Description of problem: In Samba we have a lot of python bindings for Samba libraries. However If I build Samba with AddressSanitizer and run samba-tool (python script), python3 segfaults: LD_PRELOAD=/usr/lib64/libasan.so.8 ./bin/samba-tool --help samba-tool: missing subcommand AddressSanitizer:DEADLYSIGNAL ================================================================= ==2846005==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000000000 bp 0x7ffce799d840 sp 0x7ffce799cfd8 T0) ==2846005==Hint: pc points to the zero page. ==2846005==The signal is caused by a READ memory access. ==2846005==Hint: address points to the zero page. #0 0x0 (<unknown module>) #1 0x7feacef521d9 in crypt_crypt_impl.constprop.0 (/usr/lib64/python3.11/lib-dynload/_crypt.cpython-311-x86_64-linux-gnu.so+0x11d9) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: SEGV (<unknown module>) ==2846005==ABORTING Fedora uses libxcrypt and the interceptor implementations for crypt and crypt_r do not match => segfault. (gdb) bt #0 0x0000000000000000 in ?? () #1 0x00007ffff7861315 in __interceptor_crypt_r (key=0x7ffff76fcad0 <_PyRuntime+22352> "", salt=0x7fffdf0e9000 "$6$3T4OSb4mMoNb/L6o", data=0x7fffffff3e38) at ../../../../libsanitiz er/sanitizer_common/sanitizer_common_interceptors.inc:10002 #2 0x00007fffdf3ce1da in crypt_crypt_impl (word=word@entry=0x7ffff76fcad0 <_PyRuntime+22352> "", salt=salt@entry=0x7fffdf0e9000 "$6$3T4OSb4mMoNb/L6o", module=<optimized out>) at / usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Modules/_cryptmodule.c:44 #3 0x00007fffdf3ce32f in crypt_crypt (module=<optimized out>, args=<optimized out>, nargs=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Modules/clinic/_cryptm odule.c.h:58
(In reply to Andreas Schneider from comment #0) > Fedora uses libxcrypt and the interceptor implementations for crypt and > crypt_r do not match => segfault. How did you reach this conclusion? I'm not sure if this is the actual problem here. GCC already uses <crypt.h> from libxcrypt to determine the data size at build time.
When looking for it I found this: https://github.com/google/sanitizers/issues/1365 Here is a full backtrace of: dnf install samba-common-tools LD_PRELOAD=/usr/lib64/libasan.so.8 gdb --args python3 /usr/bin/samba-tool --help Program received signal SIGSEGV, Segmentation fault. 0x0000000000000000 in ?? () (gdb) bt #0 0x0000000000000000 in ?? () #1 0x00007ffff7861315 in __interceptor_crypt_r (key=0x7ffff76fcad0 <_PyRuntime+22352> "", salt=0x7fffdf0e9000 "$6$WMbpoLo7z0HPGA37", data=0x7fffffff3e38) at ../../../../libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:10002 #2 0x00007fffdf3ce1da in crypt_crypt_impl (word=word@entry=0x7ffff76fcad0 <_PyRuntime+22352> "", salt=salt@entry=0x7fffdf0e9000 "$6$WMbpoLo7z0HPGA37", module=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Modules/_cryptmodule.c:44 #3 0x00007fffdf3ce32f in crypt_crypt (module=<optimized out>, args=<optimized out>, nargs=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Modules/clinic/_cryptm odule.c.h:58 #4 0x00007ffff73dd811 in cfunction_vectorcall_FASTCALL (func=0x7fffdf0e8c20, args=0x7ffff777eac8, nargsf=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3.11-3.1 1.1-3.fc37.x86_64/Include/cpython/methodobject.h:52 #5 0x00007ffff73d0b57 in _PyObject_VectorcallTstate (kwnames=<optimized out>, nargsf=<optimized out>, args=<optimized out>, callable=0x7fffdf0e8c20, tstate=0x7ffff771fd38 <_PyRunt ime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include/internal/pycore_call.h:92 #6 PyObject_Vectorcall (callable=0x7fffdf0e8c20, args=<optimized out>, nargsf=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Objects/c all.c:299 #7 0x00007ffff73c2f44 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Pyth on/ceval.c:4772 #8 0x00007ffff73bed6a in _PyEval_EvalFrame (throwflag=0, frame=0x7ffff777e920, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include /internal/pycore_ceval.h:73 #9 _PyEval_Vector (tstate=0x7ffff771fd38 <_PyRuntime+166328>, func=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kwnames=<optimized out> ) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:6435 #10 0x00007ffff74485ac in PyEval_EvalCode (co=0x61700019aa00, globals=<optimized out>, locals=0x7fffdf0eeec0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:1154 #11 0x00007ffff74607e2 in builtin_exec_impl (module=<optimized out>, closure=<optimized out>, locals=0x7fffdf0eeec0, globals=0x7fffdf0eeec0, source=0x61700019aa00) at /usr/src/debu g/python3.11-3.11.1-3.fc37.x86_64/Python/bltinmodule.c:1075 #12 builtin_exec (module=<optimized out>, args=<optimized out>, nargs=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/clinic/bltinmodule.c.h:465 #13 0x00007ffff73d0bea in cfunction_vectorcall_FASTCALL_KEYWORDS (func=0x7ffff6488f90, args=0x7fffdf0ec0d8, nargsf=<optimized out>, kwnames=0x0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include/cpython/methodobject.h:52 #14 0x00007ffff73c7177 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x8[46/4824]on/ceval.c:5379 #15 0x00007ffff73bed6a in _PyEval_EvalFrame (throwflag=0, frame=0x7ffff777e628, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include/internal/pycore_ceval.h:73 #16 _PyEval_Vector (tstate=0x7ffff771fd38 <_PyRuntime+166328>, func=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:6435 #17 0x00007ffff73d76b6 in _PyObject_VectorcallTstate (kwnames=0x0, nargsf=2, args=0x7fffffffc380, callable=0x7ffff644fce0, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include/internal/pycore_call.h:92 #18 object_vacall (tstate=0x7ffff771fd38 <_PyRuntime+166328>, base=<optimized out>, callable=0x7ffff644fce0, vargs=0x7fffffffc410) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Objects/call.c:819 #19 0x00007ffff73fb904 in PyObject_CallMethodObjArgs (obj=0x0, name=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Objects/call.c:878 #20 0x00007ffff73f90c1 in import_find_and_load (abs_name=0x7fffdf33a0b0, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/import. c:1736 #21 PyImport_ImportModuleLevelObject (name=0x7fffdf33a0b0, globals=<optimized out>, locals=<optimized out>, fromlist=0x7ffff76ef480 <_Py_NoneStruct>, level=0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/import.c:1835 #22 0x00007ffff73c916e in import_name (level=0x7ffff76f76c8 <_PyRuntime+840>, fromlist=0x7ffff76ef480 <_Py_NoneStruct>, name=0x7fffdf33a0b0, frame=<optimized out>, tstate=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:7429 #23 _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:3949 #24 0x00007ffff73bed6a in _PyEval_EvalFrame (throwflag=0, frame=0x7ffff777e5a0, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include /internal/pycore_ceval.h:73 #25 _PyEval_Vector (tstate=0x7ffff771fd38 <_PyRuntime+166328>, func=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kwnames=<optimized out> ) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:6435 #26 0x00007ffff74485ac in PyEval_EvalCode (co=0x61c000080880, globals=<optimized out>, locals=0x7fffdf3384c0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:1154 #27 0x00007ffff74607e2 in builtin_exec_impl (module=<optimized out>, closure=<optimized out>, locals=0x7fffdf3384c0, globals=0x7fffdf3384c0, source=0x61c000080880) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/bltinmodule.c:1075 #28 builtin_exec (module=<optimized out>, args=<optimized out>, nargs=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/clinic/blti nmodule.c.h:465 #29 0x00007ffff73d0bea in cfunction_vectorcall_FASTCALL_KEYWORDS (func=0x7ffff6488f90, args=0x7fffdf34c358, nargsf=<optimized out>, kwnames=0x0) at /usr/src/debug/python3.11-3.11.1 -3.fc37.x86_64/Include/cpython/methodobject.h:52 #30 0x00007ffff73c7177 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Pyth on/ceval.c:5379 #31 0x00007ffff73bed6a in _PyEval_EvalFrame (throwflag=0, frame=0x7ffff777e2a8, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include /internal/pycore_ceval.h:73 #32 _PyEval_Vector (tstate=0x7ffff771fd38 <_PyRuntime+166328>, func=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kwnames=<optimized out> ) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:6435 #33 0x00007ffff73d76b6 in _PyObject_VectorcallTstate (kwnames=0x0, nargsf=2, args=0x7fffffffca30, callable=0x7ffff644fce0, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/de bug/python3.11-3.11.1-3.fc37.x86_64/Include/internal/pycore_call.h:92 #34 object_vacall (tstate=0x7ffff771fd38 <_PyRuntime+166328>, base=<optimized out>, callable=0x7ffff644fce0, vargs=0x7fffffffcac0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64 /Objects/call.c:819 #35 0x00007ffff73fb904 in PyObject_CallMethodObjArgs (obj=0x0, name=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Objects/call.c:878 #36 0x00007ffff73f90c1 in import_find_and_load (abs_name=0x7fffdf3353e0, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/import. c:1736 #37 PyImport_ImportModuleLevelObject (name=0x7fffdf3353e0, globals=<optimized out>, locals=<optimized out>, fromlist=0x7fffe213b9c0, level=0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/import.c:1835 #38 0x00007ffff7406fba in builtin___import___impl (level=<optimized out>, fromlist=0x7fffe213b9c0, locals=0x0, globals=0x0, name=0x7fffdf3353e0, module=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/bltinmodule.c:277 #39 builtin___import__ (module=<optimized out>, args=<optimized out>, nargs=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/clinic/bltinmodule.c.h:78 #40 0x00007ffff73c67c0 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:5094 #41 0x00007ffff73bed6a in _PyEval_EvalFrame (throwflag=0, frame=0x7ffff777e130, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include/internal/pycore_ceval.h:73 #42 _PyEval_Vector (tstate=0x7ffff771fd38 <_PyRuntime+166328>, func=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:6435 #43 0x00007ffff73fce95 in _PyFunction_Vectorcall (kwnames=0x0, nargsf=<optimized out>, stack=0x7fffffffce70, func=0x7fffe2155120) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Objects/call.c:393 #44 _PyObject_VectorcallTstate (kwnames=0x0, nargsf=<optimized out>, args=0x7fffffffce70, callable=0x7fffe2155120, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include/internal/pycore_call.h:92 #45 method_vectorcall (method=<optimized out>, args=0x7ffff62570e8, nargsf=<optimized out>, kwnames=0x0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Objects/classobject.c:89 #46 0x00007ffff73c7177 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:5379 #47 0x00007ffff73bed6a in _PyEval_EvalFrame (throwflag=0, frame=0x7ffff777e090, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include/internal/pycore_ceval.h:73 #48 _PyEval_Vector (tstate=0x7ffff771fd38 <_PyRuntime+166328>, func=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:6435 #49 0x00007ffff73c7177 in _PyEval_EvalFrameDefault (tstate=<optimized out>, frame=<optimized out>, throwflag=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:5379 #50 0x00007ffff73bed6a in _PyEval_EvalFrame (throwflag=0, frame=0x7ffff777e020, tstate=0x7ffff771fd38 <_PyRuntime+166328>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Include/internal/pycore_ceval.h:73 #51 _PyEval_Vector (tstate=0x7ffff771fd38 <_PyRuntime+166328>, func=<optimized out>, locals=<optimized out>, args=<optimized out>, argcount=<optimized out>, kwnames=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:6435 #52 0x00007ffff74485ac in PyEval_EvalCode (co=0x7ffff6230990, globals=<optimized out>, locals=0x7ffff64f31c0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/ceval.c:1154 #53 0x00007ffff74676e3 in run_eval_code_obj (tstate=0x7ffff771fd38 <_PyRuntime+166328>, co=0x7ffff6230990, globals=0x7ffff64f31c0, locals=0x7ffff64f31c0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/pythonrun.c:1714 #54 0x00007ffff7463c1a in run_mod (mod=<optimized out>, filename=<optimized out>, globals=0x7ffff64f31c0, locals=0x7ffff64f31c0, flags=<optimized out>, arena=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/pythonrun.c:1735 #55 0x00007ffff7479c22 in pyrun_file (fp=fp@entry=0x615000001200, filename=filename@entry=0x7ffff642e9c0, start=start@entry=257, globals=globals@entry=0x7ffff64f31c0, locals=locals@entry=0x7ffff64f31c0, closeit=closeit@entry=1, flags=0x7fffffffd408) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/pythonrun.c:1630 #56 0x00007ffff74793e9 in _PyRun_SimpleFileObject (fp=0x615000001200, filename=0x7ffff642e9c0, closeit=1, flags=0x7fffffffd408) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/pythonrun.c:440 #57 0x00007ffff7479058 in _PyRun_AnyFileObject (fp=0x615000001200, filename=0x7ffff642e9c0, closeit=1, flags=0x7fffffffd408) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Python/pythonrun.c:79 #58 0x00007ffff7472d1b in pymain_run_file_obj (skip_source_first_line=0, filename=0x7ffff642e9c0, program_name=0x7ffff628bfa0) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Modules/main.c:360 #59 pymain_run_file (config=0x7ffff7705d80 <_PyRuntime+59904>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Modules/main.c:379 #60 pymain_run_python (exitcode=0x7fffffffd404) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Modules/main.c:601 #61 Py_RunMain () at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Modules/main.c:680 #62 0x00007ffff743846b in Py_BytesMain (argc=<optimized out>, argv=<optimized out>) at /usr/src/debug/python3.11-3.11.1-3.fc37.x86_64/Modules/main.c:734 #63 0x00007ffff704a510 in __libc_start_call_main (main=main@entry=0x555555555160 <main>, argc=argc@entry=3, argv=argv@entry=0x7fffffffd658) at ../sysdeps/nptl/libc_start_call_main.h:58 #64 0x00007ffff704a5c9 in __libc_start_main_impl (main=0x555555555160 <main>, argc=3, argv=0x7fffffffd658, init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffd648) at ../csu/libc-start.c:381 #65 0x0000555555555095 in _start ()
(In reply to Andreas Schneider from comment #2) > When looking for it I found this: > > https://github.com/google/sanitizers/issues/1365 That's a bit closer to what is going on, but it's still not really it. > Here is a full backtrace of: > > dnf install samba-common-tools > LD_PRELOAD=/usr/lib64/libasan.so.8 gdb --args python3 /usr/bin/samba-tool > --help At the time libasan is initialized, there is no crypt/crypt_r in the process image, so dlsym (with or without RTLD_NEXT) returns a null pointer. I'm pretty sure this issue is present even with glibc's version of libcrypt. It's a bug in libasan: these kind of interceptors only work for shared objects that libasan has among its dependencies.
LLVM patch submitted: https://reviews.llvm.org/D144073
This message is a reminder that Fedora Linux 37 is nearing its end of life. Fedora will stop maintaining and issuing updates for Fedora Linux 37 on 2023-12-05. It is Fedora's policy to close all bug reports from releases that are no longer maintained. At that time this bug will be closed as EOL if it remains open with a 'version' of '37'. Package Maintainer: If you wish for this bug to remain open because you plan to fix it in a currently maintained version, change the 'version' to a later Fedora Linux version. Note that the version field may be hidden. Click the "Show advanced fields" button if you do not see it. Thank you for reporting this issue and we are sorry that we were not able to fix it before Fedora Linux 37 is end of life. If you would still like to see this bug fixed and are able to reproduce it against a later version of Fedora Linux, you are encouraged to change the 'version' to a later version prior to this bug being closed.
Fedora Linux 37 entered end-of-life (EOL) status on 2023-12-05. Fedora Linux 37 is no longer maintained, which means that it will not receive any further security or bug fix updates. As a result we are closing this bug. If you can reproduce this bug against a currently maintained version of Fedora Linux please feel free to reopen this bug against that version. Note that the version field may be hidden. Click the "Show advanced fields" button if you do not see the version field. If you are unable to reopen this bug, please file a new report against an active release. Thank you for reporting this bug and we are sorry it could not be fixed.
LLVM fix was imported into GCC with this: commit d96e14ceb9475f9bccbbc0325d5b11419fad9246 Author: Martin Liska <mliska> Date: Sun Apr 30 09:38:14 2023 +0200 libsanitizer: merge from upstream (87e6e490e79384a5) It was fixed with the GCC 14 imported into rawhide.