Bug 1010506

Summary: [abrt] systemd-204-11.fc19: crash: Process /usr/lib/systemd/systemd was killed by signal 11 (SIGSEGV)
Product: [Fedora] Fedora Reporter: tjmdw2
Component: systemdAssignee: systemd-maint
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 19CC: dwrobel, johannbg, lnykryn, msekleta, plautrba, systemd-maint, vpavlin, zbyszek
Target Milestone: ---   
Target Release: ---   
Hardware: i686   
OS: Unspecified   
Whiteboard: abrt_hash:a3b6b3a569d0774545dcc6930e39a6043d7b7f1d
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-09-29 10:21:08 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: limits
none
File: maps
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages none

Description tjmdw2 2013-09-20 23:01:17 UTC
Version-Release number of selected component:
systemd-204-11.fc19

Additional info:
reporter:       libreport-2.1.7
backtrace_rating: 4
cmdline:        /usr/lib/systemd/systemd --switched-root --system --deserialize 20
crash_function: crash
executable:     /usr/lib/systemd/systemd
kernel:         3.11.1-200.fc19.i686
runlevel:       N 5
type:           CCpp
uid:            0

Truncated backtrace:
Thread no. 1 (10 frames)
 #2 crash at ../src/core/main.c:142
 #4 free@plt at /lib/libc.so.6
 #5 _IO_vfprintf_internal at vfprintf.c:1635
 #6 ___vsnprintf_chk at vsnprintf_chk.c:63
 #7 ___snprintf_chk at snprintf_chk.c:35
 #8 snprintf at /usr/include/bits/stdio2.h:64
 #9 log_do_header at ../src/shared/log.c:441
 #10 log_struct_internal at ../src/shared/log.c:746
 #11 process_event at ../src/core/manager.c:1641
 #12 manager_loop at ../src/core/manager.c:1755

Comment 1 tjmdw2 2013-09-20 23:01:27 UTC
Created attachment 800771 [details]
File: backtrace

Comment 2 tjmdw2 2013-09-20 23:01:34 UTC
Created attachment 800772 [details]
File: cgroup

Comment 3 tjmdw2 2013-09-20 23:01:48 UTC
Created attachment 800773 [details]
File: core_backtrace

Comment 4 tjmdw2 2013-09-20 23:01:56 UTC
Created attachment 800774 [details]
File: dso_list

Comment 5 tjmdw2 2013-09-20 23:02:03 UTC
Created attachment 800775 [details]
File: environ

Comment 6 tjmdw2 2013-09-20 23:02:10 UTC
Created attachment 800776 [details]
File: limits

Comment 7 tjmdw2 2013-09-20 23:02:19 UTC
Created attachment 800777 [details]
File: maps

Comment 8 tjmdw2 2013-09-20 23:02:32 UTC
Created attachment 800778 [details]
File: open_fds

Comment 9 tjmdw2 2013-09-20 23:02:37 UTC
Created attachment 800779 [details]
File: proc_pid_status

Comment 10 tjmdw2 2013-09-20 23:02:48 UTC
Created attachment 800780 [details]
File: var_log_messages

Comment 11 Damian Wrobel 2013-09-22 05:47:50 UTC
I had the same running on systemd-204-15.fc19.i686 as well.

Comment 12 Damian Wrobel 2013-09-22 11:01:29 UTC
(In reply to Damian Wrobel from comment #11)
> I had the same running on systemd-204-15.fc19.i686 as well.

It was 100% reproducible while resuming laptop causing the machine entirely unusable.

Recompiling and installing systemd-207-4[1] from koji to F19 fixes the issue for me.

[1]. http://kojipkgs.fedoraproject.org//packages/systemd/207/4.fc20/src/systemd-207-4.fc20.src.rpm

Comment 13 Zbigniew Jędrzejewski-Szmek 2013-09-23 11:29:21 UTC
Hm, this failure is in a logging statement. But it is a very simple logging statement, with a static string and no arguments. As simple as it gets. The logging implementation is pretty complex, but if we had bugs there, I suppose we would see more failures, since the logging code is used all the time. Most likely explanation is that this is a memory corruption that is triggered by some specific sequence of events during the suspend, but actually happens outside of the call stack shown in the backtrace.

Comment 14 Damian Wrobel 2013-09-23 15:46:24 UTC
I've made an attempt to compile the aforementioned 207-4 srpm having enabled the address sanitizer with the following change:

diff --git a/configure.ac b/configure.ac
index d3f853f..492befd 100644
--- a/configure.ac
+++ b/configure.ac
@@ -102,6 +102,7 @@ if test -z "$GPERF" ; then
 fi

 CC_CHECK_FLAGS_APPEND([with_cflags], [CFLAGS], [\
+        -fsanitize=address -fno-omit-frame-pointer \
         -pipe \
         -Wall \
         -Wextra \
@@ -151,6 +152,7 @@ AS_CASE([$CFLAGS], [*-O[[12345g\ ]]*],
 AC_SUBST([OUR_CPPFLAGS], $with_cppflags)

 CC_CHECK_FLAGS_APPEND([with_ldflags], [LDFLAGS], [\
+        -Wc,-fsanitize=address \
         -Wl,--as-needed \
         -Wl,--no-undefined \
         -Wl,--gc-sections \


unfortunately the build failed with the following errors:

./.libs/libsystemd-machine-core.a(libsystemd_machine_core_la-machined-dbus.o): In function `bus_manager_create_machine':
/home/dw/projects/rpmbuild/BUILD/systemd-207/build3/../src/machine/machined-dbus.c:204: undefined reference to `manager_add_machine'
./.libs/libsystemd-machine-core.a(libsystemd_machine_core_la-machined-dbus.o): In function `manager_message_handler':
/home/dw/projects/rpmbuild/BUILD/systemd-207/build3/../src/machine/machined-dbus.c:307: undefined reference to `manager_get_machine_by_pid'
collect2: error: ld returned 1 exit status
Makefile:8553: recipe for target 'test-machine-tables' failed
...

This looks like a Makefile's problem. If you could look at it and suggest what should be corrected, I'm willing to test such a version.

Comment 15 Zbigniew Jędrzejewski-Szmek 2013-09-26 13:01:58 UTC
Hi,
I've pushed fixes into systemd git for the build issue with -fsanitize=address. You should be able to do

  ./configure --enable-address-sanitizer --disable-introspection CFLAGS='-g ...'

and it should built an address sanitizer enabled version. --disable-introspection is required because the ldflags mess up the introspection call, and I haven't found a way to hook into the right place.

Relevant commits are 8097ab4f, and 732bfe0, bd16acf, 2b3ab29d.

Comment 16 Zbigniew Jędrzejewski-Szmek 2013-09-29 10:21:08 UTC

*** This bug has been marked as a duplicate of bug 1010603 ***