Bug 1438116 - ping segmentation fault
Summary: ping segmentation fault
Keywords:
Status: CLOSED DUPLICATE of bug 1364666
Alias: None
Product: Fedora
Classification: Fedora
Component: samba
Version: 25
Hardware: x86_64
OS: Linux
unspecified
unspecified
Target Milestone: ---
Assignee: Guenther Deschner
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-04-01 00:26 UTC by rvcsaba
Modified: 2017-04-06 13:43 UTC (History)
20 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2017-04-06 13:43:25 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
gdb --args ping lisehdfbcv.hu (9.35 KB, text/plain)
2017-04-05 11:05 UTC, rvcsaba
no flags Details

Description rvcsaba 2017-04-01 00:26:01 UTC
Description of problem:

If I use nonexistent domain name in ping command, segfault it:

ping lisehdfbcv.hu
Segmentation fault

host lisehdfbcv.hu
Host lisehdfbcv.hu not found: 3(NXDOMAIN)

Version-Release number of selected component (if applicable):

rpm -qf `which ping`
iputils-20161105-1.fc25.x86_64

;------------------------------------

I test same command from my LEDE router:

ping lisehdfbcv.hu
ping: bad address 'lisehdfbcv.hu'

It's a correct result.

Comment 1 Jan Synacek 2017-04-03 07:37:22 UTC
I cannot reproduce this on a freshly installed F25.

$ rpm -q iputils
iputils-20161105-1.fc25.x86_64

$ ping lisehdfbcv.hu
ping: lisehdfbcv.hu: Name or service not known

$ host lisehdfbcv.hu
Host lisehdfbcv.hu not found: 3(NXDOMAIN)


Please, provide a backtrace:

# dnf install -y iputils-debuginfo gdb

# gdb --args ping lisehdfbcv.hu
(gdb) run
<ping finishes>
(gdb) backtrace
<provide this output>

Comment 2 rvcsaba 2017-04-03 09:33:19 UTC
gdb --args ping lisehdfbcv.hu
GNU gdb (GDB) Fedora 7.12.1-47.fc25
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ping...Reading symbols from /usr/lib/debug/usr/bin/ping.debug...done.
done.
(gdb) run
Starting program: /usr/sbin/ping lisehdfbcv.hu
Missing separate debuginfos, use: dnf debuginfo-install glibc-2.24-4.fc25.x86_64
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007fffef268d3e in __pthread_initialize_minimal_internal ()
   from /lib64/libpthread.so.0
Missing separate debuginfos, use: dnf debuginfo-install libcap-2.25-2.fc25.x86_64 libgcc-6.3.1-1.fc25.x86_64 libidn-1.33-1.fc25.x86_64 libselinux-2.5-13.fc25.x86_64 nss-mdns-0.10-17.fc24.x86_64 openssl-libs-1.0.2k-1.fc25.x86_64 pcre-8.40-6.fc25.x86_64 systemd-libs-231-14.fc25.x86_64 zlib-1.2.8-10.fc24.x86_64
(gdb) backtrace
#0  0x00007fffef268d3e in __pthread_initialize_minimal_internal ()
   from /lib64/libpthread.so.0
#1  0x00007fffef268589 in _init () from /lib64/libpthread.so.0
#2  0x00007ffff7fa1898 in ?? () from /lib64/libnss_myhostname.so.2
#3  0x00007ffff7de79fa in call_init.part () from /lib64/ld-linux-x86-64.so.2
#4  0x00007ffff7de7bc5 in _dl_init () from /lib64/ld-linux-x86-64.so.2
#5  0x00007ffff7decaa6 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
#6  0x00007ffff7de78e4 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#7  0x00007ffff7dec079 in _dl_open () from /lib64/ld-linux-x86-64.so.2
#8  0x00007ffff6d97f8d in do_dlopen () from /lib64/libc.so.6
#9  0x00007ffff7de78e4 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#10 0x00007ffff6d98044 in __libc_dlopen_mode () from /lib64/libc.so.6
#11 0x00007ffff6d7d820 in nss_load_library () from /lib64/libc.so.6
#12 0x00007ffff6d7df48 in __nss_lookup_function () from /lib64/libc.so.6
#13 0x00007ffff6d3ff3f in gaih_inet.constprop () from /lib64/libc.so.6
#14 0x00007ffff6d42268 in getaddrinfo () from /lib64/libc.so.6
#15 0x0000555555556c5d in main (argc=1, argv=0x7fffffffe470) at ping.c:519
(gdb)

Comment 3 rvcsaba 2017-04-03 09:46:11 UTC
gdb --args ping lisehdfbcv.hu
GNU gdb (GDB) Fedora 7.12.1-47.fc25
Copyright (C) 2017 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-redhat-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ping...Reading symbols from /usr/lib/debug/usr/bin/ping.debug...done.
done.
(gdb) run
Starting program: /usr/sbin/ping lisehdfbcv.hu
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".

Program received signal SIGSEGV, Segmentation fault.
0x00007fffef268d3e in __pthread_initialize_minimal_internal () at nptl-init.c:322
322	  THREAD_SETMEM (pd, cpuclock_offset, GL(dl_cpuclock_offset));
(gdb) backtrace
#0  0x00007fffef268d3e in __pthread_initialize_minimal_internal () at nptl-init.c:322
#1  0x00007fffef268589 in _init () at ../sysdeps/x86_64/crti.S:72
#2  0x00007ffff7fa1898 in ?? () from /lib64/libnss_myhostname.so.2
#3  0x00007ffff7de79fa in call_init (l=0x555555789560, argc=2, argv=0x7fffffffe468, env=0x7fffffffe480) at dl-init.c:58
#4  0x00007ffff7de7bc5 in call_init (env=0x7fffffffe480, argv=0x7fffffffe468, argc=2, l=<optimized out>) at dl-init.c:104
#5  _dl_init (main_map=main_map@entry=0x5555557890b0, argc=2, argv=0x7fffffffe468, env=0x7fffffffe480) at dl-init.c:87
#6  0x00007ffff7decaa6 in dl_open_worker (a=a@entry=0x7fffffffd900) at dl-open.c:564
#7  0x00007ffff7de78e4 in _dl_catch_error (objname=objname@entry=0x7fffffffd8f0, errstring=errstring@entry=0x7fffffffd8f8, mallocedp=mallocedp@entry=0x7fffffffd8ef, 
    operate=operate@entry=0x7ffff7dec740 <dl_open_worker>, args=args@entry=0x7fffffffd900) at dl-error.c:187
#8  0x00007ffff7dec079 in _dl_open (file=0x7fffffffdb50 "libnss_myhostname.so.2", mode=-2147483647, caller_dlopen=0x7ffff6d7d820 <nss_load_library+240>, nsid=-2, 
    argc=<optimized out>, argv=<optimized out>, env=0x7fffffffe480) at dl-open.c:649
#9  0x00007ffff6d97f8d in do_dlopen (ptr=ptr@entry=0x7fffffffdb20) at dl-libc.c:87
#10 0x00007ffff7de78e4 in _dl_catch_error (objname=0x7fffffffdb10, errstring=0x7fffffffdb18, mallocedp=0x7fffffffdb0f, operate=0x7ffff6d97f50 <do_dlopen>, args=0x7fffffffdb20)
    at dl-error.c:187
#11 0x00007ffff6d98044 in dlerror_run (args=0x7fffffffdb20, operate=0x7ffff6d97f50 <do_dlopen>) at dl-libc.c:46
#12 __GI___libc_dlopen_mode (name=name@entry=0x7fffffffdb50 "libnss_myhostname.so.2", mode=mode@entry=-2147483647) at dl-libc.c:163
#13 0x00007ffff6d7d820 in nss_load_library (ni=0x5555557885d0) at nsswitch.c:358
#14 0x00007ffff6d7df48 in __GI___nss_lookup_function (ni=ni@entry=0x5555557885d0, fct_name=<optimized out>, fct_name@entry=0x7ffff6dde239 "gethostbyname4_r") at nsswitch.c:455
#15 0x00007ffff6d3ff3f in gaih_inet (name=name@entry=0x7fffffffe6cb "lisehdfbcv.hu", service=<optimized out>, req=req@entry=0x7fffffffe320, pai=pai@entry=0x7fffffffde28, 
    naddrs=naddrs@entry=0x7fffffffde24, tmpbuf=tmpbuf@entry=0x7fffffffde90) at ../sysdeps/posix/getaddrinfo.c:839
#16 0x00007ffff6d42268 in __GI_getaddrinfo (name=<optimized out>, service=<optimized out>, hints=0x7fffffffe320, pai=0x7fffffffe2f8) at ../sysdeps/posix/getaddrinfo.c:2391
#17 0x0000555555556c5d in main (argc=1, argv=0x7fffffffe470) at ping.c:519
(gdb)

Comment 4 Jan Synacek 2017-04-03 11:27:25 UTC
Ok, some more debugging:

$ grep hosts /etc/nsswitch.conf
#hosts:     db files nisplus nis dns
hosts:      files mdns4_minimal [NOTFOUND=return] dns myhostname

You probably have a similar line containing "myhostname" in /etc/nsswitch.conf. Try removing the "myhostname" word and retry.

Comment 5 rvcsaba 2017-04-03 12:11:32 UTC
If I use

hosts:      files mdns4_minimal [NOTFOUND=return] dns wins

ping lisehdfbcv.hu
ping: lisehdfbcv.hu: System error

exit code: 2

;----------------------------------------------------

If I use

hosts:      files mdns4_minimal [NOTFOUND=return] dns

ping lisehdfbcv.hu
ping: lisehdfbcv.hu: Name or service not known

exit code: 2

(In reply to Jan Synacek from comment #4)
> Ok, some more debugging:
> 
> $ grep hosts /etc/nsswitch.conf
> #hosts:     db files nisplus nis dns
> hosts:      files mdns4_minimal [NOTFOUND=return] dns myhostname
> 
> You probably have a similar line containing "myhostname" in
> /etc/nsswitch.conf. Try removing the "myhostname" word and retry.

Comment 6 Jan Synacek 2017-04-03 12:19:24 UTC
This is probably a problem in nss_myhostname, which is part of systemd.

Please, install "systemd-debuginfo" and rerun the gdb as you did in comment 3 (with the "myhostname" back in place in /etc/nsswitch.conf). And as a workaround, you can use the setup from comment 5.

I don't think that I will be able to fix this without a local reproducer.

Comment 7 rvcsaba 2017-04-04 14:17:23 UTC
In comment 3, systemd-debuginfo installed, and myhostname not deleted from nsswitch.conf, hosts: row.

What can I do? How I debugging it? (Sorry my very poor english.)

(In reply to Jan Synacek from comment #6)
> This is probably a problem in nss_myhostname, which is part of systemd.
> 
> Please, install "systemd-debuginfo" and rerun the gdb as you did in comment
> 3 (with the "myhostname" back in place in /etc/nsswitch.conf). And as a
> workaround, you can use the setup from comment 5.
> 
> I don't think that I will be able to fix this without a local reproducer.

Comment 8 Jan Synacek 2017-04-05 10:09:00 UTC
First, install this package:

# dnf install systemd-debuginfo

Then, rerun the steps (slightly modified) from comment 1 (make sure you put the "myhostname" word back into /etc/nsswitch.conf) before running these steps):

# gdb --args ping lisehdfbcv.hu
(gdb) run
<ping finishes>
(gdb) backtrace full
<provide this output>

Comment 9 rvcsaba 2017-04-05 10:50:51 UTC
OK, if I use this:

hosts:      files mdns4_minimal [NOTFOUND=return] dns myhostname

my result:

ping lisehdfbcv.hu
ping: lisehdfbcv.hu: Name or service not known

;----------------------------------

but if I use this:

hosts:      files mdns4_minimal [NOTFOUND=return] dns wins myhostname

my result:

ping lisehdfbcv.hu
Segmentation fault (core dumped)

Comment 10 rvcsaba 2017-04-05 11:05:41 UTC
Created attachment 1268932 [details]
gdb --args ping lisehdfbcv.hu

Ping backtrace.

hosts:      files mdns4_minimal [NOTFOUND=return] dns wins myhostname

Comment 11 Jan Synacek 2017-04-05 11:35:35 UTC
(In reply to rvcsaba from comment #10)
> Created attachment 1268932 [details]
> gdb --args ping lisehdfbcv.hu

> #2  0x00007ffff7fa2898 in ?? () from /lib64/libnss_myhostname.so.2

You haven't installed "systemd-debuginfo".

Comment 12 rvcsaba 2017-04-05 11:56:44 UTC
rpm -q systemd-debuginfo
systemd-debuginfo-231-14.fc25.x86_64


(In reply to Jan Synacek from comment #11)

> You haven't installed "systemd-debuginfo".

Comment 13 Jan Synacek 2017-04-05 12:16:58 UTC
Right... I can now reproduce this locally. The real problem seems to be the "wins" module from samba-winbind-modules.

Comment 14 Jan Synacek 2017-04-06 13:36:38 UTC
To recap:

# grep wins /etc/nsswitch.conf
hosts:      files mdns4_minimal [NOTFOUND=return] dns wins myhostname

The problem is the combination of wins (from samba-winbind-modules) + myhostname (systemd).

# gdb --args /home/jsynacek/src/iputils/ping boooooooo.org
...
(gdb) r
...
Program received signal SIGSEGV, Segmentation fault.
0x00007ffff644ccfe in __pthread_initialize_minimal_internal () from /lib64/libpthread.so.0
...
(gdb) bt
#0  0x00007ffff644ccfe in __pthread_initialize_minimal_internal () from /lib64/libpthread.so.0
#1  0x00007ffff644c549 in _init () from /lib64/libpthread.so.0
#2  0x00007ffff7e30688 in ?? () from /lib64/libnss_myhostname.so.2
#3  0x00007ffff7de8d6a in call_init.part () from /lib64/ld-linux-x86-64.so.2
#4  0x00007ffff7de8f35 in _dl_init () from /lib64/ld-linux-x86-64.so.2
#5  0x00007ffff7dedab1 in dl_open_worker () from /lib64/ld-linux-x86-64.so.2
#6  0x00007ffff7de8c54 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#7  0x00007ffff7ded009 in _dl_open () from /lib64/ld-linux-x86-64.so.2
#8  0x00007ffff6fc2aad in do_dlopen () from /lib64/libc.so.6
#9  0x00007ffff7de8c54 in _dl_catch_error () from /lib64/ld-linux-x86-64.so.2
#10 0x00007ffff6fc2b64 in __libc_dlopen_mode () from /lib64/libc.so.6
#11 0x00007ffff6fa84c0 in nss_load_library () from /lib64/libc.so.6
#12 0x00007ffff6fa8be8 in __nss_lookup_function () from /lib64/libc.so.6
#13 0x00007ffff6f6b0f6 in gaih_inet () from /lib64/libc.so.6
#14 0x00007ffff6f6e21b in getaddrinfo () from /lib64/libc.so.6
#15 0x00000000004028ff in main (argc=1, argv=0x7fffffffe5b0) at ping.c:519

This is definitely not a problem in iputils. The gdb shows that the call stack goes through something in nss_myhostname, which I didn't manage to verify, even with a custom built (no optimizations, latest master) systemd and iputils. Even after changing the myhostname code to do nothing else but return NSS_STATUS_NOTFOUND did not help. However, the problem is not reproducible on F26, which means that, very likely, the problem is in either samba-winbind-modules or glibc.

Reproducible on F25 with:
samba-winbind-modules-4.5.8-0.fc25.x86_64
glibc-2.24-4.fc25.x86_64


This is not reproducible on F26 with:
samba-winbind-modules-4.6.2-0.fc26.x86_64
glibc-2.25-4.fc26.x86_64


Switching to glibc first. Maybe the guys know something about this.

Comment 15 Florian Weimer 2017-04-06 13:43:25 UTC

*** This bug has been marked as a duplicate of bug 1364666 ***


Note You need to log in before you can comment on or make changes to this bug.