OK, haven't seen this my self, I'll try and reproduce it.

(In reply to XuWang from comment #0)
> (gdb) bt
> #0  0x00007f6b0d83bd9b in __strstr_sse42 () from /lib64/libc.so.6
> #1  0x00007f6b0b003fe2 in parse_mount () from /usr/lib/autofs/parse_sun.so
> #2  0x00007f6b0a18b0a9 in lookup_mount () from /usr/lib/autofs/lookup_file.so
> #3  0x00007f6b0ebf7523 in ?? ()
> #4  0x00007f6b0ebf7f2e in lookup_nss_mount ()
> #5  0x00007f6b0ebee802 in ?? ()
> #6  0x00007f6b0e79fdf3 in start_thread () from /lib64/libpthread.so.0
> #7  0x00007f6b0d7fe05d in clone () from /lib64/libc.so.6
> (gdb)

Not really useful with no line numbers in the backtrace.
The debuginfo package was probably not installed.

snip ...

> 
> Atachment including the maps for testing, the file autoparse is the sequence
> for opendir, the result is the succesfully opened dirs, the bad.version and
> the bad.version is the info I got by "readelf -a" from the old parse_sun.so
> and new parse_sun.so, the file parse_sun.so is the original(bad) installed
> in distro. 

I'll have a look.
Did you include the output from the connectathon run?
 
> 
> Version-Release number of selected component (if applicable):
> distro RHEL-7.1-20141105.n.0
> RHEL-7.1-20141028.n.0
> autofs-5.0.7-47.el7.x86_64 in RHEL-7.1-20141105.n.0

OK.

> 
> How reproducible:
> 
> always in x86_64
> 
> Steps to Reproduce:
> 1.run qe test case "autofs-CoreOs-autofs-contentathon"
> 2.wait for timeout and see the system message
> 3.automount[36194]: segfault at 0 ip 00007fdd9ae53d9b sp 00007fdd9c1c73b8
> error 4 in libc-2.17.so[7fdd9ad20000+1b6000]

Right.

Ian

(In reply to XuWang from comment #0)
> 
> So there maybe someing wrong with the parse_sun.so in distros, I also do
> some analysis, but found nothing. To strack it that, I report this as a bug
> with hoping somebody tell me why.

I wonder if there was something wrong with the build
environment. Due to sssd changes I had to build with
a couple of overrides but that shouldn't show up as a
problem like this .....

Ian

What's this:

for test in test.*; do
    rlPhaseStartTest ${TEST}-$role-Test-$test
        run "./$test"
    rlPhaseEnd
done

I've mentioned you can't do this before.
The setup for a couple of the tests isn't present in this
test.

This doesn't relate to the bug but I thought it worth mentioning.
Ian

Created attachment 954966 [details]
automount core file and binary files

I download the autofs-debug package and reproduce it again, and the stack dumps as below:
(gdb) up
#1  0x00007f97c7b9bfe2 in parse_mount (ap=0x7f97d0ace240, name=<optimized out>, name_len=<optimized out>, mapent=<optimized out>, context=<optimized out>) at parse_sun.c:1423
1423					if (!(strstr(myoptions, "fstype=autofs") &&
(gdb) l
1418				p += l;
1419				p = skipspace(p);
1420	
1421				l = parse_mapent(p, options, &myoptions, &loc, ap->logopt);
1422				if (!l) {
1423					if (!(strstr(myoptions, "fstype=autofs") &&
1424					      strstr(myoptions, "hosts"))) {
1425						cache_delete_offset_list(mc, name);
1426						cache_multi_unlock(me);
1427						cache_unlock(mc);
(gdb) ^Z

I also read code of parse_sun.c, I think the function parse_mapent should initialize the param options firstly(such as *options = NULL), becuase if there something wrong and parse_mapend return 0 and myoptions will get uninitialized value.

I'll also upload the core file(attachment 954966 [details]) and autmount in RHEL-7.1-20141105.n.0 for your further analysis.

And thanks your sugesstion, the connectathon test cases is not finished, I am just working on it. I will discuss your advice with the former autofs qe and make it work more robust. Besides, the setup for all tests is finished by runtest.sh in the case, and the runtest.sh called setup in cthon_automount/bin/setup to finish some work.

(In reply to XuWang from comment #7)
> I download the autofs-debug package and reproduce it again, and the stack
> dumps as below:

OK, thanks for this information, I hope to get to this Monday.

snip ...

> 
> And thanks your sugesstion, the connectathon test cases is not finished, I
> am just working on it. I will discuss your advice with the former autofs qe
> and make it work more robust. Besides, the setup for all tests is finished
> by runtest.sh in the case, and the runtest.sh called setup in
> cthon_automount/bin/setup to finish some work.

The issue is that there are a couple of tests (the net tests) that
that need a nis server with maps setup for the the test to work but
the test doesn't set them up. There are examples of nis server setup
in a number of test in the bugzillas subdirectories if your interested.

The tests that can be run with the existing setup are those that
correspond to "./runtests -b", the so called basic tests (which
aren't really basic at all).

Ian

(In reply to XuWang from comment #7)
> 
> I also read code of parse_sun.c, I think the function parse_mapent should
> initialize the param options firstly(such as *options = NULL), becuase if
> there something wrong and parse_mapend return 0 and myoptions will get
> uninitialized value.

Perhaps but this is a programming error.
Have a look at the attached upstream patch I made after looking
at the code.

Ina

Created attachment 955677 [details]
Patch - fix incorrect check in parse_mount()

Untested as yet.

I'm still thinking about this though, I probably made that change
for a reason so the resolution might not be as simple as the above
patch.

(In reply to Ian Kent from comment #9)
> (In reply to XuWang from comment #7)
> > 
> > I also read code of parse_sun.c, I think the function parse_mapent should
> > initialize the param options firstly(such as *options = NULL), becuase if
> > there something wrong and parse_mapend return 0 and myoptions will get
> > uninitialized value.
> 
> Perhaps but this is a programming error.
> Have a look at the attached upstream patch I made after looking
> at the code.

And options is initialized earlier:
options = strdup(ctxt->optstr ? ctxt->optstr : "");

(In reply to Ian Kent from comment #8)
> The issue is that there are a couple of tests (the net tests) that
> that need a nis server with ...
Yes, and that is the work I must do :)
My next week plan is to modify the connectathon to add the nis support. And of course, I will learn the way from the your test cases(bugzillas).

(In reply to Ian Kent from comment #12)
> And options is initialized earlier:
> options = strdup(ctxt->optstr ? ctxt->optstr : "");
yes, options is initialized , but myoptions is not.

//here parse_mapent can return 0 with uninitialized myoptions 
1421                         l = parse_mapent(p, options, &myoptions, &loc, ap->logopt);

//here the strstr use myoptions as input. if the myoptions is random value for an invalid address, segment fault will happen
1423                                 if (!(strstr(myoptions, "fstype=autofs") &&
1424                                       strstr(myoptions, "hosts"))) {

And your patch removed the "if (!(strstr(myoptions, "fstype=autofs")...", you must have reason to add the if setence embraced the "
1425                                         cache_delete_offset_list(mc, name);
1426                                         cache_multi_unlock(me);
1427                                         cache_unlock(mc);
1428                                         free(path);
1429                                         free(options);
1430                                         pthread_setcancelstate(cur_state, NULL);
1431                                         return 1;".

So why don't you use options(which is already initialized) instead of myoptions to judge the "fstype=autofs"?

(In reply to XuWang from comment #13)
> 
> (In reply to Ian Kent from comment #12)
> > And options is initialized earlier:
> > options = strdup(ctxt->optstr ? ctxt->optstr : "");
> yes, options is initialized , but myoptions is not.

Sure, but if parse_mapent() returns 0 the myoptions will be
invalid regardless of whether it was initialized.

> 
> //here parse_mapent can return 0 with uninitialized myoptions 
> 1421                         l = parse_mapent(p, options, &myoptions, &loc,
> ap->logopt);
> 
> //here the strstr use myoptions as input. if the myoptions is random value
> for an invalid address, segment fault will happen
> 1423                                 if (!(strstr(myoptions,
> "fstype=autofs") &&
> 1424                                       strstr(myoptions, "hosts"))) {
> 
> And your patch removed the "if (!(strstr(myoptions, "fstype=autofs")...",
> you must have reason to add the if setence embraced the "
> 1425                                         cache_delete_offset_list(mc,
> name);
> 1426                                         cache_multi_unlock(me);
> 1427                                         cache_unlock(mc);
> 1428                                         free(path);
> 1429                                         free(options);
> 1430                                        
> pthread_setcancelstate(cur_state, NULL);
> 1431                                         return 1;".
> 
> So why don't you use options(which is already initialized) instead of
> myoptions to judge the "fstype=autofs"?

Perhaps, I'll need to think about it a little more.

Ian

Created attachment 1029324 [details]
Patch - fix incorrect check in parse_mount()

run /autofs/connectathon for autofs-5.0.7-53.el7, covers x86_64, pc64, s390x, no automount core dump:
do-client-Test-test-badnames PASSED
do-client-Test-test-net      PASSED
do-client-Test-test-net1     PASSED
do-client-Test-test-parser   FAILED according to case problem
do-client-Test-test-parser-n PASSED
do-client-Test-test-proto-check PASSED
do-client-Test-test-test1    FAILED according to case problem
do-client-Test-test-test2    PASSED
do-client-Test-test-test3    FAILED according to case problem
do-client-Test-test-test4    PASSED
do-client-Test-test-test5    PASSED
do-client-Test-test-trailing-space  PASSED
do-client-Test-test-vers-check      PASSED

3 sub-test failed according the new feature that autofs allows duplicate entries.

Also run regressions, bugzillas, stress for autofs, seems good.

Now I will put this status of bug to be verified.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2417.html