Bug 1311320

Summary: [abrt] binutils: _IO_new_file_seekoff(): ar killed by SIGSEGV
Product: [Fedora] Fedora Reporter: Julian Stecklina <js>
Component: binutilsAssignee: Nick Clifton <nickc>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 23CC: jakub, nickc
Target Milestone: ---   
Target Release: ---   
Hardware: x86_64   
OS: Unspecified   
URL: https://retrace.fedoraproject.org/faf/reports/bthash/a543bceb090aa7d7d915a1d131a586f943864a31
Whiteboard: abrt_hash:7a6993f4a6f080fa20682bc844ab90458dc47987;VARIANT_ID=workstation;
Fixed In Version: binutils-2.25-17.fc23 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-03-13 23:53:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: backtrace
none
File: cgroup
none
File: core_backtrace
none
File: dso_list
none
File: environ
none
File: exploitable
none
File: limits
none
File: maps
none
File: mountinfo
none
File: namespaces
none
File: open_fds
none
File: proc_pid_status
none
File: var_log_messages
none
Object file that triggers the gcc-ar crash none

Description Julian Stecklina 2016-02-23 23:27:59 UTC
Description of problem:
This coredump happens for the following situation. I have a C++ file generic.cpp with this content:

int hello()
{
    return 42;
}

Then I execute the following two commands:
g++ -c generic.cpp -o generic.x86_32.o -m32 -flto -pipe 
gcc-ar cDrs libgeneric.x86_32.a generic.x86_32.o

Expected behavior is for gcc-ar not to crash.

Version-Release number of selected component:
binutils-2.25-15.fc23

Additional info:
reporter:       libreport-2.6.4
backtrace_rating: 4
cmdline:        /usr/bin/ar --plugin /usr/libexec/gcc/x86_64-redhat-linux/5.3.1/liblto_plugin.so -cDrs libgeneric.x86_32.a generic.x86_32.o
crash_function: _IO_new_file_seekoff
executable:     /usr/bin/ar
global_pid:     23105
kernel:         4.3.5-300.fc23.x86_64
runlevel:       N 5
type:           CCpp
uid:            1000

Truncated backtrace:
Thread no. 1 (10 frames)
 #0 _IO_new_file_seekoff at fileops.c:1134
 #1 fseeko at fseeko.c:39
 #2 bfd_seek at bfdio.c:325
 #3 pe_bfd_object_p at peicode.h:1275
 #4 bfd_check_format_matches at format.c:335
 #5 bfd_plugin_get_symbols_in_object_only at plugin.c:156
 #6 add_symbols at plugin.c:278
 #7 claim_file_handler at ../../lto-plugin/lto-plugin.c:978
 #8 try_claim at plugin.c:331
 #9 try_load_plugin at plugin.c:384

Comment 1 Julian Stecklina 2016-02-23 23:28:29 UTC
Created attachment 1129960 [details]
File: backtrace

Comment 2 Julian Stecklina 2016-02-23 23:28:31 UTC
Created attachment 1129961 [details]
File: cgroup

Comment 3 Julian Stecklina 2016-02-23 23:28:34 UTC
Created attachment 1129962 [details]
File: core_backtrace

Comment 4 Julian Stecklina 2016-02-23 23:28:35 UTC
Created attachment 1129963 [details]
File: dso_list

Comment 5 Julian Stecklina 2016-02-23 23:28:37 UTC
Created attachment 1129964 [details]
File: environ

Comment 6 Julian Stecklina 2016-02-23 23:28:39 UTC
Created attachment 1129965 [details]
File: exploitable

Comment 7 Julian Stecklina 2016-02-23 23:28:41 UTC
Created attachment 1129966 [details]
File: limits

Comment 8 Julian Stecklina 2016-02-23 23:28:42 UTC
Created attachment 1129967 [details]
File: maps

Comment 9 Julian Stecklina 2016-02-23 23:28:44 UTC
Created attachment 1129968 [details]
File: mountinfo

Comment 10 Julian Stecklina 2016-02-23 23:28:45 UTC
Created attachment 1129969 [details]
File: namespaces

Comment 11 Julian Stecklina 2016-02-23 23:28:47 UTC
Created attachment 1129970 [details]
File: open_fds

Comment 12 Julian Stecklina 2016-02-23 23:28:49 UTC
Created attachment 1129971 [details]
File: proc_pid_status

Comment 13 Julian Stecklina 2016-02-23 23:28:50 UTC
Created attachment 1129972 [details]
File: var_log_messages

Comment 14 Nick Clifton 2016-02-24 09:31:21 UTC
Hi Julian,

  Please could you upload copies of libgeneric.x86_32.a and generic.x86_32.o so that I can reproduce the problem locally ?

Cheers
  Nick

Comment 15 Julian Stecklina 2016-02-26 20:50:15 UTC
For me it trivially reproduces even with an "empty" object file:
 % rm -f foo.o lib.a
 % touch foo.cpp    
 % g++ -c foo.cpp -m32 -flto
 % gcc-ar cDrs lib.a foo.o 

I am attaching the object file for convencience. With that the bug reproduces with the last gcc-ar call.

Comment 16 Julian Stecklina 2016-02-26 20:52:06 UTC
Created attachment 1130903 [details]
Object file that triggers the gcc-ar crash

Comment 17 Nick Clifton 2016-03-01 10:06:32 UTC
Thanks Julian - that crash.o file was exactly what I needed.

Please try: binutils-2.25-17.fc23 which should fix the bug.

Comment 18 Julian Stecklina 2016-03-02 14:01:31 UTC
With binutils-2.25-17.fc23 I cannot reproduce the bug anymore. Thanks!

Comment 19 Julian Stecklina 2016-03-09 19:21:15 UTC
Is there a rough timeline when the updated binutils will be pushed to fedora-updates?

Comment 20 Fedora Update System 2016-03-10 09:29:36 UTC
binutils-2.25-17.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-3ee715a535

Comment 21 Fedora Update System 2016-03-12 17:26:16 UTC
binutils-2.25-17.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report.
See https://fedoraproject.org/wiki/QA:Updates_Testing for
instructions on how to install test updates.
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-3ee715a535

Comment 22 Fedora Update System 2016-03-13 23:53:40 UTC
binutils-2.25-17.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.