Bug 1069079 - crash when linking libgnutls and libmysqlclient
Summary: crash when linking libgnutls and libmysqlclient
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: trousers
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Steve Grubb
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 1064300
TreeView+ depends on / blocked
 
Reported: 2014-02-24 05:56 UTC by Ken Dreyer
Modified: 2014-04-21 16:39 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2014-03-18 21:00:00 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
Proposed fix (674 bytes, text/plain)
2014-02-28 11:16 UTC, Nikos Mavrogiannopoulos
no flags Details


Links
System ID Private Priority Status Summary Last Updated
Red Hat Bugzilla 1071685 0 unspecified CLOSED crash when linking libtspi and libmysqlclient 2021-02-22 00:41:40 UTC

Internal Links: 1071171 1071685 1224558

Description Ken Dreyer 2014-02-24 05:56:43 UTC
Description of problem:
A trivial program that links against both libmysqlclient and libgnutls will crash with a segfault.

Version-Release number of selected component (if applicable):
gnutls-devel-3.2.10-2.fc21
1:mariadb-devel-5.5.35-4.fc21

How reproducible:
$ cat test.c
int main ()
{
  return 0;
}

$ gcc -o test -L/usr/lib64/mysql test.c -lmysqlclient -lgnutls

$ ./test
Segmentation fault (core dumped)

backgrace in GBD:

d 1 (Thread 0x7ffff7f9f940 (LWP 25172)):
#0  0x00007ffff7301384 in pthread_mutex_lock () from /lib64/libpthread.so.0
#1  0x00007fffe25d9bb4 in host_table_final () from /lib64/libtspi.so.1
#2  0x00007ffff7deb30a in _dl_fini () from /lib64/ld-linux-x86-64.so.2
#3  0x00007ffff0fd28b9 in __run_exit_handlers () from /lib64/libc.so.6
#4  0x00007ffff0fd2905 in exit () from /lib64/libc.so.6
#5  0x00007ffff0fb9e9c in __libc_start_main () from /lib64/libc.so.6
#6  0x0000000000400879 in _start ()


Actual results:
The program segfaults.

Expected results:
The program should exit normally.

Additional info:
I found this because XBMC's build process does something like this:
  gcc -o test -L/usr/lib64/mysql test.c -lmysqlclient -lavfilter
and libavfilter pulls in libgnutls.

Comment 1 Nikos Mavrogiannopoulos 2014-02-24 08:39:00 UTC
The crash is on libtspi (which is used by gnutls). I can reproduce it as:
gcc test.c  -L/usr/lib64/mysql -lmysqlclient -ltspi 

Interesting enough if the test is compiled as:
gcc test.c -ltspi  -L/usr/lib64/mysql -lmysqlclient

there is no crash. So the issue seems related to tspi's library destructor conflicting with something in libmysqlclient. As the crash is on the mutex, my guess would be some uninitialized mutex or something like that.

I'm assigning the issue to trousers.

Comment 2 Nikos Mavrogiannopoulos 2014-02-24 08:40:49 UTC
Here is a backtrace with debugging symbols included:

==3836== Invalid read of size 4
==3836==    at 0x3942009FE0: pthread_mutex_lock (pthread_mutex_lock.c:66)
==3836==    by 0x31CFE22BC3: host_table_final (hosttable.c:54)
==3836==    by 0x394140F8E9: _dl_fini (dl-fini.c:252)
==3836==    by 0x39418394C8: __run_exit_handlers (exit.c:82)
==3836==    by 0x3941839514: exit (exit.c:104)
==3836==    by 0x3941821D6B: (below main) (libc-start.c:319)
==3836==  Address 0x18 is not stack'd, malloc'd or (recently) free'd
==3836== 
==3836== 
==3836== Process terminating with default action of signal 11 (SIGSEGV)
==3836==  Access not within mapped region at address 0x18
==3836==    at 0x3942009FE0: pthread_mutex_lock (pthread_mutex_lock.c:66)
==3836==    by 0x31CFE22BC3: host_table_final (hosttable.c:54)
==3836==    by 0x394140F8E9: _dl_fini (dl-fini.c:252)
==3836==    by 0x39418394C8: __run_exit_handlers (exit.c:82)
==3836==    by 0x3941839514: exit (exit.c:104)
==3836==    by 0x3941821D6B: (below main) (libc-start.c:319)

Comment 3 Nikos Mavrogiannopoulos 2014-02-28 11:16:43 UTC
Created attachment 868989 [details]
Proposed fix

It seems that the issue is in the name of the constructors/destructors. Both mysqlclient and tspi use the name "my_init", and the one responsible for calling them, is probably confused and doesn't call both.

The attached patch marks the tspi's constructor and destructor as static, thus eliminating the issue.

Comment 4 Nikos Mavrogiannopoulos 2014-02-28 11:29:47 UTC
Reported upstream as: https://sourceforge.net/p/trousers/bugs/172/

Comment 5 Ken Dreyer 2014-03-14 01:46:12 UTC
Thanks very much Nikos. Would you mind pushing a build to Fedora Rawhide (F21) and Fedora 20 with the patch? This should allow us to build XBMC.

Comment 6 Steve Grubb 2014-03-18 21:00:00 UTC
Patch applied in trousers-0.3.11.2-3.fc21. Thanks for reporting the issue and supplying a patch.

Comment 7 Volker Fröhlich 2014-03-23 16:29:07 UTC
Fedora 20 too, please!

Comment 8 Fedora Update System 2014-03-25 21:07:36 UTC
trousers-0.3.11.2-3.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/trousers-0.3.11.2-3.fc20

Comment 9 Steve Grubb 2014-03-26 02:58:10 UTC
In reply to comment#7, done.

Comment 10 Fedora Update System 2014-04-04 09:40:15 UTC
trousers-0.3.11.2-3.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.