Bug 140526 - bash in /chroot/mldonkey from atrpms seg fault after upgrade from fc2 to fc3
bash in /chroot/mldonkey from atrpms seg fault after upgrade from fc2 to fc3
Status: CLOSED NOTABUG
Product: Fedora
Classification: Fedora
Component: bash (Show other bugs)
3
i686 Linux
medium Severity high
: ---
: ---
Assigned To: Tim Waugh
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2004-11-23 08:40 EST by Wesley Tanaka
Modified: 2007-11-30 17:10 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2004-11-29 08:34:30 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
/etc/rc.d/init.d/mldonkey script which creates chroot environment (3.75 KB, text/plain)
2004-11-23 08:46 EST, Wesley Tanaka
no flags Details
sudo strace chroot /chroot/mldonkey /bin/bash |& tee /tmp/log.txt (4.31 KB, text/plain)
2004-11-23 22:15 EST, Wesley Tanaka
no flags Details

  None (edit)
Description Wesley Tanaka 2004-11-23 08:40:23 EST
From Bugzilla Helper:
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7)
Gecko/20040707 Firefox/0.8

Description of problem:
chroot (or bash) segfaults when trying to chroot into a
/chroot/mldonkey directory as created by the
mldonkey-backend-2.5.28-41.rhfc3.at rpm from atrpms.

The contents of the directory include:

/chroot/mldonkey
/chroot/mldonkey/.mldonkey
/chroot/mldonkey/.mldonkey/mlnet_strings.en
/chroot/mldonkey/etc
/chroot/mldonkey/etc/gshadow
/chroot/mldonkey/etc/hosts
/chroot/mldonkey/etc/ld.so.cache
/chroot/mldonkey/etc/resolv.conf
/chroot/mldonkey/etc/localtime
/chroot/mldonkey/etc/nsswitch.conf
/chroot/mldonkey/etc/group
/chroot/mldonkey/etc/passwd
/chroot/mldonkey/etc/ld.so.conf
/chroot/mldonkey/etc/shadow
/chroot/mldonkey/usr
/chroot/mldonkey/usr/lib
/chroot/mldonkey/usr/lib/libz.so.1.2.1.1
/chroot/mldonkey/usr/lib/mldonkey
/chroot/mldonkey/usr/lib/mldonkey/mlnet
/chroot/mldonkey/usr/lib/libz.so.1.2.1.2
/chroot/mldonkey/usr/lib/libz.so.1
/chroot/mldonkey/bin
/chroot/mldonkey/bin/bash
/chroot/mldonkey/bin/sh
/chroot/mldonkey/lib
/chroot/mldonkey/lib/libnss_files.so.2
/chroot/mldonkey/lib/ld-linux.so.2
/chroot/mldonkey/lib/libnss1_dns.so.1
/chroot/mldonkey/lib/libresolv-2.3.3.so
/chroot/mldonkey/lib/libnss_dns.so.2
/chroot/mldonkey/lib/libnss_dns.so.1
/chroot/mldonkey/lib/libnss_files-2.3.3.so
/chroot/mldonkey/lib/tls
/chroot/mldonkey/lib/tls/libc.so.6
/chroot/mldonkey/lib/tls/libm.so.6
/chroot/mldonkey/lib/tls/libpthread-0.61.so
/chroot/mldonkey/lib/tls/libpthread-2.3.3.so
/chroot/mldonkey/lib/tls/libpthread.so.0
/chroot/mldonkey/lib/tls/libm-2.3.3.so
/chroot/mldonkey/lib/tls/libc-2.3.3.so
/chroot/mldonkey/lib/libtermcap.so.2.0.8
/chroot/mldonkey/lib/libnss1_files.so.1
/chroot/mldonkey/lib/libtermcap.so.2
/chroot/mldonkey/lib/libnss_files.so.1
/chroot/mldonkey/lib/ld-2.3.3.so
/chroot/mldonkey/lib/libdl-2.3.3.so
/chroot/mldonkey/lib/libnss_dns-2.3.3.so
/chroot/mldonkey/lib/libdl.so.2
/chroot/mldonkey/lib/libresolv.so.2
/chroot/mldonkey/dev
/chroot/mldonkey/dev/null
/chroot/mldonkey/dev/log

~ % sudo chroot /chroot/mldonkey /bin/bash
zsh: segmentation fault  sudo chroot /chroot/mldonkey /bin/bash



Version-Release number of selected component (if applicable):
coreutils-5.2.1-31

How reproducible:
Always

Steps to Reproduce:
Don't really know how to reproduce.  I came upon this situation by:
1. Installling fc2 from scratch
2. Installing mldonkey
3. Upgrading to fc3 (fixed /etc/xdg/menus/applications.menu and
upgraded udev/firefox, but nothing else)
4. Running the command:

sudo chroot /chroot/mldonkey /bin/bash

triggers the bug.

Additional info:
Comment 1 Wesley Tanaka 2004-11-23 08:43:03 EST
This command also crashes, which leads me to believe that the crash
might be /bin/bash crashing

~ % sudo /usr/bin/compartment --chroot /chroot/mldonkey --verbose /bin/sh
Password:
I am in verbose mode now
Chrooted sucessfully to /chroot/mldonkey
FD_CLOEXEC successfully set on all filedescriptors > 2
core size limit successfully set to 0 bytes
zsh: segmentation fault  sudo /usr/bin/compartment --chroot
/chroot/mldonkey --verbose /bin/sh
Comment 2 Tim Waugh 2004-11-23 08:43:36 EST
What about if you boot with 'vdso=0' on the kernel command line?
Comment 3 Wesley Tanaka 2004-11-23 08:46:52 EST
Created attachment 107296 [details]
/etc/rc.d/init.d/mldonkey script which creates chroot environment

The chroot environment is created by the attached startup script
Comment 4 Wesley Tanaka 2004-11-23 08:51:36 EST
I copied /sbin/sash into /chroot/mldonkey/bin, and 
"sudo chroot /chroot/mldonkey /bin/sash"
works

% sudo chroot /chroot/mldonkey /bin/sash 
Stand-alone shell (version 3.7)
> 

bash version is bash-3.0-17 in case this is a bash crash


Computer is in a bar and we're open right now, so I can't reboot to
try vdso=0 right now.
Comment 5 Tim Waugh 2004-11-23 09:12:58 EST
I strongly suspect that this is another instance of bug #121351.  Let me know
what happens when you get a chance to reboot.  Thanks.
Comment 6 Wesley Tanaka 2004-11-23 09:35:52 EST
Rebooted with vsdo=0
grub.conf contains:

title Fedora Core (2.6.9-1.667)
        root (hd0,0)
        kernel /boot/vmlinuz-2.6.9-1.667 vdso=0 ro root=LABEL=/ rhgb
        initrd /boot/initrd-2.6.9-1.667.img

crash still occurs
Comment 7 Tim Waugh 2004-11-23 10:16:33 EST
And /proc/cmdline has vdso=0 in it?

Okay, let's try tracing the syscalls:

strace chroot /chroot/mldonkey/

If we get as far as the execve call and that works, it's a problem with the
atrpms package.
Comment 8 Wesley Tanaka 2004-11-23 22:06:00 EST
/proc/cmdline indeed has vdso=0 in it:

~ % cat /proc/cmdline
vdso=0 ro root=LABEL=/ rhgb
Comment 9 Wesley Tanaka 2004-11-23 22:15:13 EST
Created attachment 107373 [details]
sudo strace chroot /chroot/mldonkey /bin/bash |& tee /tmp/log.txt

Looks like the exec happens and bash crashes shortly after trying to open
/dev/tty
Comment 10 Wesley Tanaka 2004-11-23 22:19:22 EST
/dev % rpm -q bash; md5sum /bin/bash; sudo md5sum
/chroot/mldonkey/bin/bash
bash-3.0-17
ba7735421280d1a05eb3118d8c100db5  /bin/bash
ba7735421280d1a05eb3118d8c100db5  /chroot/mldonkey/bin/bash
Comment 11 Tim Waugh 2004-11-24 06:59:30 EST
(Now you need to report the bug to the atrpms people: we don't ship those binaries.)
Comment 12 Wesley Tanaka 2004-11-25 05:29:41 EST
Shouldn't bash produce some sort of useful error message instead of
crashing?
Comment 13 Tim Waugh 2004-11-25 05:36:53 EST
Well, it shouldn't crash of course.  But:

> trying to chroot into a
> /chroot/mldonkey directory as created by the
> mldonkey-backend-2.5.28-41.rhfc3.at rpm from atrpms

So you're running a bash binary that *we* haven't shipped -- so who
knows what's in it?  It might have bad patches in or all sorts.  I
don't even know what *version* it is -- so you need to talk to the
atrpms folk who compiled it, and sort them problem out with them.

This forum is for bugs in code contained in Red Hat repositories, not
third parties.
Comment 14 Wesley Tanaka 2004-11-25 07:19:58 EST
The bash in question verifies with

rpm --verify bash

and is the same binary as the one in /chroot/mldonkey/bin
via comparing md5sum (see comment #10)

It's the one that was on my system after the upgrade from fc2 to fc3,
and is shipped by redhat:

$ rpm -qi bash | grep Vendor
Version     : 3.0                               Vendor: Red Hat, Inc.
Comment 15 Tim Waugh 2004-11-25 07:27:29 EST
Ah, okay, that wasn't clear.
Comment 16 Tim Waugh 2004-11-25 12:22:28 EST
I can't reproduce this here.  Try this:

gdb --args /usr/sbin/chroot /chroot/mldonkey
(gdb) run

It would also be interesting to know what the last few lines of
'dmesg' output are after the segfault.
Comment 17 Wesley Tanaka 2004-11-25 23:05:31 EST
% sudo gdb --args /usr/sbin/chroot /chroot/mldonkey /bin/bash
Password:
GNU gdb Red Hat Linux (6.1post-1.20040607.41rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and
you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
details.
This GDB was configured as "i386-redhat-linux-gnu"...(no debugging
symbols found)...Using host libthread_db library
"/lib/tls/libthread_db.so.1".

(gdb) run
Starting program: /usr/sbin/chroot /chroot/mldonkey /bin/bash
(no debugging symbols found)...(no debugging symbols found)...
Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0xf6fb25a8 in translit_to_tbl () from /lib/tls/libc.so.6
#2  0xf6fff1a0 in _rtld_local () from /lib/ld-linux.so.2
#3  0xf6fff360 in _rtld_local () from /lib/ld-linux.so.2
#4  0xf6ff4510 in _dl_map_object_deps () from /lib/ld-linux.so.2
#5  0xf6ff8711 in _dl_show_auxv () from /lib/ld-linux.so.2
#6  0xfefe563c in ?? ()
#7  0x00000006 in ?? ()
#8  0x00000000 in ?? ()
(gdb) quit
The program is running.  Exit anyway? (y or n) y


I'm downloading glibc debuginfo packages, but it's going slow.
Comment 18 Wesley Tanaka 2004-11-25 23:08:21 EST
share/mldonkey/incoming % sudo /usr/sbin/chroot /chroot/mldonkey
/bin/bash; dmesg| grep -v INPUT-CHAIN
zsh: segmentation fault  sudo /usr/sbin/chroot /chroot/mldonkey /bin/bash
ST=218.63.230.91 LEN=47 TOS=0x00 PREC=0x00 TTL=106 ID=4655 PROTO=UDP
SPT=3360 DPT=10366 LEN=27

dmesg only lists firewall log messages
Comment 19 Wesley Tanaka 2004-11-25 23:09:40 EST
Which debuginfo packages should I install (if any?)
Comment 20 Tim Waugh 2004-11-26 05:11:39 EST
bash-debuginfo and glibc-debuginfo (get the i686 architecture), and
also glibc-debuginfo-common please.
Comment 21 Wesley Tanaka 2004-11-26 05:16:01 EST
Luckily, those are the three I downloaded in the background during the
day here.

/tmp % rpm -q bash-debuginfo glibc-debuginfo glibc-debuginfo-common
bash-debuginfo-3.0-17
glibc-debuginfo-2.3.3-74
glibc-debuginfo-common-2.3.3-74

glibc-debuginfo is the i686 version.

/tmp % sudo gdb --args /usr/sbin/chroot /chroot/mldonkey /bin/bash
GNU gdb Red Hat Linux (6.1post-1.20040607.41rh)
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and
you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for
details.
This GDB was configured as "i386-redhat-linux-gnu"...(no debugging
symbols found)...Using host libthread_db library
"/lib/tls/libthread_db.so.1".

(gdb) run
Starting program: /usr/sbin/chroot /chroot/mldonkey /bin/bash

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0xf6fb25a8 in ?? () from /lib/tls/libc.so.6
#2  0xf6fff1a0 in ?? () from /lib/ld-linux.so.2
#3  0xf6fff360 in ?? () from /lib/ld-linux.so.2
#4  0xf6ff4510 in _dl_map_object_deps (map=0xf6ff8711,
preloads=0xf6ff4510,
    npreloads=4143969120, trace_mode=0, open_mode=1) at dl-deps.c:432
#5  0xf6f1bc7c in ____wcstod_l_internal (nptr=0x8, endptr=0xf6fdaff4,
    group=-17559752, loc=0xf6f1b195) at strtod_l.c:485
#6  0xf6f1c263 in ____wcstod_l_internal (nptr=0x5, endptr=0xf6edd0a8,
    group=-151146508, loc=0x0) at strtod_l.c:1058
#7  0xf6f1b195 in __wcstoll_l (nptr=0xf6f1bb40, endptr=0xf6f1bb40,
    base=-151930048, loc=0xf6f1bb40) at strtol_l.c:555
#8  0xf6edd0a8 in str_to_mpn (str=0x8 <Address 0x8 out of bounds>,
digcnt=4,
    n=0xfef6cd91, nsize=0x5, exponent=0x0, decimal=0x0,
    decimal_len=4142697168, thousands=0xf6ec39b8 "") at gmp.h:466
#9  0xf6ed7965 in *__GI_____strtoll_l_internal (nptr=0xfef6cd8b
"en_US.UTF-8",
    endptr=0xf6fc8534, base=5, group=0, loc=0xfef41214) at strtol_l.c:447
#10 0xf6ed6ae5 in *__GI___strtol_internal (
    nptr=0xf6f1bb40 "U\211�\203�h\211]�\211u�� \021��\201ã�\v",
    endptr=0xf6f1bb40, base=-151930048, group=-151930048)
    at ../sysdeps/generic/strtol.c:100
#11 0xf6ed6513 in nrand48 (xsubi=0xf6f1bb40) at nrand48.c:26
#12 0x08090ceb in ?? ()
#13 0x00000006 in ?? ()
#14 0x080d5fa7 in ?? ()
#15 0xf6f6e47c in __tdelete (key=0x80e2200, vrootp=0x1, compar=0x6461)
    at tsearch.c:544
#16 0x0805c0fb in ?? ()
#17 0x080e2200 in ?? ()
#18 0x00000001 in ?? ()
---Type <return> to continue, or q <return> to quit---
#19 0x00006461 in ?? ()
#20 0x00000000 in ?? ()
(gdb) The program is running.  Exit anyway? (y or n) y

Comment 22 Tim Waugh 2004-11-26 07:11:13 EST
Try this:

env - /usr/sbin/chroot /chroot/mldonkey /bin/bash
Comment 23 Wesley Tanaka 2004-11-26 07:39:15 EST
Also crashes:

Program received signal SIGSEGV, Segmentation fault.
0x00000000 in ?? ()
(gdb) bt
#0  0x00000000 in ?? ()
#1  0xf6fb25a8 in ?? () from /lib/tls/libc.so.6
#2  0xf6fff1a0 in ?? () from /lib/ld-linux.so.2
#3  0xf6fe35a0 in ?? ()
#4  0x00000001 in ?? ()
#5  0x00000000 in ?? ()
Comment 24 Tim Waugh 2004-11-26 07:42:50 EST
Hmm.  Well I can't get it to happen here.  Could you tar up the chroot
environment  and attach it here?
Comment 25 Wesley Tanaka 2004-11-26 10:39:26 EST
# chroot /chroot/bug140526/ /bin/bash
Segmentation fault
# tar cf - /chroot/bug140526/ | gzip -9 -c > bug140526.tar.gz
tar: Removing leading `/' from member names
tar: /chroot/bug140526/dev/log: socket ignored
# ls -l /chroot/bug140526/dev/log
srw-rw-rw-  1 mldonkey mldonkey 0 Nov 26 09:31 /chroot/bug140526/dev/log

The file was too big to attach, so I am putting it up at:

http://ofb.net/~wtanaka/temp/bug140526.tar.gz

Comment 26 Wesley Tanaka 2004-11-29 00:29:15 EST
Can you reproduce the bug with that tar file?
Comment 27 Tim Waugh 2004-11-29 08:34:30 EST
Yes, but the ld-linux.so.2 does not correspond to the version we actually
shipped (glibc-2.3.3-74).  When I copy in the correct version it works fine.
Comment 28 Wesley Tanaka 2004-11-30 06:58:00 EST
Whoops.  That fixes everything here too.

Note You need to log in before you can comment on or make changes to this bug.