RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1365543 - nss_pcache[5367]: segfault at 69 ip 00007f2d3866238c sp 00007ffd29786348 error 4 in libc-2.17.so[7f2d385e2000+1b6000])
Summary: nss_pcache[5367]: segfault at 69 ip 00007f2d3866238c sp 00007ffd29786348 erro...
Keywords:
Status: CLOSED DUPLICATE of bug 1364560
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: mod_nss
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: Matthew Harmsen
QA Contact: Kaleem
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-09 13:52 UTC by Sudhir Menon
Modified: 2016-08-09 15:44 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-09 15:44:29 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)
install log (200.29 KB, application/x-gzip)
2016-08-09 15:16 UTC, Sudhir Menon 		no flags Details
View All

Description Sudhir Menon 2016-08-09 13:52:59 UTC 
Description of problem: traceback created after installing ipa-server

nss_pcache[5367]: segfault at 69 ip 00007f2d3866238c sp 00007ffd29786348 error 4 in libc-2.17.so[7f2d385e2000+1b6000])


Version-Release number of selected component (if applicable):
ipa-server-dns-4.4.0-5.el7.noarch
ipa-server-common-4.4.0-5.el7.noarch
ipa-server-4.4.0-5.el7.x86_64
httpd-2.4.6-45.el7.x86_64
389-ds-base-1.3.5.10-7.el7.x86_64

How reproducible:Always


Steps to Reproduce:
1. Install ipa-server
2. ipa server is installed successfully
3. check /var/spool/abrt folder

Actual results:
1. traceback file

[New LWP 5367]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/libexec/nss_pcache 393218 off /etc/httpd/alias'.
Program terminated with signal 11, Segmentation fault.
#0  __GI___libc_free (mem=0x71) at malloc.c:2929
2929	  if (chunk_is_mmapped(p))                       /* release mmapped memory. */

Thread 1 (Thread 0x7f2d39987740 (LWP 5367)):
#0  __GI___libc_free (mem=0x71) at malloc.c:2929
        ar_ptr = <optimized out>
        p = <optimized out>
        hook = 0x0
#1  0x0000000000401ad7 in DestroyPk11PinStore ()
No symbol table info available.
#2  0x0000000000401b19 in cleanup ()
No symbol table info available.
#3  0x0000000000401505 in main ()
No symbol table info available.
From                To                  Syms Read   Shared Object Library
0x00007f2d39542ba0  0x00007f2d39567ecf  Yes         /lib64/libssl3.so
0x00007f2d393192b0  0x00007f2d3932d897  Yes         /lib64/libsmime3.so
0x00007f2d39002690  0x00007f2d390d4014  Yes         /lib64/libnss3.so
0x00007f2d38de6510  0x00007f2d38de7b38  Yes         /lib64/libplc4.so
0x00007f2d38be2090  0x00007f2d38be3028  Yes         /lib64/libplds4.so
0x00007f2d389afd10  0x00007f2d389cfc70  Yes         /lib64/libnspr4.so
0x00007f2d386013b0  0x00007f2d3874611f  Yes         /lib64/libc.so.6
0x00007f2d383c1e60  0x00007f2d383d06e8  Yes         /lib64/libnssutil3.so
0x00007f2d3819f8a0  0x00007f2d381aa784  Yes         /lib64/libpthread.so.0
0x00007f2d37f96e60  0x00007f2d37f97960  Yes         /lib64/libdl.so.2
0x00007f2d37d82170  0x00007f2d37d8e6f8  Yes (*)     /lib64/libz.so.1
0x00007f2d37b7a250  0x00007f2d37b7d04c  Yes         /lib64/librt.so.1
0x00007f2d3977aaf0  0x00007f2d39794500  Yes         /lib64/ld-linux-x86-64.so.2
0x00007f2d3793e2d0  0x00007f2d3796794c  Yes (*)     /lib64/libsoftokn3.so
0x00007f2d3768fa00  0x00007f2d377177e0  Yes (*)     /lib64/libsqlite3.so.0
0x00007f2d37409900  0x00007f2d3745e9ed  Yes (*)     /lib64/libfreeblpriv3.so
0x00007f2d371e70b0  0x00007f2d371fef68  Yes (*)     /lib64/libnssdbm3.so
0x00007f2d36fb3b00  0x00007f2d36fcb24c  Yes (*)     /etc/httpd/alias/libnssckbi.so
0x00007f2d36d96c80  0x00007f2d36da2d7c  Yes (*)     /lib64/libtasn1.so.6
0x00007f2d36b91ba0  0x00007f2d36b922f9  Yes (*)     /lib64/libfreebl3.so
(*): Shared library is missing debugging information.
$1 = 0x0
No symbol "__glib_assert_msg" in current context.
rax            0x0	0
rbx            0x1ecf2b0	32305840
rcx            0x0	0
rdx            0x0	0
rsi            0x0	0
rdi            0x71	113
rbp            0x1eeda40	0x1eeda40
rsp            0x7ffd29786348	0x7ffd29786348
r8             0x0	0
r9             0x1eebec0	32423616
r10            0x0	0
r11            0x246	582
r12            0xffffffffffffffff	-1
r13            0x1eebec0	32423616
r14            0x1ef1e20	32448032
r15            0x0	0
rip            0x7f2d3866238c	0x7f2d3866238c <__GI___libc_free+28>
eflags         0x10206	[ PF IF RF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0
st0            *value not available*
st1            *value not available*
st2            *value not available*
st3            *value not available*
st4            *value not available*
st5            *value not available*
st6            *value not available*
st7            *value not available*
fctrl          *value not available*
fstat          *value not available*
ftag           *value not available*
fiseg          *value not available*
fioff          *value not available*
foseg          *value not available*
fooff          *value not available*
fop            *value not available*
xmm0           *value not available*
xmm1           *value not available*
xmm2           *value not available*
xmm3           *value not available*
xmm4           *value not available*
xmm5           *value not available*
xmm6           *value not available*
xmm7           *value not available*
xmm8           *value not available*
xmm9           *value not available*
xmm10          *value not available*
xmm11          *value not available*
xmm12          *value not available*
xmm13          *value not available*
xmm14          *value not available*
xmm15          *value not available*
mxcsr          *value not available*
Dump of assembler code for function __GI___libc_free:
   0x00007f2d38662370 <+0>:	mov    0x339b71(%rip),%rax        # 0x7f2d3899bee8
   0x00007f2d38662377 <+7>:	mov    (%rax),%rax
   0x00007f2d3866237a <+10>:	test   %rax,%rax
   0x00007f2d3866237d <+13>:	jne    0x7f2d38662442 <__GI___libc_free+210>
   0x00007f2d38662383 <+19>:	test   %rdi,%rdi
   0x00007f2d38662386 <+22>:	je     0x7f2d38662440 <__GI___libc_free+208>
=> 0x00007f2d3866238c <+28>:	mov    -0x8(%rdi),%rax
   0x00007f2d38662390 <+32>:	lea    -0x10(%rdi),%rcx
   0x00007f2d38662394 <+36>:	test   $0x2,%al
   0x00007f2d38662396 <+38>:	jne    0x7f2d386623c0 <__GI___libc_free+80>
   0x00007f2d38662398 <+40>:	test   $0x4,%al
   0x00007f2d3866239a <+42>:	lea    0x33a3bf(%rip),%rdi        # 0x7f2d3899c760 <main_arena>
   0x00007f2d386623a1 <+49>:	je     0x7f2d386623af <__GI___libc_free+63>
   0x00007f2d386623a3 <+51>:	mov    %rcx,%rax
   0x00007f2d386623a6 <+54>:	and    $0xfffffffffc000000,%rax
   0x00007f2d386623ac <+60>:	mov    (%rax),%rdi
   0x00007f2d386623af <+63>:	xor    %edx,%edx
   0x00007f2d386623b1 <+65>:	mov    %rcx,%rsi
   0x00007f2d386623b4 <+68>:	jmpq   0x7f2d3865de10 <_int_free>
   0x00007f2d386623b9 <+73>:	nopl   0x0(%rax)
   0x00007f2d386623c0 <+80>:	mov    0x339e0e(%rip),%edx        # 0x7f2d3899c1d4 <mp_+52>
   0x00007f2d386623c6 <+86>:	test   %edx,%edx
   0x00007f2d386623c8 <+88>:	jne    0x7f2d386623f8 <__GI___libc_free+136>
   0x00007f2d386623ca <+90>:	cmp    0x339ddf(%rip),%rax        # 0x7f2d3899c1b0 <mp_+16>
   0x00007f2d386623d1 <+97>:	jbe    0x7f2d386623f8 <__GI___libc_free+136>
   0x00007f2d386623d3 <+99>:	cmp    $0x2000000,%rax
   0x00007f2d386623d9 <+105>:	ja     0x7f2d386623f8 <__GI___libc_free+136>
   0x00007f2d386623db <+107>:	and    $0xfffffffffffffff8,%rax
   0x00007f2d386623df <+111>:	lea    (%rax,%rax,1),%rdx
   0x00007f2d386623e3 <+115>:	mov    %rax,0x339dc6(%rip)        # 0x7f2d3899c1b0 <mp_+16>
   0x00007f2d386623ea <+122>:	mov    %rdx,0x339daf(%rip)        # 0x7f2d3899c1a0 <mp_>
   0x00007f2d386623f1 <+129>:	nop
   0x00007f2d386623f2 <+130>:	jmp    0x7f2d386623fc <__GI___libc_free+140>
   0x00007f2d386623f4 <+132>:	nopl   0x0(%rax)
   0x00007f2d386623f8 <+136>:	and    $0xfffffffffffffff8,%rax
   0x00007f2d386623fc <+140>:	mov    -0x10(%rdi),%rdx
   0x00007f2d38662400 <+144>:	mov    %rcx,%rdi
   0x00007f2d38662403 <+147>:	lea    (%rax,%rdx,1),%rsi
   0x00007f2d38662407 <+151>:	mov    0x339a52(%rip),%rax        # 0x7f2d3899be60
   0x00007f2d3866240e <+158>:	sub    %rdx,%rdi
   0x00007f2d38662411 <+161>:	mov    %rsi,%rdx
   0x00007f2d38662414 <+164>:	mov    0x18(%rax),%rax
   0x00007f2d38662418 <+168>:	or     %rdi,%rdx
   0x00007f2d3866241b <+171>:	sub    $0x1,%rax
   0x00007f2d3866241f <+175>:	test   %rax,%rdx
   0x00007f2d38662422 <+178>:	jne    0x7f2d38662448 <__GI___libc_free+216>
   0x00007f2d38662424 <+180>:	subl   $0x1,0x339d9d(%rip)        # 0x7f2d3899c1c8 <mp_+40>
   0x00007f2d3866242b <+187>:	sub    %rsi,0x339da6(%rip)        # 0x7f2d3899c1d8 <mp_+56>
   0x00007f2d38662432 <+194>:	jmpq   0x7f2d386d3e20 <munmap>
   0x00007f2d38662437 <+199>:	nopw   0x0(%rax,%rax,1)
   0x00007f2d38662440 <+208>:	repz retq 
   0x00007f2d38662442 <+210>:	mov    (%rsp),%rsi
   0x00007f2d38662446 <+214>:	jmpq   *%rax
   0x00007f2d38662448 <+216>:	mov    %rcx,%rdi
   0x00007f2d3866244b <+219>:	jmpq   0x7f2d38601d3f <munmap_chunk>
End of assembler dump.

2. dmesg command lists the below
[  917.746232] nss_pcache[13939]: segfault at 19 ip 00007f01cb34e38c sp 00007ffea7d7c698 error 4 in libc-2.17.so[7f01cb2ce000+1b6000]
[  953.804394] nss_pcache[14721]: segfault at 19 ip 00007f4ab311238c sp 00007ffff87f9eb8 error 4 in libc-2.17.so[7f4ab3092000+1b6000]

Expected results: traceback should be fixed which seems to be related to nss_pcache.

Additional info: System memory was 2G.
Attaching the traceback as well.
Comment 1 Rob Crittenden 2016-08-09 14:18:43 UTC 
What package version of mod_nss is this?

Can you tell the context in which the crash happened or just some time during the install? Can you attach /var/log/ipaserver-install.log?
Comment 2 Sudhir Menon 2016-08-09 15:13:51 UTC 
Rob,
The version is 

mod_nss-1.0.14-3.el7.x86_64
httpd-2.4.6-45.el7.x86_64
Comment 3 Sudhir Menon 2016-08-09 15:16:20 UTC 
Created attachment 1189307 [details]
install log
Comment 6 Rob Crittenden 2016-08-09 15:44:29 UTC 
This is caused by the semaphore leak patch. The pipe in file descriptor was being closed twice.

*** This bug has been marked as a duplicate of bug 1364560 ***
Note You need to log in before you can comment on or make changes to this bug.