour there, or some other change in the toolchain.

> The segfault appears because at some point "requests" (defined at
> socks.c:87) is not NULL, but no connections have been made yet.

> This is strange, because it is defined to be NULL and so should be when
> the library gets loaded. If I force it to NULL by modifying
> torsocks_init(), then I have no segfaults, by CVS fails with the
> following:

>     cvs [checkout aborted]: internal error: testing support for unknown request?

> The patch is the following:

> --- a/src/torsocks.c
> +++ b/src/torsocks.c
> @@ -187,6 +187,7 @@ void torsocks_init(void)
>          show_msg(MSGERR, "Fatal error: exiting\n");
>          exit(1);
>      }
> +    requests = NULL;

>      pthread_mutex_unlock(&torsocks_init_mutex);

> This is a weird issue. Maybe we should ask CVS maintainers if they have
> a clue…

Anyone interested to try and reproduce this with torsocks 2.x RC from
Debian experimental?

Cheers,
--
  intrigeri
  | GnuPG key @ https://gaffer.ptitcanardnoir.org/intrigeri/intrigeri.asc
  | OTR fingerprint @ https://gaffer.ptitcanardnoir.org/intrigeri/otr.asc

Message #29 received at 684580-close@bugs.debian.org (full text, mbox, reply):

From: Jérémy Bobbio <lunar@debian.org>

To: 684580-close@bugs.debian.org

Subject: Bug#684580: fixed in torsocks 2.0.0-1

Date: Sun, 24 Aug 2014 21:51:20 +0000

Source: torsocks
Source-Version: 2.0.0-1

We believe that the bug you reported is fixed in the latest version of
torsocks, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 684580@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Jérémy Bobbio <lunar@debian.org> (supplier of updated torsocks package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Fri, 22 Aug 2014 23:37:53 +0000
Source: torsocks
Binary: torsocks
Architecture: source amd64
Version: 2.0.0-1
Distribution: unstable
Urgency: low
Maintainer: Anonymity Tools Debian Maintainers <pkg-anonymity-tools@lists.alioth.debian.org>
Changed-By: Jérémy Bobbio <lunar@debian.org>
Description:
 torsocks   - use SOCKS-friendly applications with Tor
Closes: 684580 704861 755458
Changes:
 torsocks (2.0.0-1) unstable; urgency=low
 .
   * New upstream release. The 2.0 rewrite is considered stable.
     (Closes: #684580, #704861, #755458)
   * Put under the umbrella of the Anonymity Tools Debian Maintainers team.
   * Add watch file and upstream signing key.
   * Add debian/README.source.
Checksums-Sha1:
 7581f21b44e2f7eb5c1d46e28cced80904100772 2009 torsocks_2.0.0-1.dsc
 73c4725617d8d526a7c28531e4f8dfb9ccc46b8e 349795 torsocks_2.0.0.orig.tar.bz2
 79d17f5e55acf59a7ecfb9f327e45ca5ee791113 9452 torsocks_2.0.0-1.debian.tar.xz
 10c2d638119d2217a8071ec25496ba608a5d0d57 61140 torsocks_2.0.0-1_amd64.deb
Checksums-Sha256:
 3907fd0d2ecd2c7eb73b7089e93dae177bdeff4087c96ee09ac92255061f3c91 2009 torsocks_2.0.0-1.dsc
 59dd4b90b94bfd5297b6cfba0b4d109826faba9fc36490f58b6d82d12e2cec02 349795 torsocks_2.0.0.orig.tar.bz2
 72101788dc5ba2a79c6e835faee2adca4c5a967c6812c9c89d49fe84aa50f8a1 9452 torsocks_2.0.0-1.debian.tar.xz
 71292e0fecb18b85612ef04b847c067b3e45538236457b6a5ab0cfb62565a601 61140 torsocks_2.0.0-1_amd64.deb
Files:
 64aaa240d731d16758055db41fd2a7aa 61140 net optional torsocks_2.0.0-1_amd64.deb
 3316e4d59f63aec67f5f1cfb5773a595 2009 net optional torsocks_2.0.0-1.dsc
 599de06e030e954f6d2e4c4a88d5d802 349795 net optional torsocks_2.0.0.orig.tar.bz2
 2c528b7a695977178ac7711a78c1f062 9452 net optional torsocks_2.0.0-1.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIcBAEBCgAGBQJT+lhiAAoJELrOFdKldJj/f24QANiPgFTpxgAdgOdKlTDSnFAv
XW2vJ5p5K+tO7eKTZSAFq8BqMwd/1e9c+LcEowYNvn/LxnaggXNdKt3HaOMA+RWb
kVI1UKZDsjLqM47ylWkAXJpANBPPZiUimK7qmC+6hNUB3jfO2F/96B5fUw9YiHD6
ZfticMFEO1tz9YTiTnlf2QkTB0WJHoch0X76nzd6phLlrUykZRg9dspvboYIWApR
SbmB+tvsUo+ge1/BROIWB4ucsR0kTgVR/ZqucBA2cCiVnnpmSmBeOWmojwDuSZdv
KkTS5dN75W6TdbLknxMSTYUa0GuEScOG1N83XHAeIi3Pb4xJorB22A0Ib1DZukZ+
5MJmUEf3y3DthTk6CGVtwqGyynxAlQA/1nDkrlxPWYeJq1uC8i69YeoIVRA9zRyB
Y8Pe4FFZg0vGiw1iFrdqAL9A/DaOzr32JbM119j5ZqFRAcN0JEQEHoOjEKslvFA1
2MRdNbobAS3y8mM8afAWDgur4qhGqiB/DYuZ6PDbRnzDvRAjpCAGxB13bLtt3t77
2oOv/0qmJr18w1Ze5INy3ve/Nzfr5MI6ttjefUCQTyIIBBv1Qdca+ABUGAhCMndK
jL8sqyHziEtH5kpa1OL1q9Q6nC5VSkbBDJqvFk+a/Bm4fbfcXgsZr8OcW6gv/eKA
nKSfMxCoMUSQsODPysaZ
=Ak2s
-----END PGP SIGNATURE-----

Message #34 received at 684580@bugs.debian.org (full text, mbox, reply):

From: JS <jshaio@yahoo.com>

To: "684580@bugs.debian.org" <684580@bugs.debian.org>

Subject: SIGSEGV in torsocks 2.0.0-1

Date: Sat, 30 Aug 2014 07:59:03 -0700

[Message part 1 (text/plain, inline)]

I've just upgrade torsocks from 1.3-3 to 2.0.0-1 and have found that it gets SIGSEGV now

when before it worked fine.


Below is the backtrace from gdb after running:

     . torsocks on

     midori                    # but happens with most other apps as well


I have used the exact config file as came with the new torsocks 2.0.0-1 package and restarted the tor daemon.

Perhaps this is a related problem to #684580?



Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0xb7fcd12b in tsocks_close () from /usr/lib/torsocks/libtorsocks.so
#2  0xb7fcd1d4 in close () from /usr/lib/torsocks/libtorsocks.so
#3  0xb46491a6 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
#4  0xb464973b in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
#5  0xb462c7c4 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
#6  0xb7fed86a in call_init (l=0xb46f15a0, argc=argc@entry=1, argv=argv@entry=0xbffff1f4, env=env@entry=0xbffff1fc) at dl-init.c:64
#7  0xb7fed9a4 in call_init (env=0xbffff1fc, argv=0xbffff1f4, argc=1, l=<optimized out>) at dl-init.c:36
#8  _dl_init (main_map=0xb7fff930, argc=1, argv=0xbffff1f4, env=0xbffff1fc) at dl-init.c:126
#9  0xb7fdfd3f in _dl_start_user () from /lib/ld-linux.so.2


~ => /bin/ls -lt /usr/lib/i386-linux-gnu/libGL.so.1 
lrwxrwxrwx 1 root root 48 Nov 22  2013 /usr/lib/i386-linux-gnu/libGL.so.1 -> /etc/alternatives/glx--libGL.so.1-i386-linux-gnu
~ => readlink -f /usr/lib/i386-linux-gnu/libGL.so.1 
/usr/lib/i386-linux-gnu/nvidia/current/libGL.so.340.24

torsocks:
Installed: 2.0.0-1
Candidate: 2.0.0-1
Version table:
*** 2.0.0-1 0
500 http://debian.lcs.mit.edu/debian/ testing/main i386 Packages
100 /var/lib/dpkg/status


2014-08-30 10:25:23 upgrade tor-geoipdb:all 0.2.4.22-1 0.2.4.23-1
2014-08-30 10:25:25 upgrade tor:i386 0.2.4.22-1 0.2.4.23-1
2014-08-30 10:25:28 upgrade torsocks:i386 1.3-3 2.0.0-1
2014-08-30 10:25:32 configure tor:i386 0.2.4.23-1 <none>
2014-08-30 10:25:34 configure tor-geoipdb:all 0.2.4.23-1 <none>
2014-08-30 10:25:34 configure torsocks:i386 2.0.0-1 <none>
2014-08-30 10:25:34 status installed tor-geoipdb:all 0.2.4.23-1
2014-08-30 10:25:34 status installed tor:i386 0.2.4.23-1
2014-08-30 10:25:35 status installed torsocks:i386 2.0.0-1


 
thanks,
--jack

[Message part 2 (text/html, inline)]

Message #39 received at 684580@bugs.debian.org (full text, mbox, reply):

From: intrigeri <intrigeri@debian.org>

To: JS <jshaio@yahoo.com>, David Goulet <dgoulet@ev0ke.net>

Cc: 684580@bugs.debian.org

Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

Date: Sat, 30 Aug 2014 13:18:33 -0700

Hi,

JS wrote (30 Aug 2014 14:59:03 GMT) :
> I've just upgrade torsocks from 1.3-3 to 2.0.0-1 and have found that
> it gets SIGSEGV now

> Below is the backtrace from gdb after running:
>      . torsocks on
>      midori                    # but happens with most other apps as well

I've seen a segfault once when running midori in that context (sid, amd64):

[Aug 30 13:12:26] ERROR torsocks[5021]: [recvmsg] Inet socket passing detected. Aborting everything! A non Tor socket could be used thus leaking information. (in tsocks_recvmsg() at recv.c:87)

... but I cannot reproduce it anymore.

> Perhaps this is a related problem to #684580?

I doubt it, as torsocks 2.x is a complete rewrite.
JS, may you please file a separate bug?

David, could you please have a look?

> Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".

> Program received signal SIGSEGV, Segmentation fault.
> 0x00000000 in ?? ()
> (gdb) bt
> #0  0x00000000 in ?? ()
> #1  0xb7fcd12b in tsocks_close () from /usr/lib/torsocks/libtorsocks.so
> #2  0xb7fcd1d4 in close () from /usr/lib/torsocks/libtorsocks.so
> #3  0xb46491a6 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> #4  0xb464973b in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> #5  0xb462c7c4 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> #6 0xb7fed86a in call_init (l=0xb46f15a0, argc=argc@entry=1,
> argv=argv@entry=0xbffff1f4, env=env@entry=0xbffff1fc) at dl-init.c:64
> #7  0xb7fed9a4 in call_init (env=0xbffff1fc, argv=0xbffff1f4, argc=1, l=<optimized out>) at dl-init.c:36
> #8  _dl_init (main_map=0xb7fff930, argc=1, argv=0xbffff1f4, env=0xbffff1fc) at dl-init.c:126
> #9  0xb7fdfd3f in _dl_start_user () from /lib/ld-linux.so.2


> ~ => /bin/ls -lt /usr/lib/i386-linux-gnu/libGL.so.1 
> lrwxrwxrwx 1 root root 48 Nov 22 2013 /usr/lib/i386-linux-gnu/libGL.so.1 ->
> /etc/alternatives/glx--libGL.so.1-i386-linux-gnu
> ~ => readlink -f /usr/lib/i386-linux-gnu/libGL.so.1 
> /usr/lib/i386-linux-gnu/nvidia/current/libGL.so.340.24

Cheers,
-- 
intrigeri

Message #44 received at 684580@bugs.debian.org (full text, mbox, reply):

From: David Goulet <dgoulet@ev0ke.net>

To: intrigeri <intrigeri@debian.org>

Cc: JS <jshaio@yahoo.com>, 684580@bugs.debian.org

Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

Date: Wed, 3 Sep 2014 09:10:05 -0400

[Message part 1 (text/plain, inline)]

On 30 Aug (13:18:33), intrigeri wrote:
> Hi,
> 
> JS wrote (30 Aug 2014 14:59:03 GMT) :
> > I've just upgrade torsocks from 1.3-3 to 2.0.0-1 and have found that
> > it gets SIGSEGV now
> 
> > Below is the backtrace from gdb after running:
> >      . torsocks on
> >      midori                    # but happens with most other apps as well
> 
> I've seen a segfault once when running midori in that context (sid, amd64):
> 
> [Aug 30 13:12:26] ERROR torsocks[5021]: [recvmsg] Inet socket passing detected. Aborting everything! A non Tor socket could be used thus leaking information. (in tsocks_recvmsg() at recv.c:87)

This implies that torsocks stopped the application completely. I was
able to reproduce that once with midori. This is normal behaviour for
now, since the application is about to receive a TCP socket from an
other process that is most probably NOT connected to the tor network, we
abort everything.

Maybe in the future we could simply deny the recvmsg() call and let the
application handle the error. That could be less "hammer-ish" :).

> 
> ... but I cannot reproduce it anymore.
> 
> > Perhaps this is a related problem to #684580?
> 
> I doubt it, as torsocks 2.x is a complete rewrite.
> JS, may you please file a separate bug?
> 
> David, could you please have a look?

I've played around with midori for 10 minutes and I got a lot of
segfaults from libgnutls, libc, libgtk and libsoup. None from
libtorsocks yet so I can't confirm the stacktrace below :S.

Cheers!
David

> 
> > Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
> 
> > Program received signal SIGSEGV, Segmentation fault.
> > 0x00000000 in ?? ()
> > (gdb) bt
> > #0  0x00000000 in ?? ()
> > #1  0xb7fcd12b in tsocks_close () from /usr/lib/torsocks/libtorsocks.so
> > #2  0xb7fcd1d4 in close () from /usr/lib/torsocks/libtorsocks.so
> > #3  0xb46491a6 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > #4  0xb464973b in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > #5  0xb462c7c4 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > #6 0xb7fed86a in call_init (l=0xb46f15a0, argc=argc@entry=1,
> > argv=argv@entry=0xbffff1f4, env=env@entry=0xbffff1fc) at dl-init.c:64
> > #7  0xb7fed9a4 in call_init (env=0xbffff1fc, argv=0xbffff1f4, argc=1, l=<optimized out>) at dl-init.c:36
> > #8  _dl_init (main_map=0xb7fff930, argc=1, argv=0xbffff1f4, env=0xbffff1fc) at dl-init.c:126
> > #9  0xb7fdfd3f in _dl_start_user () from /lib/ld-linux.so.2
> 
> 
> > ~ => /bin/ls -lt /usr/lib/i386-linux-gnu/libGL.so.1 
> > lrwxrwxrwx 1 root root 48 Nov 22 2013 /usr/lib/i386-linux-gnu/libGL.so.1 ->
> > /etc/alternatives/glx--libGL.so.1-i386-linux-gnu
> > ~ => readlink -f /usr/lib/i386-linux-gnu/libGL.so.1 
> > /usr/lib/i386-linux-gnu/nvidia/current/libGL.so.340.24
> 
> Cheers,
> -- 
> intrigeri

[signature.asc (application/pgp-signature, inline)]

Message #49 received at 684580@bugs.debian.org (full text, mbox, reply):

From: JS <jshaio@yahoo.com>

To: David Goulet <dgoulet@ev0ke.net>, intrigeri <intrigeri@debian.org>

Cc: "684580@bugs.debian.org" <684580@bugs.debian.org>

Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

Date: Wed, 3 Sep 2014 07:09:53 -0700

David,

Thanks for looking at this.


I've never had a problem running midori with torsocks 1.3, so these segmentation faults are new with 2.0.0.
After reverting to 1.3, midori and iceweasel work correctly with torsocks.

Is it possible the problem is related to my version of libc6:
    Versions of packages torsocks depends on:
    ii  libc6  2.19-1

while the newest version is libc6 2.19-9 in jessie?

thanks,
--jack


----- Original Message -----
From: David Goulet <dgoulet@ev0ke.net>
To: intrigeri <intrigeri@debian.org>
Cc: JS <jshaio@yahoo.com>; 684580@bugs.debian.org
Sent: Wednesday, September 3, 2014 9:10 AM
Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

On 30 Aug (13:18:33), intrigeri wrote:
> Hi,
> 
> JS wrote (30 Aug 2014 14:59:03 GMT) :
> > I've just upgrade torsocks from 1.3-3 to 2.0.0-1 and have found that
> > it gets SIGSEGV now
> 
> > Below is the backtrace from gdb after running:
> >      . torsocks on
> >      midori                    # but happens with most other apps as well
> 
> I've seen a segfault once when running midori in that context (sid, amd64):
> 
> [Aug 30 13:12:26] ERROR torsocks[5021]: [recvmsg] Inet socket passing detected. Aborting everything! A non Tor socket could be used thus leaking information. (in tsocks_recvmsg() at recv.c:87)

This implies that torsocks stopped the application completely. I was
able to reproduce that once with midori. This is normal behaviour for
now, since the application is about to receive a TCP socket from an
other process that is most probably NOT connected to the tor network, we
abort everything.

Maybe in the future we could simply deny the recvmsg() call and let the
application handle the error. That could be less "hammer-ish" :).

> 
> ... but I cannot reproduce it anymore.
> 
> > Perhaps this is a related problem to #684580?
> 
> I doubt it, as torsocks 2.x is a complete rewrite.
> JS, may you please file a separate bug?
> 
> David, could you please have a look?

I've played around with midori for 10 minutes and I got a lot of
segfaults from libgnutls, libc, libgtk and libsoup. None from
libtorsocks yet so I can't confirm the stacktrace below :S.

Cheers!



David

> 
> > Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
> 
> > Program received signal SIGSEGV, Segmentation fault.
> > 0x00000000 in ?? ()
> > (gdb) bt
> > #0  0x00000000 in ?? ()
> > #1  0xb7fcd12b in tsocks_close () from /usr/lib/torsocks/libtorsocks.so
> > #2  0xb7fcd1d4 in close () from /usr/lib/torsocks/libtorsocks.so
> > #3  0xb46491a6 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > #4  0xb464973b in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > #5  0xb462c7c4 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > #6 0xb7fed86a in call_init (l=0xb46f15a0, argc=argc@entry=1,
> > argv=argv@entry=0xbffff1f4, env=env@entry=0xbffff1fc) at dl-init.c:64
> > #7  0xb7fed9a4 in call_init (env=0xbffff1fc, argv=0xbffff1f4, argc=1, l=<optimized out>) at dl-init.c:36
> > #8  _dl_init (main_map=0xb7fff930, argc=1, argv=0xbffff1f4, env=0xbffff1fc) at dl-init.c:126
> > #9  0xb7fdfd3f in _dl_start_user () from /lib/ld-linux.so.2
> 
> 
> > ~ => /bin/ls -lt /usr/lib/i386-linux-gnu/libGL.so.1 
> > lrwxrwxrwx 1 root root 48 Nov 22 2013 /usr/lib/i386-linux-gnu/libGL.so.1 ->
> > /etc/alternatives/glx--libGL.so.1-i386-linux-gnu
> > ~ => readlink -f /usr/lib/i386-linux-gnu/libGL.so.1 
> > /usr/lib/i386-linux-gnu/nvidia/current/libGL.so.340.24
> 
> Cheers,
> -- 
> intrigeri

Message #54 received at 684580@bugs.debian.org (full text, mbox, reply):

From: David Goulet <dgoulet@ev0ke.net>

To: JS <jshaio@yahoo.com>

Cc: intrigeri <intrigeri@debian.org>, "684580@bugs.debian.org" <684580@bugs.debian.org>

Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

Date: Wed, 3 Sep 2014 10:12:00 -0400

[Message part 1 (text/plain, inline)]

On 03 Sep (07:09:53), JS wrote:
> David,
> 
> Thanks for looking at this.
> 
> 
> I've never had a problem running midori with torsocks 1.3, so these segmentation faults are new with 2.0.0.
> After reverting to 1.3, midori and iceweasel work correctly with torsocks.
> 
> Is it possible the problem is related to my version of libc6:
>     Versions of packages torsocks depends on:
>     ii  libc6  2.19-1
> 
> while the newest version is libc6 2.19-9 in jessie?

It's possible but the stacktrace you provided clearly shows torsocks as
the issue so I'm still puzzled.

Is it possible you can provide the full backtrace of the coredump?

Use "bt full" which will help me spot the callsite that segfaults in
tsocks_close().

> 
> thanks,
> --jack
> 
> 
> ----- Original Message -----
> From: David Goulet <dgoulet@ev0ke.net>
> To: intrigeri <intrigeri@debian.org>
> Cc: JS <jshaio@yahoo.com>; 684580@bugs.debian.org
> Sent: Wednesday, September 3, 2014 9:10 AM
> Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1
> 
> On 30 Aug (13:18:33), intrigeri wrote:
> > Hi,
> > 
> > JS wrote (30 Aug 2014 14:59:03 GMT) :
> > > I've just upgrade torsocks from 1.3-3 to 2.0.0-1 and have found that
> > > it gets SIGSEGV now
> > 
> > > Below is the backtrace from gdb after running:
> > >      . torsocks on
> > >      midori                    # but happens with most other apps as well
> > 
> > I've seen a segfault once when running midori in that context (sid, amd64):
> > 
> > [Aug 30 13:12:26] ERROR torsocks[5021]: [recvmsg] Inet socket passing detected. Aborting everything! A non Tor socket could be used thus leaking information. (in tsocks_recvmsg() at recv.c:87)
> 
> This implies that torsocks stopped the application completely. I was
> able to reproduce that once with midori. This is normal behaviour for
> now, since the application is about to receive a TCP socket from an
> other process that is most probably NOT connected to the tor network, we
> abort everything.
> 
> Maybe in the future we could simply deny the recvmsg() call and let the
> application handle the error. That could be less "hammer-ish" :).
> 
> > 
> > ... but I cannot reproduce it anymore.
> > 
> > > Perhaps this is a related problem to #684580?
> > 
> > I doubt it, as torsocks 2.x is a complete rewrite.
> > JS, may you please file a separate bug?
> > 
> > David, could you please have a look?
> 
> I've played around with midori for 10 minutes and I got a lot of
> segfaults from libgnutls, libc, libgtk and libsoup. None from
> libtorsocks yet so I can't confirm the stacktrace below :S.
> 
> Cheers!
> 
> 
> 
> David
> 
> > 
> > > Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
> > 
> > > Program received signal SIGSEGV, Segmentation fault.
> > > 0x00000000 in ?? ()
> > > (gdb) bt
> > > #0  0x00000000 in ?? ()
> > > #1  0xb7fcd12b in tsocks_close () from /usr/lib/torsocks/libtorsocks.so
> > > #2  0xb7fcd1d4 in close () from /usr/lib/torsocks/libtorsocks.so
> > > #3  0xb46491a6 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > > #4  0xb464973b in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > > #5  0xb462c7c4 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > > #6 0xb7fed86a in call_init (l=0xb46f15a0, argc=argc@entry=1,
> > > argv=argv@entry=0xbffff1f4, env=env@entry=0xbffff1fc) at dl-init.c:64
> > > #7  0xb7fed9a4 in call_init (env=0xbffff1fc, argv=0xbffff1f4, argc=1, l=<optimized out>) at dl-init.c:36
> > > #8  _dl_init (main_map=0xb7fff930, argc=1, argv=0xbffff1f4, env=0xbffff1fc) at dl-init.c:126
> > > #9  0xb7fdfd3f in _dl_start_user () from /lib/ld-linux.so.2
> > 
> > 
> > > ~ => /bin/ls -lt /usr/lib/i386-linux-gnu/libGL.so.1 
> > > lrwxrwxrwx 1 root root 48 Nov 22 2013 /usr/lib/i386-linux-gnu/libGL.so.1 ->
> > > /etc/alternatives/glx--libGL.so.1-i386-linux-gnu
> > > ~ => readlink -f /usr/lib/i386-linux-gnu/libGL.so.1 
> > > /usr/lib/i386-linux-gnu/nvidia/current/libGL.so.340.24
> > 
> > Cheers,
> > -- 
> > intrigeri

[signature.asc (application/pgp-signature, inline)]

Message #59 received at 684580@bugs.debian.org (full text, mbox, reply):

From: JS <jshaio@yahoo.com>

To: David Goulet <dgoulet@ev0ke.net>

Cc: intrigeri <intrigeri@debian.org>, "684580@bugs.debian.org" <684580@bugs.debian.org>

Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

Date: Wed, 3 Sep 2014 08:17:26 -0700

[Message part 1 (text/plain, inline)]

David,

I've attached text files with the bt full for midori and chromium.

 
thanks,
--jack


----- Original Message -----
From: David Goulet <dgoulet@ev0ke.net>
To: JS <jshaio@yahoo.com>
Cc: intrigeri <intrigeri@debian.org>; "684580@bugs.debian.org" <684580@bugs.debian.org>
Sent: Wednesday, September 3, 2014 10:12 AM
Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

On 03 Sep (07:09:53), JS wrote:
> David,
> 
> Thanks for looking at this.
> 
> 
> I've never had a problem running midori with torsocks 1.3, so these segmentation faults are new with 2.0.0.
> After reverting to 1.3, midori and iceweasel work correctly with torsocks.
> 
> Is it possible the problem is related to my version of libc6:
>     Versions of packages torsocks depends on:
>     ii  libc6  2.19-1
> 
> while the newest version is libc6 2.19-9 in jessie?

It's possible but the stacktrace you provided clearly shows torsocks as
the issue so I'm still puzzled.

Is it possible you can provide the full backtrace of the coredump?

Use "bt full" which will help me spot the callsite that segfaults in
tsocks_close().




> 
> thanks,
> --jack
> 
> 
> ----- Original Message -----
> From: David Goulet <dgoulet@ev0ke.net>
> To: intrigeri <intrigeri@debian.org>
> Cc: JS <jshaio@yahoo.com>; 684580@bugs.debian.org
> Sent: Wednesday, September 3, 2014 9:10 AM
> Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1
> 
> On 30 Aug (13:18:33), intrigeri wrote:
> > Hi,
> > 
> > JS wrote (30 Aug 2014 14:59:03 GMT) :
> > > I've just upgrade torsocks from 1.3-3 to 2.0.0-1 and have found that
> > > it gets SIGSEGV now
> > 
> > > Below is the backtrace from gdb after running:
> > >      . torsocks on
> > >      midori                    # but happens with most other apps as well
> > 
> > I've seen a segfault once when running midori in that context (sid, amd64):
> > 
> > [Aug 30 13:12:26] ERROR torsocks[5021]: [recvmsg] Inet socket passing detected. Aborting everything! A non Tor socket could be used thus leaking information. (in tsocks_recvmsg() at recv.c:87)
> 
> This implies that torsocks stopped the application completely. I was
> able to reproduce that once with midori. This is normal behaviour for
> now, since the application is about to receive a TCP socket from an
> other process that is most probably NOT connected to the tor network, we
> abort everything.
> 
> Maybe in the future we could simply deny the recvmsg() call and let the
> application handle the error. That could be less "hammer-ish" :).
> 
> > 
> > ... but I cannot reproduce it anymore.
> > 
> > > Perhaps this is a related problem to #684580?
> > 
> > I doubt it, as torsocks 2.x is a complete rewrite.
> > JS, may you please file a separate bug?
> > 
> > David, could you please have a look?
> 
> I've played around with midori for 10 minutes and I got a lot of
> segfaults from libgnutls, libc, libgtk and libsoup. None from
> libtorsocks yet so I can't confirm the stacktrace below :S.
> 
> Cheers!
> 
> 
> 
> David
> 
> > 
> > > Using host libthread_db library "/lib/i386-linux-gnu/i686/cmov/libthread_db.so.1".
> > 
> > > Program received signal SIGSEGV, Segmentation fault.
> > > 0x00000000 in ?? ()
> > > (gdb) bt
> > > #0  0x00000000 in ?? ()
> > > #1  0xb7fcd12b in tsocks_close () from /usr/lib/torsocks/libtorsocks.so
> > > #2  0xb7fcd1d4 in close () from /usr/lib/torsocks/libtorsocks.so
> > > #3  0xb46491a6 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > > #4  0xb464973b in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > > #5  0xb462c7c4 in ?? () from /usr/lib/i386-linux-gnu/libGL.so.1
> > > #6 0xb7fed86a in call_init (l=0xb46f15a0, argc=argc@entry=1,
> > > argv=argv@entry=0xbffff1f4, env=env@entry=0xbffff1fc) at dl-init.c:64
> > > #7  0xb7fed9a4 in call_init (env=0xbffff1fc, argv=0xbffff1f4, argc=1, l=<optimized out>) at dl-init.c:36
> > > #8  _dl_init (main_map=0xb7fff930, argc=1, argv=0xbffff1f4, env=0xbffff1fc) at dl-init.c:126
> > > #9  0xb7fdfd3f in _dl_start_user () from /lib/ld-linux.so.2
> > 
> > 
> > > ~ => /bin/ls -lt /usr/lib/i386-linux-gnu/libGL.so.1 
> > > lrwxrwxrwx 1 root root 48 Nov 22 2013 /usr/lib/i386-linux-gnu/libGL.so.1 ->
> > > /etc/alternatives/glx--libGL.so.1-i386-linux-gnu
> > > ~ => readlink -f /usr/lib/i386-linux-gnu/libGL.so.1 
> > > /usr/lib/i386-linux-gnu/nvidia/current/libGL.so.340.24
> > 
> > Cheers,
> > -- 
> > intrigeri

[bt-full-midori.txt (text/plain, attachment)]

[bt-full-chromium.txt (text/plain, attachment)]

Message #64 received at 684580@bugs.debian.org (full text, mbox, reply):

From: David Goulet <dgoulet@ev0ke.net>

To: JS <jshaio@yahoo.com>

Cc: intrigeri <intrigeri@debian.org>, "684580@bugs.debian.org" <684580@bugs.debian.org>

Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

Date: Wed, 10 Sep 2014 11:33:23 -0400

[Message part 1 (text/plain, inline)]

On 03 Sep (08:17:26), JS wrote:
> I've attached text files with the bt full for midori and chromium.
> 

Hrm, unfortunately I can't get the exact call site since you are using I
suppose the package which does not provide debug symbol.

However, I think I understand what's going on here. In a nutshell, the
symbols that the preloaded library (libtorsocks.so) hijacks are
resolved. After that, the libc calls all library constructors in a
"unkwnown-unspecified" order where libGL.so ends up calling close() that
is resovled to tsocks_close() but segfaults when calling the original
libc close symbol because torsocks constructor has not yet been called
to it couldn't get the libc close() symbol

This is a very difficult issue with dlopen() in constructor since the
libc does not guarantees on constructor call ordering...

There are solutions to that issue, I need to investiguate more and do
some testing. I will open a bug on the upstream tracker because this is
not a Debian specific issue.

Thanks!
David

[signature.asc (application/pgp-signature, inline)]

Message #71 received at 684580@bugs.debian.org (full text, mbox, reply):

From: intrigeri <intrigeri@debian.org>

To: 684580@bugs.debian.org, 761120@bugs.debian.org

Cc: JS <jshaio@yahoo.com>, David Goulet <dgoulet@ev0ke.net>

Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

Date: Wed, 10 Sep 2014 13:58:27 -0700

Hi,

intrigeri wrote (30 Aug 2014 20:18:33 GMT) :
> JS, may you please file a separate bug?

I have done it myself, eventually: #761120. Please keep further
discussion on that new bug, instead of the old #684580 one, that was
fixed in torsocks 2.0. Thanks!

Cheers,
--
intrigeri

Message #76 received at 684580@bugs.debian.org (full text, mbox, reply):

From: JS <jshaio@yahoo.com>

To: intrigeri <intrigeri@debian.org>, "684580@bugs.debian.org" <684580@bugs.debian.org>, "761120@bugs.debian.org" <761120@bugs.debian.org>, "760075@bugs.debian.org" <760075@bugs.debian.org>

Cc: David Goulet <dgoulet@ev0ke.net>

Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

Date: Wed, 10 Sep 2014 17:35:52 -0700

I apologize: I opened the new bug as requested in https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=760075
but seemed to have responded only to the original emails.


 
thanks,
--jack


----- Original Message -----
From: intrigeri <intrigeri@debian.org>
To: 684580@bugs.debian.org; 761120@bugs.debian.org
Cc: JS <jshaio@yahoo.com>; David Goulet <dgoulet@ev0ke.net>
Sent: Wednesday, September 10, 2014 4:58 PM
Subject: Re: Bug#684580: SIGSEGV in torsocks 2.0.0-1

Hi,

intrigeri wrote (30 Aug 2014 20:18:33 GMT) :
> JS, may you please file a separate bug?

I have done it myself, eventually: #761120. Please keep further
discussion on that new bug, instead of the old #684580 one, that was
fixed in torsocks 2.0. Thanks!




Cheers,
--
intrigeri

Send a report that this bug log contains spam.