Debian Bug report logs - #820334
Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers

Date: Thu, 7 Apr 2016 15:45:13 +0200

[Message part 1 (text/plain, inline)]

Package: src:cmake
Version: 3.0.2-1

Hi,

I've managed to find the cause of the openmpi segfault (#818909). It
might affect a number of different packages.

The segfault is caused by the interaction of the
new DT_MIPS_RLD_MAP_REL dynamic tag (from binutils 2.26) and chrpath.
Unlike all other tags, this tag is relative to the offset of the tag
within the executable. chrpath is used to remove rpaths from ELF files.
It does this by moving all of the other dynamic tags up one entry, but
since the DT_MIPS_RLD_MAP_REL is not updated, it now points to an
incorrect offset. The dynamic linker will then overwrite some other
memory when processing the DT_MIPS_RLD_MAP_REL tag.

The openmpi segfault was caused by a global variable being initialized
incorrectly (overwritten by the dynamic linker). I expect other
executables using chrpath will also be affected - possibly in strange
ways (not nessesarily a segfault).

It also seems that at least cmake uses the same technique for removing
the RPATH so any cmake reverse dependencies could be affected. The
DT_MIPS_RLD_MAP_REL is only created for executables which limits the
effect of this slightly. Only packages built using binutils
>= 2.25.51.20151014-1 will be affected.

There is a convinient way to test if a package is broken using the
presence of the old DT_MIPS_RLD_MAP tag. When correct
(DT_MIPS_RLD_MAP_REL + tag offset + executable base address) equals
DT_MIPS_RLD_MAP, so someone could analyze the archive to find which
packages are affected (any if any tools other than chrpath and cmake
are broken).

Based only on chrpath and cmake reverse dependencies, there is an upper
bound of about 1500 binNMUs (after the tools after fixed). Hopefully
that can be reduced!

I really don't have any time to fix all this. Please can someone else
have a look!

OpenMPI maintainers (and anyone else affected):
One possible workaround is to use chrpath -r "" <file> on mips*
architectures until this is fixed since that command does not cause any
tags to be moved. It has a tiny performance penalty but should
otherwise work properly.

James

[signature.asc (application/pgp-signature, attachment)]

Message #12 received at 820334@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: 820334@bugs.debian.org

Cc: Aurelien Jarno <aurel32@debian.org>, jcowgill@debian.org

Subject: Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers

Date: Sat, 9 Apr 2016 13:22:09 +0200

Thanks to aurel32@d.o chrpath has been fixed. Could an equivalent
patch be included in cmake ?

On 2016-04-07 15:46, Mathieu Malaterre wrote:
> Package: src:chrpath
> Version: 0.16-1
>
> Hi,
>
> I've managed to find the cause of the openmpi segfault (#818909). It
> might affect a number of different packages.
>
> The segfault is caused by the interaction of the
> new DT_MIPS_RLD_MAP_REL dynamic tag (from binutils 2.26) and chrpath.
> Unlike all other tags, this tag is relative to the offset of the tag
> within the executable. chrpath is used to remove rpaths from ELF files.
> It does this by moving all of the other dynamic tags up one entry, but
> since the DT_MIPS_RLD_MAP_REL is not updated, it now points to an
> incorrect offset. The dynamic linker will then overwrite some other
> memory when processing the DT_MIPS_RLD_MAP_REL tag.

Please find below a patch to correctly handle this tag in chrpath. If
you are fine with the patch, a quick upload would be appreciated as
chrpath currently generates broken binaries. Thanks!

Aurelien


--- chrpath-0.16.orig/killrpath.c
+++ chrpath-0.16/killrpath.c
@@ -73,10 +73,26 @@
    dynpos = 0;
    for (i = 0; DYNSS(i, d_tag) != DT_NULL; i++)
      {
-       if (is_e32())
+       if (is_e32()) {
         ((Elf32_Dyn *)dyns)[dynpos] = ((Elf32_Dyn *)dyns)[i];
-       else
+#ifdef DT_MIPS_RLD_MAP_REL
+        /* DT_MIPS_RLD_MAP_REL is relative to the offset of the tag.
+           Adjust it consequently.  */
+        if (DYNSS(i, d_tag) == DT_MIPS_RLD_MAP_REL)
+         ((Elf32_Dyn *)dyns)[dynpos].d_un.d_val =
+          DO_SWAPU32(DYNSU(i, d_un.d_val) +
+          (i - dynpos) * sizeof(Elf32_Dyn));
+#endif
+       } else {
         ((Elf64_Dyn *)dyns)[dynpos] = ((Elf64_Dyn *)dyns)[i];
+#ifdef DT_MIPS_RLD_MAP_REL
+        /* Ditto */
+        if (DYNSS(i, d_tag) == DT_MIPS_RLD_MAP_REL)
+         ((Elf64_Dyn *)dyns)[dynpos].d_un.d_val =
+          DO_SWAPU64(DYNSU(i, d_un.d_val) +
+          (i - dynpos) * sizeof(Elf64_Dyn));
+#endif
+       }
        if ( ! elf_dynpath_tag(DYNSS(i, d_tag)) )
         dynpos++;
      }

--
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net

Message #17 received at 820334@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: 820334@bugs.debian.org

Subject: Fwd: Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers

Date: Sat, 9 Apr 2016 13:23:19 +0200

Please find the current list of affected packages.


---------- Forwarded message ----------
From: Aurelien Jarno <aurelien@aurel32.net>
Date: Fri, Apr 8, 2016 at 11:07 PM
Subject: Re: Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers
To: debian-mips@lists.debian.org


On 2016-04-08 18:44, Aurelien Jarno wrote:
> On 2016-04-08 10:45, Aurelien Jarno wrote:
> > Hi,
> >
> > On 2016-04-07 11:51, James Cowgill wrote:
> > >
> > > Based only on chrpath and cmake reverse dependencies, there is an upper
> > > bound of about 1500 binNMUs (after the tools after fixed). Hopefully
> > > that can be reduced!
> > >
> > > I really don't have any time to fix all this. Please can someone else
> > > have a look!
> >
> > I'll try to do an archive scan asap to really get an idea on how many
> > packages are affected. After I'll look at how to fix chrpath, but help
> > would be welcome as I also don't have a lot of time.
>
> Please find below a small quick and dirty python script to check that.
> There is probably a way to do it better and cleaner, but it does its
> job.
>
> I will start an archive scan and will start working on a chrpath fix.

There are 180 packages affected on mipsel, it could have been worse.
That said all the binNMUs scheduled for the libpng transition could
increase the broken packages.

Anyway please find the list below.

Aurelien



airspy-host_1.0.7-1
amarok_2.8.0-4
appstream_0.9.3-1
ark_4:15.08.3-1
axe-demultiplexer_0.3.1-4
baloo-kf5_5.16.0-1
bamtools_2.4.0+dfsg-6
basket_2.10~beta+git20160305.487a115-1
bladerf_0.2016.01~rc1-3
cantor_4:15.12.2-1
cassiopee_1.0.4+dfsg-1
castxml_0.1+git20160202-1.1
chemps2_1.6-3
choqok_1.5-4
chromaprint_1.3-1
c-icap_1:0.4.2-3
cigi-ccl_3.3.3a+svn818-10
codec2_0.5-3
code-saturne_4.2.1+repack-1
cupt_2.9.4
davix_0.5.0-1
dcmtk_3.6.1~20150924-5
dnsval_2.0-4
dolphin_4:15.08.3-1
ebook-tools_0.2.2-4
eiskaltdcpp_2.2.9-4
elektra_0.8.14-5
eterm_0.9.6-4
ffmpegthumbnailer_2.1.1-0.1
fontforge_20120731.b-7.1
gammaray_2.4.0-1
gammu_1.37.0-1
gazebo_7.0.0+dfsg-2
gcc-4.8_4.8.5-4
gcc-4.9_4.9.3-12
gcc-5_5.3.1-13
glyr_1.0.8-2
gmsh_2.12.0+dfsg1-1
gmt_5.2.1+dfsg-4
gnuradio_3.7.9.1-2
grib-api_1.14.7-1
gwenview_4:15.08.3-1
hackrf_2015.07.2-6
haskell-swish_0.9.1.7-1
hatari_1.8.0+dfsg-1
hyperestraier_1.4.13-14
hyphy_2.2.6+dfsg-3
ifrit_4.1.2-2
irony-mode_0.1.2-2
iwyu_3.7-1
jovie_4:15.08.3-1
k3b_2.0.3a-1
kate_4:15.08.3-1
kcalc_4:15.08.3-1
kconfig_5.16.0-1
kde4libs_4:4.14.14-1
kde-baseapps_4:15.08.3-1
kdeclarative_5.16.0-1
kde-cli-tools_4:5.4.3-1
kdeconnect_0.9g-1
kded_5.16.0-1
kdelibs4support_5.16.0-1
kde-runtime_4:15.08.3-1
kdesu_5.16.0-1
kdewebdev_4:15.08.3-1
kglobalaccel_5.16.0-1
khelpcenter_4:5.4.3-1
kicad_4.0.2+dfsg1-4
kiconthemes_5.16.0-1
kinit_5.16.0-1
kio_5.16.0-1
kiten_4:15.08.3-1
kjs_5.16.0-1
kjsembed_5.16.0-1
klatexformula_3.3.0~beta-1
kmenuedit_4:5.4.3-1
kolf_4:15.08.3-1
kolourpaint_4:15.08.3-1
konsole_4:15.08.3-1
kopete_4:15.08.3-1
kpackage_5.16.0-1
kpat_4:15.08.3-1
krfb_4:15.08.3-1
kross_5.16.0-1
kservice_5.16.0-1
kst_2.0.3-5
ksysguard_4:5.4.3-1
ktorrent_4.3.1-4
ktp-common-internals_15.08.3-1
ktp-text-ui_15.08.3-1
kvirc_4:4.2.0-2
kwallet-kf5_5.16.0-1
kwave_0.9.1-1-2
kwin_4:5.4.3-1.1
libam7xxx_0.1.6-2
libcitygml_2.0-2
libdigidoc_3.10.1.1208+ds1-2
libfreenect_1:0.5.3-1
libftdi1_1.2-5
libiio_0.6.40-1
libindi_1.1.0-2
libjdns_2.0.3-1
libjson-rpc-cpp_0.6.0-2
libkipi_4:15.08.3-1
libkscreen_4:5.4.3-1
liblas_1.8.0-8
libqapt_3.0.1-1
librabbitmq_0.7.1-1
libsolv_0.6.11-1.1
liggghts_3.3.1+repack1-1
limba_0.5.6-1
llvm-toolchain-3.7_1:3.7.1-2
magics++_2.28.0-1
mapserver_7.0.1-3
marble_4:15.08.3-1.1
mathgl_2.3.4-1
mia_2.2.7-3
midori_0.5.11-ds1-2
mixxx_2.0.0~dfsg-3
mlpack_2.0.1-1
mpqc_2.3.1-16.1
mpqc3_0.0~git20160216-3
mrpt_1:1.3.2-1
muon_4:5.4.3-1
music_1.0.7-1.2
mysql-workbench_6.3.4+dfsg-3
netcdf_1:4.4.0-2
nordlicht_0.4.4-2
normaliz_3.1.0+ds-1
oclgrind_15.5-3
openalpr_2.2.4-1
openal-soft_1:1.17.2-1
opencolorio_1.0.9~dfsg0-5
openimageio_1.6.12~dfsg0-1
openmpi_1.10.2-12
openmsx-debugger_0.1~git20160326-2
openscenegraph_3.2.3+dfsg1-1
osgearth_2.7.0+dfsg-1
ossim_1.8.20.3+ds-2
palapeli_4:15.08.3-1
parmetis_4.0.3-4
pdal_1.1.0-4
pfstools_2.0.4-5
pgadmin3_1.22.1-1
plasma-desktop_4:5.4.3-1
plasma-framework_5.16.0-1
plasma-nm_4:5.4.3-1
plasma-workspace_4:5.4.3-2
plplot_5.10.0+dfsg2-0.2
print-manager_4:15.08.3-1
qdbm_1.8.78-6
qlandkartegt_1.8.1+ds-5
qpid-proton_0.10-2
racket_6.3-3
razorqt_0.5.2-4
regina-normal_4.96-2.1
rocs_4:15.08.3-1
ros-geometry_1.11.7-3
ros-geometry-experimental_0.5.12-3
ros-image-common_1.11.10-5
ros-nodelet-core_1.9.3-2
ros-robot-model_1.11.8-4
ros-ros-comm_1.11.16-5
ros-rospack_2.2.5-3
ros-rviz_1.11.10+dfsg-2
ros-vision-opencv_1.11.11+ds-3
simgrid_3.12-2
slang2_2.3.0-2.1
smb4k_1.2.1-1
solid_5.16.0-1
subtle_0.11.3224-xi-2.2
supertux_0.4.0-1
systemsettings_4:5.4.3-1
uhd_3.9.3-1
urdfdom_0.4.1-1
volk_1.2.1-2
vtk6_6.2.0+dfsg1-9
vtk-dicom_0.7.6-1
x265_1.9-3
xcircuit_3.8.78.dfsg-1

--
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net

Message #22 received at 820334@bugs.debian.org (full text, mbox, reply):

From: Aurelien Jarno <aurel32@debian.org>

To: Mathieu Malaterre <malat@debian.org>

Cc: 820334@bugs.debian.org, jcowgill@debian.org

Subject: Re: Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers

Date: Sat, 9 Apr 2016 14:14:41 +0200

On 2016-04-09 13:22, Mathieu Malaterre wrote:
> Thanks to aurel32@d.o chrpath has been fixed. Could an equivalent
> patch be included in cmake ?

You mean that cmake is not calling chrpath, but instead has an embedded
copy? In that case I'll look at that later today.

-- 
Aurelien Jarno                          GPG: 4096R/1DDD8C9B
aurelien@aurel32.net                 http://www.aurel32.net

Message #27 received at 820334@bugs.debian.org (full text, mbox, reply):

From: Mathieu Malaterre <malat@debian.org>

To: Aurelien Jarno <aurel32@debian.org>

Cc: 820334@bugs.debian.org, Brad King <brad.king@kitware.com>

Subject: Re: Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers

Date: Sat, 9 Apr 2016 17:01:51 +0200

Salut Aurélien,

On Sat, Apr 9, 2016 at 2:14 PM, Aurelien Jarno <aurel32@debian.org> wrote:
> On 2016-04-09 13:22, Mathieu Malaterre wrote:
>> Thanks to aurel32@d.o chrpath has been fixed. Could an equivalent
>> patch be included in cmake ?
>
> You mean that cmake is not calling chrpath, but instead has an embedded
> copy? In that case I'll look at that later today.

That is how I understand the code in cmSystemTools::RemoveRPath (it
should hopefully be very close to chrpath implementation).

Brad, is this the only location that needs to be fixed ?

Thanks

Message #32 received at 820334@bugs.debian.org (full text, mbox, reply):

From: Brad King <brad.king@kitware.com>

To: Mathieu Malaterre <malat@debian.org>, Aurelien Jarno <aurel32@debian.org>

Cc: 820334@bugs.debian.org

Subject: Re: Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers

Date: Mon, 11 Apr 2016 09:24:20 -0400

On 04/09/2016 11:01 AM, Mathieu Malaterre wrote:
> On Sat, Apr 9, 2016 at 2:14 PM, Aurelien Jarno wrote:
>> You mean that cmake is not calling chrpath, but instead has an embedded
>> copy? In that case I'll look at that later today.

Yes, CMake has a separate implementation.  It is not a copy of chrpath
but its own implementation, and was created because (at least at the time)
chrpath did not support changing cross-compiled binaries.

> That is how I understand the code in cmSystemTools::RemoveRPath (it
> should hopefully be very close to chrpath implementation).
> 
> Brad, is this the only location that needs to be fixed ?

Yes, IIRC.

-Brad

Message #39 received at 820334@bugs.debian.org (full text, mbox, reply):

From: James Cowgill <jcowgill@debian.org>

To: 820334@bugs.debian.org

Subject: Bug#820334: Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers

Date: Thu, 6 Oct 2016 09:42:14 +0100

[Message part 1 (text/plain, inline)]

Control: forwarded -1 https://gitlab.kitware.com/cmake/cmake/merge_requests/147
Control: tags -1 sid stretch

Hi,

I've submitted the above PR upstream which should fix this issue. The
patch was a bit bigger than what I would have liked due to the cmELF
class requiring some changes.

Tagging for stretch since jessie contains binutils 2.25 which is
unaffected.

Thanks,
James

[signature.asc (application/pgp-signature, attachment)]

Message #48 received at 820334@bugs.debian.org (full text, mbox, reply):

From: James Cowgill <jcowgill@debian.org>

To: 820334@bugs.debian.org

Subject: Re: Bug#820334: Segfaults caused by new DT_MIPS_RLD_MAP_REL tag and RPATH removers

Date: Thu, 13 Oct 2016 12:53:39 +0100

[Message part 1 (text/plain, inline)]

Control: tags -1 patch fixed-upstream

Hi,

On 06/10/16 09:42, James Cowgill wrote:
> Control: forwarded -1 https://gitlab.kitware.com/cmake/cmake/merge_requests/147
> Control: tags -1 sid stretch
> 
> Hi,
> 
> I've submitted the above PR upstream which should fix this issue. The
> patch was a bit bigger than what I would have liked due to the cmELF
> class requiring some changes.

The PR was accepted and I've attached a patch which backports it to 3.6.

Thanks,
James

[mips-rld-map-rel.patch (text/x-patch, attachment)]

[signature.asc (application/pgp-signature, attachment)]

Message #57 received at 820334-close@bugs.debian.org (full text, mbox, reply):

From: Lisandro Damián Nicanor Pérez Meyer <lisandro@debian.org>

To: 820334-close@bugs.debian.org

Subject: Bug#820334: fixed in cmake 3.6.2-2

Date: Sat, 15 Oct 2016 04:20:32 +0000

Source: cmake
Source-Version: 3.6.2-2

We believe that the bug you reported is fixed in the latest version of
cmake, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 820334@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Lisandro Damián Nicanor Pérez Meyer <lisandro@debian.org> (supplier of updated cmake package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Format: 1.8
Date: Fri, 14 Oct 2016 22:29:17 -0300
Source: cmake
Binary: cmake cmake-data cmake-curses-gui cmake-qt-gui cmake-doc
Architecture: source
Version: 3.6.2-2
Distribution: unstable
Urgency: medium
Maintainer: Debian CMake Team <pkg-cmake-team@lists.alioth.debian.org>
Changed-By: Lisandro Damián Nicanor Pérez Meyer <lisandro@debian.org>
Description:
 cmake      - cross-platform, open-source make system
 cmake-curses-gui - curses based user interface for CMake (ccmake)
 cmake-data - CMake data files (modules, templates and documentation)
 cmake-doc  - extended documentation in various formats for CMake
 cmake-qt-gui - Qt4 based user interface for CMake (cmake-gui)
Closes: 820334
Changes:
 cmake (3.6.2-2) unstable; urgency=medium
 .
   * Add mips-rld-map-rel.patch to solve segfaults caused by new
     DT_MIPS_RLD_MAP_REL tag and RPATH removers (Closes: #820334).
     Thanks James Cowgill for the patch.
   * Refresh patches.
Checksums-Sha1:
 49b66cfd7e77c09708a4f0e8d124a9e57d14606d 2459 cmake_3.6.2-2.dsc
 41000e3d5e9e0f32e20767c9f087a9f240f40f1b 32640 cmake_3.6.2-2.debian.tar.xz
Checksums-Sha256:
 9f5220fa3c1aa59a957aa141cf2910ca3f504e8c810ddf1e93a029707150cf4b 2459 cmake_3.6.2-2.dsc
 daeb05d238753c702dfc3ad1fc6176999fe5cdd04f3493fb5f5b7978a87fa03b 32640 cmake_3.6.2-2.debian.tar.xz
Files:
 88f593b98c0fb38a69550202371a1202 2459 devel optional cmake_3.6.2-2.dsc
 25e954900b28cf3a535f6c14eb9efa31 32640 devel optional cmake_3.6.2-2.debian.tar.xz

-----BEGIN PGP SIGNATURE-----

iQIxBAEBCAAbBQJYAY95FBxsaXNhbmRyb0BkZWJpYW4ub3JnAAoJEKtkX0BihqfQ
GPUP/3tt6LVgwVTg0ekgXav9nmJhKX6BiDhzQroUgBTFpOgNdhl8Ctb5O69Bu1eX
7lihTlKy8pIdhG3HhVEAUd5xvwHq2Aur8FaE9QJij9l9Amu50HhQPpOK/ofAiKYF
4TadRDDW2kTmSliPGwXHZHvuq5M7yKJKoICigs5TQu1ong5p4ut31NYI4HeH40rA
qXPw5+QOn/LMLwvZI9+2KGAdQlpOagXaIVOSYk6ZnuRrtQfXhb4bSnCSMJkXH3P0
iLYJI6bej2HvJCy1HUoeCRcnkXnuy60EmHMMM0iWcxTbUrhWnQE8aEk3QYbzOTGC
1jYL1I0+HBkRW3p3Y8C+N+Ca6i4tf7FGk4gq6xj6U10/0JeabIeZheR2esg/aG2B
ObwT2HEXU9bk0bP2PFt1q5XDUppk8ehARzCVUHjh/7fMsJsRVCyN/+PzTYkK7g/f
8d84+783mlMlwCpnUoms+Z3WSJZkUVkxbEiv2x+Q8ezv0G+OqM562Y6LVFB3u2io
9eyiNKQrYJQsJX6+sUEfLtX0yiTmq/e9V2fww0gNLsKaP60X6LH5RSnHkZrxNVzx
XFSxc9G8yKurZrx875Wz0Ig2oPeJ5gurTlhKG8+YrIdUVI9u+W47fjzkcXJ04rHS
ayJvzIBwyr3rWZCGlHXEngS1WF7LeijxYM2PEBuyNN28PJ2U
=4APu
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.