Debian Bug report logs - #811087
qemu-user: aptitude segfaults in qemu-user environments

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: qemu-user-static: qemu-arm-static segfaults in armhf chroot on 'aptitude -u'

Date: Fri, 15 Jan 2016 15:55:52 +0100

Package: qemu-user-static
Version: 1:2.5+dfsg-3
Severity: normal

Hi,

I use qemu-arm-static in an sid/armhf pbuilder chroot on a amd64 host.
It reproducably segfaults upon aptitude -u (and also on pbuilders call
to aptitude to install some build dependencies, but aptitude -u is an
easier reproducer).

I also tried the qemu-user-static binaries from 2.4.0 and 2.1.2, all
with the same problem.

Please let me know if there is a way I can help you debugging this
issue.


Andreas

Message #10 received at 811087@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: Andreas Beckmann <anbe@debian.org>, 811087@bugs.debian.org

Subject: Re: Bug#811087: qemu-user-static: qemu-arm-static segfaults in armhf chroot on 'aptitude -u'

Date: Sat, 30 Jan 2016 13:35:01 +0300

Control: tag -1 + upstream confirmed

15.01.2016 17:55, Andreas Beckmann wrote:
> Package: qemu-user-static
> Version: 1:2.5+dfsg-3
> Severity: normal
> 
> Hi,
> 
> I use qemu-arm-static in an sid/armhf pbuilder chroot on a amd64 host.
> It reproducably segfaults upon aptitude -u (and also on pbuilders call
> to aptitude to install some build dependencies, but aptitude -u is an
> easier reproducer).

Indeed, aptitude segfaults in a 100% reliable way :)

But.. um. This smells like multithreading issue again (qemu-user
does not support it properly).  Even single-threaded apps nowadays
use threading primitives and sometimes fail.

I'll try to dig deeper, but unfortunately I don't know much about
linux-user qemu emulation.

Thanks,

/mjt

Message #43 received at 811087-done@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: 811087-done@bugs.debian.org

Subject: Re: Bug#811087: qemu-user-static: qemu-arm-static segfaults in armhf chroot on 'aptitude -u'

Date: Sun, 26 Jul 2020 17:49:21 +0300

Version: 1:5.0-1

On Fri, 15 Jan 2016 15:55:52 +0100 Andreas Beckmann <anbe@debian.org> wrote:
> Package: qemu-user-static
> Version: 1:2.5+dfsg-3
> Severity: normal
> 
> Hi,
> 
> I use qemu-arm-static in an sid/armhf pbuilder chroot on a amd64 host.
> It reproducably segfaults upon aptitude -u (and also on pbuilders call
> to aptitude to install some build dependencies, but aptitude -u is an
> easier reproducer).

This has been fixed in qemu 5.0 (maybe earlier, but 5.0 definitely works).
The buster version (3.1) does not work still.

Thanks,

/mjt

Message #52 received at 811087@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>

To: 811087@bugs.debian.org

Subject: Re: Bug#811087 closed by Michael Tokarev <mjt@tls.msk.ru> (Re: Bug#811087: qemu-user-static: qemu-arm-static segfaults in armhf chroot on 'aptitude -u')

Date: Sun, 26 Jul 2020 22:19:37 +0200

Control: reopen -1
Control: found -1 1:5.0-13

On 7/26/20 4:51 PM, Debian Bug Tracking System wrote:
> This has been fixed in qemu 5.0 (maybe earlier, but 5.0 definitely works).
> The buster version (3.1) does not work still.

Unfortunately, I can still reproduce it with the current version from
sid (on an amd64 buster/bullseye mixed host) in all three qemu pbuilder
chroots I use: armhf, arm64, ppc64el.

Andreas

Message #63 received at 811087@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: Andreas Beckmann <anbe@debian.org>, 811087@bugs.debian.org

Subject: Re: Bug#811087: closed by Michael Tokarev <mjt@tls.msk.ru> (Re: Bug#811087: qemu-user-static: qemu-arm-static segfaults in armhf chroot on 'aptitude -u')

Date: Sun, 14 Feb 2021 18:46:30 +0300

Control: tag -1 + moreinfo - confirmed

26.07.2020 23:19, Andreas Beckmann wrote:
> Control: reopen -1
> Control: found -1 1:5.0-13
> 
> On 7/26/20 4:51 PM, Debian Bug Tracking System wrote:
>> This has been fixed in qemu 5.0 (maybe earlier, but 5.0 definitely works).
>> The buster version (3.1) does not work still.
> 
> Unfortunately, I can still reproduce it with the current version from
> sid (on an amd64 buster/bullseye mixed host) in all three qemu pbuilder
> chroots I use: armhf, arm64, ppc64el.

Andreas, what are you aptituding? Maybe this is something specific to
what you actually install?

Before I was able to hit this issue with almost any invocation of aptitude.
But in 5.0 or current 5.2 I can't reproduce this issue anymore, now matter
how I try.

Thanks,

/mjt

Message #72 received at 811087@bugs.debian.org (full text, mbox, reply):

From: Andreas Beckmann <anbe@debian.org>

To: Michael Tokarev <mjt@tls.msk.ru>, 811087@bugs.debian.org

Subject: Re: Bug#811087: closed by Michael Tokarev <mjt@tls.msk.ru> (Re: Bug#811087: qemu-user-static: qemu-arm-static segfaults in armhf chroot on 'aptitude -u')

Date: Sun, 14 Feb 2021 21:29:20 +0100

Version: 1:5.2+dfsg-3~bpo10+1

On 2/14/21 4:46 PM, Michael Tokarev wrote:
> Before I was able to hit this issue with almost any invocation of aptitude.
> But in 5.0 or current 5.2 I can't reproduce this issue anymore, now matter
> how I try.

a simple 'aptitude -u' does the job for me :-(

The core file I get inside the chroot is actually from the qemu binary on the host,
perhaps this backtrace helps:

Reading symbols from /usr/bin/qemu-aarch64-static...Reading symbols from /usr/lib/debug/.build-id/30/efd3930fb9519b21470b113679376f2ffbb41a.debug...done.
done.

warning: core file may not match specified executable file.
[New LWP 23784]
[New LWP 23772]
[New LWP 23774]
[New LWP 23777]
[New LWP 23776]
[New LWP 23775]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/bin/qemu-aarch64-static /usr/bin/aptitude -u'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x000000000059a1eb in getgroups (__list=0x7f867be79cc0, __size=65536) at /usr/include/x86_64-linux-gnu/bits/unistd.h:275

warning: Source file is more recent than executable.
275       return __getgroups_alias (__size, __list);
[Current thread is 1 (Thread 0x7f867bebb700 (LWP 23784))]
(gdb) bt
#0  0x000000000059a1eb in getgroups (__list=0x7f867be79cc0, __size=65536) at /usr/include/x86_64-linux-gnu/bits/unistd.h:275
#1  do_syscall1 (cpu_env=cpu_env@entry=0x1c8d540, num=num@entry=158, arg1=arg1@entry=65536, arg2=arg2@entry=365688737808, arg3=arg3@entry=365112983552, arg4=arg4@entry=0, arg5=-1, arg6=0, arg8=0, arg7=0) at ../../linux-user/syscall.c:11262
#2  0x00000000005a4c73 in do_syscall (cpu_env=cpu_env@entry=0x1c8d540, num=158, arg1=65536, arg2=365688737808, arg3=365112983552, arg4=0, arg5=-1, arg6=0, arg7=0, arg8=0) at ../../linux-user/syscall.c:13104
#3  0x0000000000421f98 in cpu_loop (env=env@entry=0x1c8d540) at ../../linux-user/aarch64/cpu_loop.c:90
#4  0x0000000000590073 in clone_func (arg=0x7ffee38be2b0) at ../../linux-user/syscall.c:6372
#5  0x0000000000728cb7 in start_thread (arg=<optimized out>) at pthread_create.c:477
#6  0x00000000007aad0f in clone ()
(gdb) info threads
  Id   Target Id                         Frame
* 1    Thread 0x7f867bebb700 (LWP 23784) 0x000000000059a1eb in getgroups (__list=0x7f867be79cc0, __size=65536) at /usr/include/x86_64-linux-gnu/bits/unistd.h:275
  2    Thread 0x19c63c0 (LWP 23772)      tc_ptr_to_region_tree (p=0x7f867c6c3240 <code_gen_buffer+7619091>) at ../../tcg/tcg.c:418
  3    Thread 0x7f8688812700 (LWP 23774) 0x00000000007a9429 in syscall ()
  4    Thread 0x7f867befc700 (LWP 23777) safe_syscall_base () at ../../linux-user/host/x86_64/safe-syscall.inc.S:75
  5    Thread 0x7f867bf3d700 (LWP 23776) safe_syscall_base () at ../../linux-user/host/x86_64/safe-syscall.inc.S:75
  6    Thread 0x7f867bf7e700 (LWP 23775) safe_syscall_base () at ../../linux-user/host/x86_64/safe-syscall.inc.S:75

Message #77 received at 811087@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: 811087@bugs.debian.org

Subject: Re: Bug#811087: closed by Michael Tokarev <mjt@tls.msk.ru> (Re: Bug#811087: qemu-user-static: qemu-arm-static segfaults in armhf chroot on 'aptitude -u')

Date: Fri, 16 Dec 2022 13:41:19 +0300

Control: tag -1 - moreinfo
Control: found -1 1:7.2+dfsg-1

On Sun, 14 Feb 2021 21:29:20 +0100 Andreas Beckmann <anbe@debian.org> wrote:
> Version: 1:5.2+dfsg-3~bpo10+1
> 
> On 2/14/21 4:46 PM, Michael Tokarev wrote:
> > Before I was able to hit this issue with almost any invocation of aptitude.
> > But in 5.0 or current 5.2 I can't reproduce this issue anymore, now matter
> > how I try.
> 
> a simple 'aptitude -u' does the job for me :-(

This is still happening with current sid and qemu 7.2.  That's fantastic!.. :)

> The core file I get inside the chroot is actually from the qemu binary on the host,
> perhaps this backtrace helps:

How does one gets the core inside a ch

/mjt

Message #86 received at 811087@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: 811087@bugs.debian.org

Subject: Re: Bug#811087: qemu-user-static: qemu-arm-static segfaults in armhf chroot on 'aptitude -u'

Date: Fri, 16 Dec 2022 16:51:58 +0300

On Sun, 14 Feb 2021 21:29:20 +0100 Andreas Beckmann <anbe@debian.org> wrote:
> Version: 1:5.2+dfsg-3~bpo10+1
> 
> On 2/14/21 4:46 PM, Michael Tokarev wrote:
> > Before I was able to hit this issue with almost any invocation of aptitude.
> > But in 5.0 or current 5.2 I can't reproduce this issue anymore, now matter
> > how I try.
> 
> a simple 'aptitude -u' does the job for me :-(
> 
> The core file I get inside the chroot is actually from the qemu binary on the host,
> perhaps this backtrace helps:
> 
> Reading symbols from /usr/bin/qemu-aarch64-static...Reading symbols from /usr/lib/debug/.build-id/30/efd3930fb9519b21470b113679376f2ffbb41a.debug...done.
> done.
> 
> warning: core file may not match specified executable file.
> [New LWP 23784]
> [New LWP 23772]
> [New LWP 23774]
> [New LWP 23777]
> [New LWP 23776]
> [New LWP 23775]
> [Thread debugging using libthread_db enabled]
> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
> Core was generated by `/usr/bin/qemu-aarch64-static /usr/bin/aptitude -u'.
> Program terminated with signal SIGSEGV, Segmentation fault.
> #0  0x000000000059a1eb in getgroups (__list=0x7f867be79cc0, __size=65536) at /usr/include/x86_64-linux-gnu/bits/unistd.h:275

This comes from the following code, linux-user/syscall.c:11757 in qemu version 7.2:

    case TARGET_NR_getgroups32:
        {
            int gidsetsize = arg1;
            uint32_t *target_grouplist;
            gid_t *grouplist;
            int i;

            grouplist = alloca(gidsetsize * sizeof(gid_t));
11757       ret = get_errno(getgroups(gidsetsize, grouplist));

gidsetsize as coming from aptitude is 65536. Grouplist is allocated on the stack...

/mjt

Message #91 received at 811087@bugs.debian.org (full text, mbox, reply):

From: Michael Tokarev <mjt@tls.msk.ru>

To: 811087@bugs.debian.org

Subject: Re: Bug#811087: qemu-user-static: qemu-arm-static segfaults in armhf chroot on 'aptitude -u'

Date: Fri, 16 Dec 2022 18:36:47 +0300

Control: tag -1 + confirmed upstream patch
Control: forwarded -1 https://lore.kernel.org/qemu-devel/20221216152006.2838195-1-mjt@msgid.tls.msk.ru/T

Just sent a patch fixing this issue to the qemu list.

/mjt

Message #100 received at 811087-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 811087-close@bugs.debian.org

Subject: Bug#811087: fixed in qemu 1:8.0~rc3+dfsg-2

Date: Mon, 10 Apr 2023 09:56:28 +0000

Source: qemu
Source-Version: 1:8.0~rc3+dfsg-2
Done: Michael Tokarev <mjt@tls.msk.ru>

We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 811087@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Mon, 10 Apr 2023 12:33:01 +0300
Source: qemu
Architecture: source
Version: 1:8.0~rc3+dfsg-2
Distribution: experimental
Urgency: medium
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Closes: 811087
Changes:
 qemu (1:8.0~rc3+dfsg-2) experimental; urgency=medium
 .
   * d/rules: fix qemu.svg install and remove .png fallback icons again
     (qemu window still doesn't have an icon)
   * d/binfmt-install: fix systemd binfmt registration broken
     since previous upload
   * +linux-user-fix-getgroups-setgroups-allocations.patch (Closes: #811087)
Checksums-Sha1:
 e075f547371f126ec6e5658ab800e1712279c795 6515 qemu_8.0~rc3+dfsg-2.dsc
 200e1e02667ca27dcaa33cd2f52fd301899a1255 99940 qemu_8.0~rc3+dfsg-2.debian.tar.xz
 ed3eb035de77a69291fec75521dddd3889c9dce3 10978 qemu_8.0~rc3+dfsg-2_source.buildinfo
Checksums-Sha256:
 fccc69450c1c1b16e34f53415b4e5e67f8f1ae95ce91eb15156fb09630469542 6515 qemu_8.0~rc3+dfsg-2.dsc
 21a65aef3ca896592d3f74219f6038494280fcddb7248ebf19e24f0ada259650 99940 qemu_8.0~rc3+dfsg-2.debian.tar.xz
 409dc0e4b353322826abcc9e06f0ac69d97e56b73385d7291b763401dc8fa224 10978 qemu_8.0~rc3+dfsg-2_source.buildinfo
Files:
 b2f21913bb3060e3f196d3cba6ad6479 6515 otherosfs optional qemu_8.0~rc3+dfsg-2.dsc
 5c8f3a7a92ff8b18da0d47548407846a 99940 otherosfs optional qemu_8.0~rc3+dfsg-2.debian.tar.xz
 146da48537372f97190b05b88d5849c9 10978 otherosfs optional qemu_8.0~rc3+dfsg-2_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQFDBAEBCgAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmQz2AsPHG1qdEB0bHMu
bXNrLnJ1AAoJEHAbT2saaT5ZBTIH/RGbqg4LYNM9bzRr6Y3ryWUc1igQba8Yu+oP
G3DbnaK7ZO/Q6ETm1EQDixsiyj7PRDA4Yyq7Q1izAnantRpy5bbeqO5BRKEvU5m3
VGxz2eCOUaHfwm0ehCfdmO0jnDTARw0b2jO8oOTkbx7L55Ar5nFe6h/JD1rtPK2D
5D6tZyKfltZZEad1oavCuS0fD8vhv71YmtZ882qd64lXiQAiOiSSLypsdFkA9JLS
6jt4Jyyiq5UUnao9jB/SwO6T26G8Q6jQN7AIvOVxMhnfVaPj9QHAp/yVdKqN/i9u
ZEZ6WeWlStlcr9PPFku4Zjtp80uW0hWQJr2TeTVKpVai+fzcVvo=
=tgai
-----END PGP SIGNATURE-----

Message #109 received at 811087-close@bugs.debian.org (full text, mbox, reply):

From: Debian FTP Masters <ftpmaster@ftp-master.debian.org>

To: 811087-close@bugs.debian.org

Subject: Bug#811087: fixed in qemu 1:7.2+dfsg-6

Date: Sat, 29 Apr 2023 11:21:19 +0000

Source: qemu
Source-Version: 1:7.2+dfsg-6
Done: Michael Tokarev <mjt@tls.msk.ru>

We believe that the bug you reported is fixed in the latest version of
qemu, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 811087@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Michael Tokarev <mjt@tls.msk.ru> (supplier of updated qemu package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 29 Apr 2023 13:02:55 +0300
Source: qemu
Architecture: source
Version: 1:7.2+dfsg-6
Distribution: unstable
Urgency: medium
Maintainer: Debian QEMU Team <pkg-qemu-devel@lists.alioth.debian.org>
Changed-By: Michael Tokarev <mjt@tls.msk.ru>
Closes: 811087 1034431
Changes:
 qemu (1:7.2+dfsg-6) unstable; urgency=medium
 .
   [ Michael Tokarev ]
   * sync with upstream v7.2.1 stable release, into d/patches/v7.2.1.diff.
     All patches from 7.2.1 (besides stuff not relevant for linux, such
     as mingw compilation fixes) has already been in d/patches/master/,
     now they're in single upstream patch file
   * v7.2.2.diff: upstream 7.2.2 stable/bugfix release
   * hw-pvrdma-protect-against-guest-driver-CVE-2022-1050.patch:
     remove, included in v7.2.2
   * d/rules, d/qemu.desktop: provide an icon for gtk display (qemu.display)
   * d/gbp.conf: set debian branch to debian-bookworm
   * pick 3 more fixes from qemu-devel@:
     rtl8139-fix-large_send_mss-divide-by-zero.patch
     target_i386-Change-wrong-XFRM-value.patch
     hw_mips_malta-Fix-malta-machine-on-big-endian-hosts.patch
   * +linux-user-fix-getgroups-setgroups-allocations.patch (Closes: #811087)
 .
   [ Vagrant Cascadian ]
   * debian/rules: Use 'printf' instead of 'echo' to avoid differences
     in underlying /bin/sh implementations. Closes: #1034431
Checksums-Sha1:
 c2cb1e159ef7719fe59daa205630cc4cf2c78f1b 6450 qemu_7.2+dfsg-6.dsc
 5dba953198cc768762319cef52a86905465a40d5 125508 qemu_7.2+dfsg-6.debian.tar.xz
 6e0ce392a5d222b08e7163a773deab856b69683b 11322 qemu_7.2+dfsg-6_source.buildinfo
Checksums-Sha256:
 d8bb951d13f790e3e24730741bb58829f606207a047cd1dedbbc96ced735898d 6450 qemu_7.2+dfsg-6.dsc
 fdaedf711f1c84bf0c6a9c0cc1817dd38a25917470773b068e3c8670d371f772 125508 qemu_7.2+dfsg-6.debian.tar.xz
 0f753517944332d2eb89209e8db4debae0f399f9254d0bb02401f1db8908161b 11322 qemu_7.2+dfsg-6_source.buildinfo
Files:
 283effb6437e1b7ed3fc0eea438651bd 6450 otherosfs optional qemu_7.2+dfsg-6.dsc
 9f84e7b63893ee6c99a80df7d015b0a2 125508 otherosfs optional qemu_7.2+dfsg-6.debian.tar.xz
 3ae5bcb3492108d7c042fe078aa25315 11322 otherosfs optional qemu_7.2+dfsg-6_source.buildinfo

-----BEGIN PGP SIGNATURE-----

iQFDBAEBCgAtFiEEe3O61ovnosKJMUsicBtPaxppPlkFAmRM9GoPHG1qdEB0bHMu
bXNrLnJ1AAoJEHAbT2saaT5ZucQIAMU6hNTlW1UBY4DyAJjFQkBkXhKB+OhRgZGl
MIAzEilEA21vuByIvFugLw6A26PQcjHJZI6CrGst3kY3YdWWZJ6Y2qfPqzGhnXsb
67+Aq0Re3UYxngYS1Q3R+rq2nK7KnxUHdQz2xQhsIYDGiL1IQCFctT2AaQMbxdV5
EP6lYy5rLnVb7//HhIeiNS1ntTbdZ0uI1QMKuirlLYYfnV6PzsodIkESn5okY0bO
1QoBmNBRCWRLQPql5m62Z2S9AX0EWlhUHDkVZoA4jfaePamJuJo3cuHXiYFHveEz
ByM/bLbxfgEqg+5eVzI5KvxpK9kLAS9oKm5FRSXtGbT8D7DoRFg=
=jDR0
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.