Red Hat Bugzilla – Bug 211112
sudo occasionally segfaults
Last modified: 2007-11-16 20:14:54 EST
Description of problem: sudo sometimes core dumps. I can reproduce this by running the cp command through sudo in a little test script over and over again. I'm running on dule Xeons with hyperthreading turned on. Also the core file produces almost a useless back trace with an error like: Error accessing memory address 0xbf9a9964: No such file or directory Version-Release number of selected component (if applicable): 1.6.7p5-30.1.3 How reproducible: I suspect it takes thousands of tries, but the little test script will merrily keep going till it does core. Steps to Reproduce: 1. Run the following script: touch /tmp/bother while sudo cp /tmp/bother /tmp/blather; do : ; done; Actual results: Eventually it will core dump in about 30 seconds (often times less). Expected results: It would keep on running along just fine. Additional info: Note it is assumed the user you run this test as configure to run copy, and not have to type a password.
I can't reproduce it on x86_64 :-(. Could you send coredump file, please.
Sure, just attach it as an attachement or send it to your email?
The attachment is alright.
Created attachment 139725 [details] core file
Note that this is a FC6 kernel (w 4 device related patches) Linux gt40 2.6.18-1.2798prerel3.0.0_60.25.0PAE #1 SMP Wed Oct 25 18:58:20 EDT 2006 i686 athlon i386 GNU/Linux running on a CentOS 4.3 userland. Even with that variance, I'm surprised to see a sudo core dump. The core dump itself is rather odd. Lemme try to see if I can't simplify the problem some by varying how sudo is compiled and perhaps what glibc is installed.
Backing out the WITH_SELINUX patch does not fix the segfault. Backing out "F_PIE=-fpie LDFLAGS=-pie" does fix the segfault. So PIE using a 2.6.18 kernel and glibc from RHLE4/CentOS4 appear to have an intrinsic difference wrto PIE (my hunch only, consistent with the oddly uniformative core dump).
The segfault is not corrected by doing (together or individually): echo "0" > /proc/sys/kernel/randomize_va_space echo "0" > /proc/sys/kernel/exec-shield The segfault is invariant to execstack {-s|-c} /usr/bin/sudo So the only known "fix" I know of is removing -fpie and -pie from compiler/linkage flags.