Bug 2166714 - dmapd segfaults
Summary: dmapd segfaults
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: dmapd
Version: 36
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: W. Michael Petullo
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2023-02-02 17:43 UTC by Adam Pribyl
Modified: 2023-03-29 02:35 UTC (History)
3 users (show)

Fixed In Version: dmapd-0.0.94-2.fc38 dmapd-0.0.94-2.fc36 dmapd-0.0.94-2.fc37
Clone Of:
Environment:
Last Closed: 2023-03-29 00:16:28 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)
file that may crash the dmapd (6.12 MB, audio/mpeg)
2023-02-03 07:50 UTC, Adam Pribyl
no flags Details

Description Adam Pribyl 2023-02-02 17:43:48 UTC
Description of problem:
Just configured the dmapd, after systemct start dmapd it segfaults.

Version-Release number of selected component (if applicable):
dmapd-0.0.91-1.fc36.x86_64

How reproducible:
Always

Steps to Reproduce:
1.systemct start dmapd



Additional info:

 kernel: dmapd[606786]: segfault at 8 ip 00007f7ae0bfa1f7 sp 00007ffd2b341a80 error 4 in libdb-builder-gdir.so[7f7ae0bf9000+2000]


                                               
                                               Module libopenslide.so.0 with build-id bc09b15880d2c146f3c1c75dd46ba86b58755336
                                               Stack trace of thread 606786:
                                               #0  0x00007f7ae0bfa1f7 _build_db_starting_at (libdb-builder-gdir.so + 0x31f7)
                                               #1  0x00007f7ae0bfa2ef _handle_path (libdb-builder-gdir.so + 0x32ef)
                                               #2  0x00007f7ae0bfa182 _build_db_starting_at (libdb-builder-gdir.so + 0x3182)
                                               #3  0x000055f6b10ae442 _serve (dmapd + 0x5442)
                                               #4  0x000055f6b10ad7a7 main (dmapd + 0x47a7)
                                               #5  0x00007f7ae5a29510 __libc_start_call_main (libc.so.6 + 0x29510)
                                               #6  0x00007f7ae5a295c9 __libc_start_main@@GLIBC_2.34 (libc.so.6 + 0x295c9)
                                               #7  0x000055f6b10adea5 _start (dmapd + 0x4ea5)
                                               
                                               Stack trace of thread 606787:
                                               #0  0x00007f7ae5b0afbd syscall (libc.so.6 + 0x10afbd)
                                               #1  0x00007f7ae5d649d0 g_cond_wait_until (libglib-2.0.so.0 + 0xa59d0)
                                               #2  0x00007f7ae5ce3f11 g_async_queue_pop_intern_unlocked (libglib-2.0.so.0 + 0x24f11)
                                               #3  0x00007f7ae5d40d5a g_thread_pool_thread_proxy.lto_priv.0 (libglib-2.0.so.0 + 0x81d5a)
                                               #4  0x00007f7ae5d3e302 g_thread_proxy (libglib-2.0.so.0 + 0x7f302)
                                               #5  0x00007f7ae5a8cded start_thread (libc.so.6 + 0x8cded)
                                               #6  0x00007f7ae5b12370 __clone3 (libc.so.6 + 0x112370)
                                               ELF object binary architecture: AMD x86-64


Feb 02 18:32:44 ed dmapd[606786]: Object class AvRender doesn't implement property 'volume' from interface 'DmapControlPlayer'
Feb 02 18:32:44 ed dmapd[606786]: Object class AvRender doesn't implement property 'shuffle-state' from interface 'DmapControlPlayer'
Feb 02 18:32:44 ed dmapd[606786]: Object class AvRender doesn't implement property 'repeat-state' from interface 'DmapControlPlayer'
Feb 02 18:32:44 ed dmapd[606786]: Object class AvRender doesn't implement property 'playing-time' from interface 'DmapControlPlayer'
Feb 02 18:32:44 ed dmapd[606786]: Object class AvRender doesn't implement property 'play-state' from interface 'DmapControlPlayer'
Feb 02 18:32:44 ed dmapd[606786]: A group named "gst" is already part of this GOptionContext
Feb 02 18:32:44 ed dmapd[606786]: Object class DmapdDmapAvRecord doesn't implement property 'songalbumid' from interface 'DmapAvRecord'
Feb 02 18:32:44 ed dmapd[606786]: dmapd: WARNING: Could not read metadata from file:///mnt/d/audio/Prod/08%20-%20Their%20Law.mp3
Feb 02 18:32:44 ed systemd[1]: dmapd.service: Main process exited, code=dumped, status=11/SEGV
Feb 02 18:32:44 ed systemd[1]: dmapd.service: Failed with result 'core-dump'.

Comment 1 W. Michael Petullo 2023-02-02 22:59:50 UTC
Would it be possible to collect a backtrace that includes C source line numbers? That, along with the media file that triggers the crash would help diagnose this.

Please see https://fedoraproject.org/wiki/StackTraces.

It also might be worth running dmapd from outside systemd, for example with "dmapd -f ..."

Comment 2 Adam Pribyl 2023-02-03 07:49:58 UTC
I did it via GDB:
https://fedoraproject.org/wiki/StackTraces#Obtaining_a_stack_trace_using_just_GDB
not sure if this helps enought:

Thread 2 (Thread 0x7ffff24f2640 (LWP 808677) "typefind:sink"):
#0  0x00007ffff7b0b27d in syscall () from /lib64/libc.so.6
No symbol table info available.
#1  0x00007ffff7e619d0 in g_cond_wait_until () from /lib64/libglib-2.0.so.0
No symbol table info available.
#2  0x00007ffff7de0f11 in g_async_queue_pop_intern_unlocked () from /lib64/libglib-2.0.so.0
No symbol table info available.
#3  0x00007ffff7e3dd5a in g_thread_pool_thread_proxy.lto_priv () from /lib64/libglib-2.0.so.0
No symbol table info available.
#4  0x00007ffff7e3b302 in g_thread_proxy () from /lib64/libglib-2.0.so.0
No symbol table info available.
#5  0x00007ffff7a8cdcd in start_thread () from /lib64/libc.so.6
No symbol table info available.
#6  0x00007ffff7b12630 in clone3 () from /lib64/libc.so.6
No symbol table info available.

Thread 1 (Thread 0x7ffff6065d80 (LWP 808674) "dmapd"):
#0  0x00007ffff32e31f7 in _build_db_starting_at (builder=0x5555556e56a0, dir=dir@entry=0x5555556a3f70 "/mnt/d/audio/Prod", container_record=container_record@entry=0x5555556e56e0, error=error@entry=0x7fffffffe318) at /usr/src/debug/dmapd-0.0.91-1.fc36.x86_64/src/db-
builder-gdir.c:381
        path = 0x55555561ead0 "0\374qUUU"
        d = 0x5555556ecfb0
        ok = 0
        entry = <optimized out>
        __func__ = "_build_db_starting_at"
#1  0x00007ffff32e32ef in _handle_path (builder=0x5555556e56a0, path=path@entry=0x5555556a3f70 "/mnt/d/audio/Prod", container_record=container_record@entry=0x0, error=error@entry=0x7fffffffe318) at /usr/src/debug/dmapd-0.0.91-1.fc36.x86_64/src/db-builder-gdir.c:180
        record = 0x5555556e56e0
        ok = 0
        filename = 0x5555556eaf60 "Prod"
#2  0x00007ffff32e3182 in _build_db_starting_at (builder=0x5555556e56a0, dir=0x5555555ff3c0 "/mnt/d/audio", container_record=0x0, error=0x7fffffffe318) at /usr/src/debug/dmapd-0.0.91-1.fc36.x86_64/src/db-builder-gdir.c:373
        path = 0x5555556a3f70 "/mnt/d/audio/Prod"
        d = 0x5555555ffcf0
        ok = 1
        entry = <optimized out>
        __func__ = "_build_db_starting_at"
#3  0x0000555555559442 in _serve (protocol=protocol@entry=DAAP, factory=<optimized out>, share_def=share_def@entry=0x5555555ff4f0, error=error@entry=0x7fffffffe318) at /usr/src/debug/dmapd-0.0.91-1.fc36.x86_64/src/dmapd.c:464
        i = 0
        db = 0x5555556e5660
        rc = <optimized out>
        ok = <optimized out>
        share = 0x0
        container_db = 0x5555556cc2a0
        db_protocol_dir = 0x5555555d2810 "/var/cache/dmapd/Edna Audio/DAAP"
        __func__ = "_serve"
#4  0x00005555555587a7 in main (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/dmapd-0.0.91-1.fc36.x86_64/src/dmapd.c:901
        factory = <optimized out>
        share_def = 0x5555555ff4f0
        list = 0x55555557ac50
        exitval = 0
        error = 0x0
        context = 0x55555557de00
        av_meta_reader = <optimized out>
        photo_meta_reader = 0x5555555a6010
        workers = {dacp_share = 0x0, av_render = 0x555555585b70}
Warning: 'set logging off', an alias for the command 'set logging enabled', is deprecated.
Use 'set logging enabled off'.

I am also not sure why this file should trigger this crash - it looks to me this is for some reason a very first file that is indexed. I'd like to point out, there is running a selinux that is sometimes causig a strange things, but I disabled it however the crash still occurs.

Comment 3 Adam Pribyl 2023-02-03 07:50:39 UTC
Created attachment 1941976 [details]
file that may crash the dmapd

Comment 4 W. Michael Petullo 2023-03-18 19:48:04 UTC
Your segfault seems to occur as a result of line 381 in db-builder-gdir.c. This seems to mean that ok is FALSE, but that the pointer error holds NULL. I cannot find a way to cause this to happen. From what I see, all instances where ok is FALSE also result in setting error. Unfortunately, the media file you provided loads fine here.

I tried corrupting the file and also setting its permissions so that I could not read it. Neither triggered the segfault here.

Obviously, I am missing something.

If you are able to operate GDB or recompile with print statements, I recommend you poke around _handle_path, _build_db_starting_at, dmapd_db_lookup_id_by_location, dmapd_db_add_path, and dmapd_db_record_factory_create to see what returns ok == FALSE without setting error.

Comment 5 W. Michael Petullo 2023-03-18 20:26:53 UTC
I just found a problem.

Are you using the "acceptable formats" feature ("dmapd -M ..." or "Acceptable-Formats")? If so, then dmapd will segfault due to the circumstances described above.

If able, please compile and test Git master after cloning with:

git clone https://www.flyn.org/git/dmapd

You can run ./autogen.sh to create the necessary Makefiles.

Otherwise, try avoiding the "acceptable formats" feature, and see if that makes the problem go away.

I will publish a new version of the package if your tests demonstrate that the problem is fixed.

Comment 6 Adam Pribyl 2023-03-19 06:39:15 UTC
Yes I am using

Acceptable-Formats=mp3;flac;ogg

Acually this machine is not intended to build, I tried to install several required devel things but ended up with that

checking for DMAPSHARING... no
configure: error: libdmapsharing not found.  Install libdmapsharing

even thou
Package libdmapsharing-devel-2.9.41-6.fc36.x86_64 is already installed.

Comment 7 W. Michael Petullo 2023-03-19 14:20:29 UTC
Does the segfault go away if you avoid using "Acceptable-Formats" with the current dmapd package? That would be nearly as strong evidence that what I changed will fix your problem.

Comment 8 Adam Pribyl 2023-03-20 09:39:14 UTC
Yes, the segfault does not happen when acceptable formats is removed from the config.

Comment 9 Fedora Update System 2023-03-20 13:15:36 UTC
FEDORA-2023-56a0a07091 has been submitted as an update to Fedora 38. https://bodhi.fedoraproject.org/updates/FEDORA-2023-56a0a07091

Comment 10 Fedora Update System 2023-03-20 13:16:45 UTC
FEDORA-2023-0bcd61a0a7 has been submitted as an update to Fedora 37. https://bodhi.fedoraproject.org/updates/FEDORA-2023-0bcd61a0a7

Comment 11 Fedora Update System 2023-03-20 13:24:31 UTC
FEDORA-2023-9eb828d84f has been submitted as an update to Fedora 36. https://bodhi.fedoraproject.org/updates/FEDORA-2023-9eb828d84f

Comment 12 Fedora Update System 2023-03-21 01:37:03 UTC
FEDORA-2023-56a0a07091 has been pushed to the Fedora 38 testing repository.

You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-56a0a07091

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 13 Fedora Update System 2023-03-21 01:42:04 UTC
FEDORA-2023-0bcd61a0a7 has been pushed to the Fedora 37 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-0bcd61a0a7`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-0bcd61a0a7

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 14 Fedora Update System 2023-03-21 01:48:27 UTC
FEDORA-2023-9eb828d84f has been pushed to the Fedora 36 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2023-9eb828d84f`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2023-9eb828d84f

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 15 Fedora Update System 2023-03-29 00:16:28 UTC
FEDORA-2023-56a0a07091 has been pushed to the Fedora 38 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 16 Fedora Update System 2023-03-29 01:28:19 UTC
FEDORA-2023-9eb828d84f has been pushed to the Fedora 36 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 17 Fedora Update System 2023-03-29 02:35:59 UTC
FEDORA-2023-0bcd61a0a7 has been pushed to the Fedora 37 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.