Bug 469299 - NSS_DNS Resolver crashes when looking up certain hostnames the very first time
Summary: NSS_DNS Resolver crashes when looking up certain hostnames the very first time
Keywords:
Status: CLOSED RAWHIDE
Alias: None
Product: Fedora
Classification: Fedora
Component: glibc
Version: rawhide
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Jakub Jelinek
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2008-10-31 05:23 UTC by Shawn Starr
Modified: 2008-11-19 15:43 UTC (History)
4 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2008-11-19 15:43:51 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Shawn Starr 2008-10-31 05:23:50 UTC
Description of problem:
When trying to visit http://en.wikipedia.org/wiki/[whatever]  and loading the page in firefox or konqueror the browsers will crash with a SIGABRT


Version-Release number of selected component (if applicable):
glibc-2.8.90-14.i686

(I do not know if this related to what is fixed in -15 or not)

How reproducible:
100% when initially trying to load url above afterwords ok

Steps to Reproduce:
1. load up browser, type in url above, watch browser crash
  
Actual results:
Web browsers crash (you can only reproduce this in either, but you have to have a cold system booted)


Expected results:
Webpage loads corrected DNS lookup ok.

Additional info:
- no nscd cache daemon is being used.
- IPv6 is enabled but no IP configured for interface
 
* Sorry, I don't have firefox debuginfo installed but those symbol addrs can be found in as rawhide is frozen most updates.

Crash from gdb caught:
=====================

Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb2aa7b90 (LWP 6893)]
0x00130416 in __kernel_vsyscall ()
(gdb) bt f
#0  0x00130416 in __kernel_vsyscall ()
No symbol table info available.
#1  0x002a44c0 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
	resultvar = <value optimized out>
	pid = 4100084
	selftid = 6893
#2  0x002a5e88 in abort () at abort.c:88
	act = {__sigaction_handler = {sa_handler = 0x67726f03, sa_sigaction = 0x67726f03}, sa_mask = {__val = {1661166848, 50359663, 7171939, 0, 0, 0, 0, 2997509564, 
      162888408, 46331224, 0 <repeats 22 times>}}, sa_flags = 0, sa_restorer = 0}
	sigs = {__val = {32, 0 <repeats 31 times>}}
#3  0x02c31bad in gaih_getanswer_slice (answer=0xb2aa6390, anslen=<value optimized out>, qname=0xaad70f4 "meta.wikimedia.org", patp=0xb2aa6bb0, bufferp=0xb2aa6bac, 
    buflenp=0xb2aa6ba8, errnop=0xb2aa716c, h_errnop=0xb2aa715c, ttlp=0x0, firstp=0xb2aa6ba4) at nss_dns/dns-host.c:1103
	buffer = 0xb2aa6c1f "calhost6.localdomain6"
	buflen = 993
	pat = (struct gaih_addrtuple **) 0xb2aa7170
	cp = <value optimized out>
	end_of_message = (const u_char *) 0xb2aa6433 "��\201\200"
	packtmp = "\twikimedia\003org\000\003org\000org\000com\000co\002uk", '\0' <repeats 218 times>, "�\033�\001"
	n = <value optimized out>
	haveanswer = 0
	had_error = <value optimized out>
	canon = 0xb2aa6c00 "rr.wikimedia.org"
	h_name = 0xb2aa6c11 "wikimedia.org"
	h_namelen = 14
#4  0x02c3217e in gaih_getanswer (buflen=1024, buffer=0xb2aa6c00 "rr.wikimedia.org", pat=0xb2aa7170) at nss_dns/dns-host.c:1190
No locals.
#5  _nss_dns_gethostbyname4_r (name=0xaad70f4 "meta.wikimedia.org", pat=0xb2aa7170, buffer=0xb2aa6c00 "rr.wikimedia.org", buflen=1024, errnop=0xb2aa716c, 
    herrnop=0xb2aa715c, ttlp=0x0) at nss_dns/dns-host.c:321
	host_buffer = {buf = 0xb2aa6390, ptr = 0xb2aa6390 "�\037\201\200"}
	ans2p = (u_char *) 0xb2aa6433 "��\201\200"
	nans2p = 1885
	resplen2 = 92
	olderr = 0
	status = <value optimized out>
	n = 6
#6  0x00340b63 in gaih_inet (name=0xaad70f4 "meta.wikimedia.org", service=0x0, req=0xb2aa72f8, pai=0xb2aa72b4, naddrs=0xb2aa72a4) at ../sysdeps/posix/getaddrinfo.c:714
	herrno = 1
	pat = (struct gaih_addrtuple **) 0xb2aa7170
	no_inet6_data = 0
	nip = (service_user *) 0x8f1b310
	status = NSS_STATUS_NOTFOUND
	no_more = <value optimized out>
	tmpbuflen = 1024
	tmpbuf = 0xb2aa6c00 "rr.wikimedia.org"
	no_data = 0
	inet6_status = NSS_STATUS_UNAVAIL
	tp = <value optimized out>
	st = (struct gaih_servtuple *) 0xb2aa7040
	at = (struct gaih_addrtuple *) 0xb2aa7010
	rc = 0
	got_ipv6 = false
	canon = 0x0
	port = <value optimized out>
	__PRETTY_FUNCTION__ = "gaih_inet"
#7  0x003428a7 in getaddrinfo (name=0xaad70f4 "meta.wikimedia.org", service=0x0, hints=0xb2aa72f8, pai=0xb2aa7318) at ../sysdeps/posix/getaddrinfo.c:2154
	i = <value optimized out>
	last_i = <value optimized out>
	nresults = <value optimized out>
	p = (struct addrinfo *) 0x0
	gaih_service = {name = 0xb2aa72ac "\004", num = 5022282}
	pservice = (struct gaih_service *) 0x6
	local_hints = {ai_flags = -1297452456, ai_family = 1294396, ai_socktype = 150596436, ai_protocol = 0, ai_addrlen = 66, ai_addr = 0xb2aa72ac, 
  ai_canonname = 0x13d494 "\203�\030\205�\017D�[^_]�\211�\203{ �\017\225�\203�\001\201�\200", ai_next = 0x0}
	in6ai = (struct in6addrinfo *) 0x9f1eff0
	in6ailen = 4
	seen_ipv4 = true
	seen_ipv6 = true
	naddrs = 0
	__PRETTY_FUNCTION__ = "getaddrinfo"
	once = 2
	lock = 0
#8  0x004cc5f9 in PR_GetAddrInfoByName () from /lib/libnspr4.so
No symbol table info available.
#9  0x006e5606 in ?? () from /usr/lib/xulrunner-1.9/libxul.so
No symbol table info available.
#10 0x004da0b1 in ?? () from /lib/libnspr4.so
No symbol table info available.
#11 0x0013951f in start_thread (arg=0xb2aa7b90) at pthread_create.c:297
	__res = <value optimized out>
	__ignore1 = <value optimized out>
	__ignore2 = <value optimized out>
	pd = (struct pthread *) 0xb2aa7b90
	now = <value optimized out>
	unwind_buf = {cancel_jmp_buf = {{jmp_buf = {1351668, 0, 0, -1297451864, 32299093, 1914865456}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {
      prev = 0x0, cleanup = 0x0, canceltype = 0}}}
	not_first_call = <value optimized out>
	robust = <value optimized out>
#12 0x0035d02e in clone () from /lib/libc.so.6

Comment 1 Shawn Starr 2008-10-31 19:13:42 UTC
Is this related to #466786

Comment 2 Shawn Starr 2008-10-31 19:14:11 UTC
Is this related to bug 466786

Comment 3 Ulrich Drepper 2008-11-07 13:59:24 UTC
We need the network traffic recorded for this.  Run wireshark to capture DNS traffic and then look up that site.

The servers shouldn't reply with anything but IPv4 or IPv6 addresses.  It seems the server you use does.

Comment 5 Mads Kiilerich 2008-11-13 19:09:25 UTC
I have created Bug 471450 which might be related

Comment 6 Shawn Starr 2008-11-19 15:43:51 UTC
With the workaround added by Ulrich,  this is fixed.


Note You need to log in before you can comment on or make changes to this bug.