Bug 2388236
| Summary: | [abrt] Crash under gnutls_x509_trust_list_verify_crt2() (accessing GnuTLS internals from multiple threads at the same time) | ||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Loris Santamaria <loris.santamaria> | ||||||||||||||||||||||||||
| Component: | gnutls | Assignee: | Red Hat Crypto Team <crypto-team> | ||||||||||||||||||||||||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||||||||||||||||||||||||
| Severity: | unspecified | Docs Contact: | |||||||||||||||||||||||||||
| Priority: | unspecified | ||||||||||||||||||||||||||||
| Version: | 42 | CC: | ansasaki, crypto-team, dueno, fkrenzel, gnome-sig, loris.santamaria, mcatanza, mclasen, mcrha, rstrode, tm, zfridric | ||||||||||||||||||||||||||
| Target Milestone: | --- | Flags: | fedora-admin-xmlrpc:
mirror+
|
||||||||||||||||||||||||||
| Target Release: | --- | ||||||||||||||||||||||||||||
| Hardware: | x86_64 | ||||||||||||||||||||||||||||
| OS: | Unspecified | ||||||||||||||||||||||||||||
| URL: | https://retrace.fedoraproject.org/faf/reports/bthash/b8c14cc3dd48c62b44a10c227d2f3d27bf39032 | ||||||||||||||||||||||||||||
| Whiteboard: | abrt_hash:50aad4babab71183dc8131178d1060bc32adc659;VARIANT_ID=workstation; | ||||||||||||||||||||||||||||
| Fixed In Version: | gnutls-3.8.11-1.fc43 | Doc Type: | --- | ||||||||||||||||||||||||||
| Doc Text: | Story Points: | --- | |||||||||||||||||||||||||||
| Clone Of: | Environment: | ||||||||||||||||||||||||||||
| Last Closed: | 2025-11-23 00:56:20 UTC | Type: | --- | ||||||||||||||||||||||||||
| Regression: | --- | Mount Type: | --- | ||||||||||||||||||||||||||
| Documentation: | --- | CRM: | |||||||||||||||||||||||||||
| Verified Versions: | Category: | --- | |||||||||||||||||||||||||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||||||||||||||||||||||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||||||||||||||||||||||||
| Embargoed: | |||||||||||||||||||||||||||||
| Bug Depends On: | 1937513 | ||||||||||||||||||||||||||||
| Bug Blocks: | |||||||||||||||||||||||||||||
| Attachments: |
|
||||||||||||||||||||||||||||
|
Description
Loris Santamaria
2025-08-13 14:49:12 UTC
Created attachment 2103509 [details]
File: proc_pid_status
Created attachment 2103510 [details]
File: maps
Created attachment 2103511 [details]
File: limits
Created attachment 2103512 [details]
File: os_info
Created attachment 2103513 [details]
File: cpuinfo
Created attachment 2103514 [details]
File: core_backtrace
Created attachment 2103515 [details]
File: exploitable
Created attachment 2103516 [details]
File: dso_list
Created attachment 2103517 [details]
File: mountinfo
Created attachment 2103518 [details]
File: backtrace
Created attachment 2103519 [details]
File: open_fds
Created attachment 2103520 [details]
File: environ
Thanks for a bug report. This looks similar as bug #1937513. From what I can see, several of your CalDAV calendars had been connecting to their server, while multiple threads had been accessing GnuTLS internals. That's something what had been supposed to be fixed within that old bug, if I recall correctly. I move this to the glib-networking for further investigation. I see some threads do wait on some condition, but not all, not from all the places. Good analysis, thanks. I see we are verifying the same gnutls_x509_trust_list 0x7fd319089520 on thread 1 (the crash thread) and thread 12 at the same time. This is indeed very similar to bug #1937513, but it's not the same because in that bug GTlsDatabase was performing the verification, whereas in this bug, it's handled by GTlsConnection instead. That changed in https://gitlab.gnome.org/GNOME/glib-networking/-/commit/d94c33138ecb12905fde400b1db41a3829ce7be9 so the original fix here didn't even last for very long. The underlying issue is a bug in GnuTLS, https://gitlab.com/gnutls/gnutls/-/issues/1212. Probably best to just fix it. Alternatively, it can probably be solved with extra mutexes in glib-networking, but that really shouldn't be required. This does not look like the same issue as bug #1937513, where I put a comment saying that the original issue was fixed in: https://gitlab.com/gnutls/gnutls/-/issues/1277 Here, the crash is happening in a PKCS#11 module itself: > crash_function: object_find_init > > Truncated backtrace: > Thread no. 1 (34 frames) > #0 object_find_init at src/lib/object.c:338 > #1 C_FindObjectsInit at src/pkcs11.c:490 > #2 find_cert_cb at ../../lib/pkcs11.c:4173 I suspect that the object_find_init function is from tpm2-pkcs11: https://github.com/tpm2-software/tpm2-pkcs11/blob/1e5b798e2f1b0b674a97bf1149d28874779a2680/src/lib/object.c#L313 which has a locking mechanism, but it is only enabled under certain conditions (CKF_OS_LOCKING_OK is set and/or locking functions are specified): https://github.com/tpm2-software/tpm2-pkcs11/blob/1e5b798e2f1b0b674a97bf1149d28874779a2680/src/lib/general.c#L173 I guess the fix would be to simply set the CKF_OS_LOCKING_OK flag in the GnuTLS; this is done for p11-kit-trust.so, but not for external modules: https://gitlab.com/gnutls/gnutls/-/blob/935505fa10e96e92f3f2d69ca6f64f0ac2726d15/lib/pkcs11.c#L412 FEDORA-2025-45b1844342 (gnutls-3.8.11-1.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2025-45b1844342 FEDORA-2025-45b1844342 has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-45b1844342` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-45b1844342 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2025-45b1844342 (gnutls-3.8.11-1.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report. |