Bug 1143908
Summary: | mod_gnutls crashes httpd if mod_php is loaded (CentOS 7) | ||||||
---|---|---|---|---|---|---|---|
Product: | [Fedora] Fedora EPEL | Reporter: | Django <django> | ||||
Component: | mod_gnutls | Assignee: | Jiri Kastner <cz172638> | ||||
Status: | CLOSED DUPLICATE | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
Severity: | high | Docs Contact: | |||||
Priority: | unspecified | ||||||
Version: | epel7 | CC: | cz172638, nmavrogi | ||||
Target Milestone: | --- | ||||||
Target Release: | --- | ||||||
Hardware: | x86_64 | ||||||
OS: | Linux | ||||||
Whiteboard: | |||||||
Fixed In Version: | Doc Type: | Bug Fix | |||||
Doc Text: | Story Points: | --- | |||||
Clone Of: | Environment: | ||||||
Last Closed: | 2017-08-14 08:53:41 UTC | Type: | Bug | ||||
Regression: | --- | Mount Type: | --- | ||||
Documentation: | --- | CRM: | |||||
Verified Versions: | Category: | --- | |||||
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
Cloudforms Team: | --- | Target Upstream Version: | |||||
Embargoed: | |||||||
Attachments: |
|
Description
Django
2014-09-18 08:45:45 UTC
can you try comment in /etc/httpd/conf.d/mod_gnutls.conf this: GnuTLSPriorities "@SYSTEM" (In reply to Jiri Kastner from comment #1) > can you try comment in /etc/httpd/conf.d/mod_gnutls.conf this: > GnuTLSPriorities "@SYSTEM" # cat /etc/httpd/conf.d/mod_gnutls.conf LoadModule gnutls_module modules/mod_gnutls.so GnuTLSCache dbm "/var/cache/mod_gnutls" GnuTLSCacheTimeout 300 GnuTLSPriorities "@SYSTEM" # apachectl -t AH00526: Syntax error on line 5 of /etc/httpd/conf.d/mod_gnutls.conf: GnuTLS: Syntax error parsing priorities string at: "@SYSTEM" without GnuTLSPriorities "@SYSTEM" httpd crashes (In reply to Django from comment #2) > # cat /etc/httpd/conf.d/mod_gnutls.conf > LoadModule gnutls_module modules/mod_gnutls.so > > GnuTLSCache dbm "/var/cache/mod_gnutls" > GnuTLSCacheTimeout 300 > GnuTLSPriorities "@SYSTEM" > > # apachectl -t > AH00526: Syntax error on line 5 of /etc/httpd/conf.d/mod_gnutls.conf: > GnuTLS: Syntax error parsing priorities string at: "@SYSTEM" > > without GnuTLSPriorities "@SYSTEM" httpd crashes please remove that line (it is supposed to work only in fedora 21 and rawhide) to have this: # cat /etc/httpd/conf.d/mod_gnutls.conf LoadModule gnutls_module modules/mod_gnutls.so GnuTLSCache dbm "/var/cache/mod_gnutls" GnuTLSCacheTimeout 300 (In reply to Jiri Kastner from comment #3) > please remove that line (it is supposed to work only in fedora 21 and > rawhide) to have this: > # cat /etc/httpd/conf.d/mod_gnutls.conf > LoadModule gnutls_module modules/mod_gnutls.so > > GnuTLSCache dbm "/var/cache/mod_gnutls" > GnuTLSCacheTimeout 300 O.K. I've done. like you told me. But the daemon crashes whil I reload the configuration. If I prevent loading the php5_module, like here. # vim /etc/httpd/conf.modules.d/10-php.conf # # PHP is an HTML-embedded scripting language which attempts to make it # easy for developers to write dynamically generated webpages. # <IfModule prefork.c> #LoadModule php5_module modules/libphp5.so </IfModule> http-daemon won't crash while reloading the daemon. But without PHP makes horde no more fun :/ Could you provide the output of 'valgrind apache -X'? (when apache isn't running) sorry I meant 'valgrind httpd -X' and then from another terminal try to restart it using httpd -k graceful (I believe it simulates your scenario). (In reply to Nikos Mavrogiannopoulos from comment #6) > sorry I meant 'valgrind httpd -X' and then from another terminal try to > restart it using httpd -k graceful (I believe it simulates your scenario). O.K. I've done, how you told me. After restarting httpd via 'httpd -k graceful' nothing happens on valgrind's terminal. After pressing STRG+C following lines are reported: [root@vml000097 ~]# valgrind httpd -X ==6020== Memcheck, a memory error detector ==6020== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==6020== Using Valgrind-3.9.0 and LibVEX; rerun with -h for copyright info ==6020== Command: httpd -X ==6020== ^C==6020== ==6020== HEAP SUMMARY: ==6020== in use at exit: 2,464,831 bytes in 4,748 blocks ==6020== total heap usage: 39,496 allocs, 34,748 frees, 8,389,797 bytes allocated ==6020== ==6020== LEAK SUMMARY: ==6020== definitely lost: 6,555 bytes in 49 blocks ==6020== indirectly lost: 150,694 bytes in 429 blocks ==6020== possibly lost: 1,643,192 bytes in 1,735 blocks ==6020== still reachable: 664,390 bytes in 2,535 blocks ==6020== suppressed: 0 bytes in 0 blocks ==6020== Rerun with --leak-check=full to see details of leaked memory ==6020== ==6020== For counts of detected and suppressed errors, rerun with: -v ==6020== ERROR SUMMARY: 0 errors from 0 contexts (suppressed: 3 from 3) ==6020== could not unlink /tmp/vgdb-pipe-from-vgdb-to-6020-by-root-on-vml000097.dmz.example.org ==6020== could not unlink /tmp/vgdb-pipe-to-vgdb-from-6020-by-root-on-vml000097.dmz.example.org ==6020== could not unlink /tmp/vgdb-pipe-shared-mem-vgdb-6020-by-root-on-vml000097.dmz.example.org Created attachment 943631 [details] valgrind output Ok the output that you list isn't informative, but the output that you sent me (in attachment shows the issue). The issue is on mod_php which overrides the gmp memory allocation functions. As gnutls uses gmp too, that creates a mess with memory half being allocated with php's memory allocation functions, and some without. When everything is deinitialized (on reload), there is the crash you see. It is a known bug upstream: https://bugs.php.net/bug.php?id=63595 I don't think that mod_php is in epel7, so you'd have to open this bug to rhel7, or to centos7. A work-around that could work, would be to load mod_php prior to mod_gnutls. i use rhel7 and i tried that combination. was that 'clean installation'? i see there dmz.example.com, which are not part of clean install configs. (In reply to Nikos Mavrogiannopoulos from comment #10) > A work-around that could work, would be to load mod_php prior to mod_gnutls. Nope, the same sh*t :/ (In reply to Jiri Kastner from comment #11) > i use rhel7 and i tried that combination. was that 'clean installation'? Yes, I tested it on three different CentOS 7 KVM-Hosts. Everytime the same sh*t. :/ > see there dmz.example.com, which are not part of clean install configs. I edited the outputs. :) The real name is the FQDN of the virtual host. A few minutes ago I tried to install: httpd-2.4.6-18.el7.centos.x86_64 (from CentOS-Base-Repository) mod_gnutls-0.5.10-13.el7.x86_64 (from EPEL-Repository) php-5.4.16-23.el7_0.1.x86_64 (from CentOS-Base-Repository) on my ThinkPad T410, but someone has removed mod_gnutls-0.5.10-13.el7.x86_64, so I cant test, if there's the same problem. new update is on the way as GnuTLSPriorities is only for fedora 21+. (In reply to Django from comment #12) > (In reply to Nikos Mavrogiannopoulos from comment #10) > > A work-around that could work, would be to load mod_php prior to mod_gnutls. > Nope, the same sh*t :/ In that case, I don't think there is anything that can be done in mod_gnutls to solve the issue. Please open a bug on mod_php. (In reply to Nikos Mavrogiannopoulos from comment #9) > I don't think that mod_php is in epel7, so you'd have to open this bug to > rhel7, or to centos7. O.K. I've done, how you told me: https://bugs.centos.org/view.php?id=7669 Feedback from Feedback from tigalch (developer) 2014-10-06 13:33 I've just retried your steps, and they happen here as well. I'Ve also went through the bugzilla entry from EPEL re. that issue. IMHO the best course of action would be to resubmit your bugreport against RHEL7, and see what comes from that. Once it gets fixed upstream, CentOS will inherit the fix. My initial reply has been the way it is because 3rd party packages are not supported in this buzgilla (meaning mod_gnutls). Not shure how this will be handled upstream, might be interesting. can you try http://kojipkgs.fedoraproject.org/packages/mod_gnutls/0.6/1.el7/x86_64/mod_gnutls-0.6-1.el7.x86_64.rpm short answer: the same holy shit detailed answer (with configuration: mod_gnutls loaded but not listening an port 443): [root@vml000097 ~]# systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled) Active: active (running) since Mon 2014-10-13 11:07:53 CEST; 43s ago Process: 15399 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS) Process: 15397 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful (code=exited, status=0/SUCCESS) Main PID: 15412 (httpd) Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec" CGroup: /system.slice/httpd.service ├─15412 /usr/sbin/httpd -DFOREGROUND ├─15414 /usr/sbin/httpd -DFOREGROUND ├─15415 /usr/sbin/httpd -DFOREGROUND ├─15416 /usr/sbin/httpd -DFOREGROUND ├─15417 /usr/sbin/httpd -DFOREGROUND └─15418 /usr/sbin/httpd -DFOREGROUND Oct 13 11:07:53 vml000097.dmz.example.org systemd[1]: Started The Apache HTTP Server. [root@vml000097 ~]# systemctl reload httpd.service [root@vml000097 ~]# systemctl status httpd.service httpd.service - The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled) Active: failed (Result: signal) since Mon 2014-10-13 11:08:47 CEST; 3s ago Process: 15426 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS) Process: 15424 ExecReload=/usr/sbin/httpd $OPTIONS -k graceful (code=exited, status=0/SUCCESS) Process: 15412 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=killed, signal=SEGV) Main PID: 15412 (code=killed, signal=SEGV) Status: "Total requests: 0; Current requests/sec: 0; Current traffic: 0 B/sec" Oct 13 11:07:53 vml000097.dmz.example.org systemd[1]: Started The Apache HTTP Server. Oct 13 11:08:47 vml000097.dmz.example.org systemd[1]: Reloading The Apache HTTP Server. Oct 13 11:08:47 vml000097.dmz.example.org systemd[1]: Reloaded The Apache HTTP Server. Oct 13 11:08:47 vml000097.dmz.example.org systemd[1]: httpd.service: main process exited, code=killed, status=11/SEGV Oct 13 11:08:47 vml000097.dmz.example.org systemd[1]: Unit httpd.service entered failed state. [root@vml000097 ~]# tail -n10 /var/log/httpd/error_log [Mon Oct 13 11:07:53.795677 2014] [proxy:debug] [pid 15417] proxy_util.c(1785): AH00931: initialized single connection worker in child 15417 for (*) [Mon Oct 13 11:07:53.796145 2014] [mpm_prefork:notice] [pid 15412] AH00163: Apache/2.4.6 (CentOS) mod_gnutls/0.6 GnuTLS/3.1.18 configured -- resuming normal operations [Mon Oct 13 11:07:53.796184 2014] [mpm_prefork:info] [pid 15412] AH00164: Server built: Jul 23 2014 14:48:00 [Mon Oct 13 11:07:53.796195 2014] [core:notice] [pid 15412] AH00094: Command line: '/usr/sbin/httpd -D FOREGROUND' [Mon Oct 13 11:07:53.796207 2014] [mpm_prefork:debug] [pid 15412] prefork.c(995): AH00165: Accept mutex: sysvsem (default: sysvsem) [Mon Oct 13 11:07:53.802170 2014] [proxy:debug] [pid 15418] proxy_util.c(1694): AH00925: initializing worker proxy:reverse shared [Mon Oct 13 11:07:53.802216 2014] [proxy:debug] [pid 15418] proxy_util.c(1734): AH00927: initializing worker proxy:reverse local [Mon Oct 13 11:07:53.802281 2014] [proxy:debug] [pid 15418] proxy_util.c(1785): AH00931: initialized single connection worker in child 15418 for (*) [Mon Oct 13 11:08:47.784162 2014] [mpm_prefork:notice] [pid 15412] AH00171: Graceful restart requested, doing restart [Mon Oct 13 11:08:47.793707 2014] [core:notice] [pid 15412] AH00060: seg fault or similar nasty error detected in the parent process *** This bug has been marked as a duplicate of bug 1149991 *** |