Bug 822676

Summary: [abrt] tcsh-6.17-18.fc17: __GI_raise: Process /usr/bin/tcsh was killed by signal 6 (SIGABRT)
Product: [Fedora] Fedora Reporter: Brian Johnson <voyager.106>
Component: ncursesAssignee: Miroslav Lichvar <mlichvar>
Status: CLOSED DUPLICATE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 17CC: mlichvar, phil_g
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Unspecified   
Whiteboard: abrt_hash:885c5a8dd539942c5f0f2223ae158219e9f6d8cc
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2013-04-15 12:35:28 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
File: environ
none
File: backtrace none

Description Brian Johnson 2012-05-17 18:21:13 UTC
libreport version: 2.0.10
abrt_version:   2.0.10
backtrace_rating: 4
cmdline:        -bin/tcsh
comment:        Tried to use 'screen' in my xterm as myself (not root) and received the message that tcsh had crashed. This goes with bug https://bugzilla.redhat.com/show_bug.cgi?id=813607
crash_function: __GI_raise
executable:     /usr/bin/tcsh
kernel:         3.3.5-2.fc16.i686.PAE
pid:            2864
pwd:            /home/mbjohn
remote_result:  NOTFOUND
time:           Tue 15 May 2012 06:57:01 PM EDT
uid:            1000
username:       mbjohn

backtrace:      Text file, 9610 bytes
environ:        Text file, 4530 bytes

build_ids:
:95ff314f610eb37745b0e3175eb802188476fe8a
:657bed8df5cfda1d7eb24a25a043cfbdf228b933
:80d17794a91edd0122dbe55f2cd49bd4badeb2ac
:8b8fc79f6d14471ef212188db7d5b8e916825c88
:ff3623d0e283740b0518e56f96041d9151d041b7
:55f74def006b96ec11adb895d30e4608864457ea
:09204ae134bd8d05bce65bb6e9e6fd68d6bbb3f1

cgroup:
:9:perf_event:/
:8:blkio:/
:7:net_cls:/
:6:freezer:/
:5:devices:/
:4:memory:/
:3:cpuacct,cpu:/
:2:cpuset:/
:1:name=systemd:/user/mbjohn/2

core_backtrace:
:83d613cc2f553219b35c3d1f31d4faf0e1ef4a3e 0x424 __kernel_vsyscall linux-gate.so.1 -
:09204ae134bd8d05bce65bb6e9e6fd68d6bbb3f1 0x2e91f raise libc.so.6 -
:09204ae134bd8d05bce65bb6e9e6fd68d6bbb3f1 0x30273 abort libc.so.6 -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x3cdf2 free [exe] -
:8b8fc79f6d14471ef212188db7d5b8e916825c88 0x802d - libtinfo.so.5 -
:8b8fc79f6d14471ef212188db7d5b8e916825c88 0x8152 _nc_last_db libtinfo.so.5 -
:8b8fc79f6d14471ef212188db7d5b8e916825c88 0xf771 _nc_read_entry libtinfo.so.5 -
:8b8fc79f6d14471ef212188db7d5b8e916825c88 0xacf6 _nc_setup_tinfo libtinfo.so.5 -
:8b8fc79f6d14471ef212188db7d5b8e916825c88 0xb0c9 _nc_setupterm libtinfo.so.5 -
:8b8fc79f6d14471ef212188db7d5b8e916825c88 0xb501 tgetent libtinfo.so.5 -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x364e5 - [exe] -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x37935 - [exe] -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x21092 - [exe] -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x2152c - [exe] -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x49e7 - [exe] -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x52da - [exe] -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x564d - [exe] -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x56bc - [exe] -
:95ff314f610eb37745b0e3175eb802188476fe8a 0x3a75 - [exe] -

dso_list:
:/usr/lib/libfreebl3.so nss-softokn-freebl-3.13.4-2.fc17.i686 (Fedora Project) 1337004982
:/usr/lib/libcrypt-2.15.so glibc-2.15-35.fc17.i686 (Fedora Project) 1337005003
:/usr/lib/locale/locale-archive glibc-common-2.15-35.fc17.i686 (Fedora Project) 1337004994
:/usr/lib/libc-2.15.so glibc-2.15-35.fc17.i686 (Fedora Project) 1337005003
:/usr/lib/gconv/gconv-modules.cache glibc-2.15-35.fc17.i686 (Fedora Project) 1337005003
:/usr/share/locale/en/LC_MESSAGES/tcsh tcsh-6.17-18.fc17.i686 (Fedora Project) 1337009394
:/usr/bin/tcsh tcsh-6.17-18.fc17.i686 (Fedora Project) 1337009394
:/usr/lib/libdl-2.15.so glibc-2.15-35.fc17.i686 (Fedora Project) 1337005003
:/usr/lib/ld-2.15.so glibc-2.15-35.fc17.i686 (Fedora Project) 1337005003
:/usr/lib/libtinfo.so.5.9 ncurses-libs-5.9-4.20120204.fc17.i686 (Fedora Project) 1337005005

limits:
:Limit                     Soft Limit           Hard Limit           Units     
:Max cpu time              unlimited            unlimited            seconds   
:Max file size             unlimited            unlimited            bytes     
:Max data size             unlimited            unlimited            bytes     
:Max stack size            8388608              unlimited            bytes     
:Max core file size        0                    unlimited            bytes     
:Max resident set          unlimited            unlimited            bytes     
:Max processes             1024                 28159                processes 
:Max open files            1024                 4096                 files     
:Max locked memory         65536                65536                bytes     
:Max address space         unlimited            unlimited            bytes     
:Max file locks            unlimited            unlimited            locks     
:Max pending signals       28159                28159                signals   
:Max msgqueue size         819200               819200               bytes     
:Max nice priority         0                    0                    
:Max realtime priority     0                    0                    
:Max realtime timeout      unlimited            unlimited            us        

maps:
:08048000-080a1000 r-xp 00000000 fd:02 809017     /usr/bin/tcsh
:080a1000-080a2000 r--p 00058000 fd:02 809017     /usr/bin/tcsh
:080a2000-080a6000 rw-p 00059000 fd:02 809017     /usr/bin/tcsh
:080a6000-080ba000 rw-p 00000000 00:00 0 
:08b9f000-08cdb000 rw-p 00000000 00:00 0          [heap]
:4750d000-4752c000 r-xp 00000000 fd:02 801739     /usr/lib/ld-2.15.so
:4752c000-4752d000 r--p 0001e000 fd:02 801739     /usr/lib/ld-2.15.so
:4752d000-4752e000 rw-p 0001f000 fd:02 801739     /usr/lib/ld-2.15.so
:47534000-476dc000 r-xp 00000000 fd:02 801740     /usr/lib/libc-2.15.so
:476dc000-476de000 r--p 001a8000 fd:02 801740     /usr/lib/libc-2.15.so
:476de000-476df000 rw-p 001aa000 fd:02 801740     /usr/lib/libc-2.15.so
:476df000-476e2000 rw-p 00000000 00:00 0 
:4772d000-47730000 r-xp 00000000 fd:02 801741     /usr/lib/libdl-2.15.so
:47730000-47731000 r--p 00002000 fd:02 801741     /usr/lib/libdl-2.15.so
:47731000-47732000 rw-p 00003000 fd:02 801741     /usr/lib/libdl-2.15.so
:4829c000-482e6000 r-xp 00000000 fd:02 801903     /usr/lib/libfreebl3.so
:482e6000-482e7000 r--p 0004a000 fd:02 801903     /usr/lib/libfreebl3.so
:482e7000-482e8000 rw-p 0004b000 fd:02 801903     /usr/lib/libfreebl3.so
:482e8000-482ec000 rw-p 00000000 00:00 0 
:482ee000-482f6000 r-xp 00000000 fd:02 801904     /usr/lib/libcrypt-2.15.so
:482f6000-482f7000 r--p 00007000 fd:02 801904     /usr/lib/libcrypt-2.15.so
:482f7000-482f8000 rw-p 00008000 fd:02 801904     /usr/lib/libcrypt-2.15.so
:482f8000-4831f000 rw-p 00000000 00:00 0 
:48eee000-48f0b000 r-xp 00000000 fd:02 801787     /usr/lib/libtinfo.so.5.9
:48f0b000-48f0d000 r--p 0001c000 fd:02 801787     /usr/lib/libtinfo.so.5.9
:48f0d000-48f0e000 rw-p 0001e000 fd:02 801787     /usr/lib/libtinfo.so.5.9
:b75cc000-b77cc000 r--p 00000000 fd:02 2752548    /usr/lib/locale/locale-archive
:b77cc000-b77ce000 rw-p 00000000 00:00 0 
:b77d9000-b77e0000 r--s 00000000 fd:02 814073     /usr/lib/gconv/gconv-modules.cache
:b77e0000-b77ec000 r--p 00000000 fd:02 550297     /usr/share/locale/en/LC_MESSAGES/tcsh
:b77ec000-b77ed000 rw-p 00000000 00:00 0 
:b77ed000-b77ee000 r-xp 00000000 00:00 0          [vdso]
:bfbc2000-bfbe4000 rw-p 00000000 00:00 0          [stack]

open_fds:
:0:/dev/pts/13
:pos:	0
:flags:	02
:1:/dev/pts/13
:pos:	0
:flags:	02
:2:/dev/pts/13
:pos:	0
:flags:	02

smolt_data:
:
:
:General
:=================================
:UUID: 79a32020-4865-49a6-b180-78efe42df659
:OS: Fedora release 17 (Beefy Miracle)
:Default run level: Unknown
:Language: en_US.UTF-8
:Platform: i686
:BogoMIPS: 5986.77
:CPU Vendor: GenuineIntel
:CPU Model: Intel(R) Pentium(R) D CPU 3.00GHz
:CPU Stepping: 4
:CPU Family: 15
:CPU Model Num: 6
:Number of CPUs: 2
:CPU Speed: 3000
:System Memory: 3537
:System Swap: 5567
:Vendor: Dell Inc.
:System: OptiPlex GX620 
:Form factor: Mini Tower
:Kernel: 3.3.5-2.fc16.i686.PAE
:SELinux Enabled: 0
:SELinux Policy: targeted
:SELinux Enforce: Unknown
:MythTV Remote: Unknown
:MythTV Role: Unknown
:MythTV Theme: Unknown
:MythTV Plugin: 
:MythTV Tuner: -1
:
:
:Devices
:=================================
:(4486:19456:4486:19456) pci, skge, ETHERNET, DGE-530T Gigabit Ethernet Adapter
:(32902:10168:0:0) pci, None, PCI/ISA, 82801GB/GR (ICH7 Family) LPC Interface Bridge
:(32902:10202:4136:429) pci, i801_smbus, SERIAL, OptiPlex GX620
:(32902:10176:4136:429) pci, ata_piix, STORAGE, OptiPlex GX620
:(32902:10192:0:0) pci, pcieport, PCI/PCI, N10/ICH 7 Family PCI Express Port 1
:(32902:10194:0:0) pci, pcieport, PCI/PCI, N10/ICH 7 Family PCI Express Port 2
:(32902:10207:4136:429) pci, ata_piix, STORAGE, 82801G (ICH7 Family) IDE Controller
:(32902:9294:0:0) pci, None, PCI/PCI, 82801 PCI Bridge
:(32902:10206:4136:429) pci, snd_intel8x0, MULTIMEDIA_AUDIO, OptiPlex GX620
:(4318:1026:6510:1081) pci, nouveau, VIDEO, G84 [GeForce 8600 GT]
:(32902:10185:4136:429) pci, uhci_hcd, USB, OptiPlex GX620
:(32902:10184:4136:429) pci, uhci_hcd, USB, OptiPlex GX620
:(32902:10096:4136:429) pci, None, HOST/PCI, OptiPlex GX620
:(32902:10186:4136:429) pci, uhci_hcd, USB, OptiPlex GX620
:(32902:10187:4136:429) pci, uhci_hcd, USB, OptiPlex GX620
:(32902:10188:4136:429) pci, ehci_hcd, USB, OptiPlex GX620
:(32902:10097:32902:0) pci, pcieport, PCI/PCI, 82945G/GZ/P/PL PCI Express Root Port
:
:
:Filesystem Information
:=================================
:device mtpt type bsize frsize blocks bfree bavail file ffree favail
:-------------------------------------------------------------------
:/dev/mapper/vg_scorponok-lv_root / ext4 4096 4096 13081819 10286673 9631313 3276800 2935627 2935627
:/dev/sda1 /boot ext4 1024 1024 508745 406096 380496 128016 127714 127714
:/dev/mapper/vg_scorponok-lv_home /home ext4 4096 4096 24357763 5023451 3803663 6103040 5756413 5756413
:/dev/sdc2 WITHHELD ext4 UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN
:/dev/sdc1 WITHHELD fuseblk UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN UNKNOWN
:

var_log_messages:
:May 14 13:24:28 scorponok abrt[2299]: Saved core dump of pid 2268 (/usr/bin/tcsh) to /var/spool/abrt/ccpp-2012-05-14-13:24:26-2268 (1654784 bytes)
:May 14 15:05:03 scorponok abrt[2923]: Saved core dump of pid 2910 (/usr/bin/tcsh) to /var/spool/abrt/ccpp-2012-05-14-15:05:02-2910 (1658880 bytes)
:May 15 18:57:01 scorponok abrt[2877]: Saved core dump of pid 2864 (/usr/bin/tcsh) to /var/spool/abrt/ccpp-2012-05-15-18:57:01-2864 (1658880 bytes)

Comment 1 Brian Johnson 2012-05-17 18:21:17 UTC
Created attachment 585296 [details]
File: environ

Comment 2 Brian Johnson 2012-05-17 18:21:18 UTC
Created attachment 585297 [details]
File: backtrace

Comment 3 Phil! Gold 2012-12-20 13:40:13 UTC
There appears to be a bug in tcsh or ncurses that triggers when you set
$TERM from the shell's initscript (.cshrc or .tcshrc).  This particular
problem was generated (and can be reproducrd) by starting tcsh with a
.cshrc containing one line:

    setenv TERM vt100

The problem does not occur when using bash, sh, ksh, or zsh.  It does not
occur when setting $TERM from the interactive command line.  The problem
does not seem to be specific to the new value of $TERM; I have reproduced
it with "vt100", "xterm", "screen", "xterm-256color", and "xterm-color".
It only occurs if the value of $TERM actually changes, so if $TERM is
already set to "vt100", you'll have to use a different value in your
.cshrc, like "xterm".

Here's an strace of tcsh in the time period around the problem:

open("/users/phil/.tcshrc", O_RDONLY)   = -1 ENOENT (No such file or directory)
open("/users/phil/.cshrc", O_RDONLY)    = 0
dup(0)                                  = 1
dup(1)                                  = 2
dup(2)                                  = 3
dup(3)                                  = 4
dup(4)                                  = 5
dup(5)                                  = 6
close(5)                                = 0
close(4)                                = 0
close(3)                                = 0
close(2)                                = 0
close(1)                                = 0
close(0)                                = 0
fcntl(6, F_SETFD, FD_CLOEXEC)           = 0
fstat(6, {st_mode=S_IFREG|0600, st_size=18, ...}) = 0
ioctl(6, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, 0x7fffedc14ee0) = -1 ENOTTY (Inappropriate ioctl for device)
read(6, "setenv TERM xterm\n", 4096)    = 18
lseek(6, 0, SEEK_CUR)                   = 18
alarm(0)                                = 0
close(0)                                = -1 EBADF (Bad file descriptor)
dup(19)                                 = 0
fcntl(0, F_SETFD, 0)                    = 0
close(1)                                = -1 EBADF (Bad file descriptor)
dup(17)                                 = 1
fcntl(1, F_SETFD, 0)                    = 0
close(2)                                = -1 EBADF (Bad file descriptor)
dup(18)                                 = 2
fcntl(2, F_SETFD, 0)                    = 0
rt_sigprocmask(SIG_BLOCK, [WINCH], [], 8) = 0
ioctl(1, SNDCTL_TMR_TIMEBASE or SNDRV_TIMER_IOCTL_NEXT_DEVICE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
access("/etc/terminfo/x/xterm", R_OK)   = -1 ENOENT (No such file or directory)
access("/usr/share/terminfo/x/xterm", R_OK) = 0
open("/usr/share/terminfo/x/xterm", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=3358, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7ff3c300c000
read(3, "\32\0010\0&\0\17\0\235\1l\5xterm|xterm terminal"..., 4096) = 3358
read(3, "", 4096)                       = 0
brk(0)                                  = 0x1af9800
brk(0)                                  = 0x1af9800
brk(0x1afa800)                          = 0x1afa800
brk(0)                                  = 0x1afa800
brk(0)                                  = 0x1afa800
brk(0x1afb000)                          = 0x1afb000
close(3)                                = 0
munmap(0x7ff3c300c000, 4096)            = 0
write(1, "free(19eb811) bad block. (memtop"..., 65) = 65
rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
tgkill(6116, 6116, SIGABRT)             = 0
--- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, si_pid=6116, si_uid=1639} ---
+++ killed by SIGABRT (core dumped) +++


backtrace_rating: 4
Package: tcsh-6.17-18.fc17
Architecture: x86_64
OS Release: Fedora release 17 (Beefy Miracle)

Comment 4 Phil! Gold 2012-12-20 15:52:36 UTC
As a further note, this problem is definitely related to ncurses.  If I install the ncurses-libs package from Fedora 16 (version 5.9-2.20110716), tcsh works as expected with "setenv TERM ..." in its .cshrc.  The ncurses version in Fedora 17 (5.9-4.20120204) is the only one that shows the problem.

I still don't know whether this should be classified as a tcsh or ncurses bug, as I've only seen it so far from tcsh and not from anything else that uses ncurses.

Comment 5 Phil! Gold 2012-12-20 17:04:14 UTC
Also (and sorry for the extra messages), if I have the Fedora 17 ncurses libraries installed every Fedora-packaged tcsh 6.17 package exhibits the problem, all the way back to Fedora 12's 6.17-5.  The tcsh 6.15-9 package in Fedora 11 does not have this problem.

Comment 6 Phil! Gold 2013-01-11 14:26:48 UTC
Furthermore, I've just discovered that the problem only appears to manifest on 64-bit systems.  I cannot reproduce on a Fedora 17 32-bit install I just did.

Comment 7 Fedora Admin XMLRPC Client 2013-03-26 16:50:49 UTC
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 8 Fedora Admin XMLRPC Client 2013-03-27 08:19:52 UTC
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.

Comment 9 FridolĂ­n PokornĂ˝ 2013-04-15 12:29:26 UTC
This bug is probably caused by ncurses. I have tested this issue and it
occurs only if cache_expired() is called. It crashes inside ncurses with bad
free. It was probably fixed meanwhile, because I cannot reproduce this problem
on f18+.

The bug can be reproduced on f17 x86_64 (with setenv TERM vt100 in ~/.cshrc),
i686 looks ok for me.

Comment 10 Miroslav Lichvar 2013-04-15 12:35:28 UTC
Thanks for the analysis. It looks identical to bug #854351.

*** This bug has been marked as a duplicate of bug 854351 ***