Bug 971513 - segfault when installing FreeIPA
Summary: segfault when installing FreeIPA
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: libbsd
Version: 19
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Eric Smith
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: 971509
TreeView+ depends on / blocked
 
Reported: 2013-06-06 16:58 UTC by Rob Crittenden
Modified: 2013-06-13 06:44 UTC (History)
2 users (show)

Fixed In Version: libbsd-0.5.2-1.fc19
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-06-13 06:44:53 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
FreeDesktop.org 65470 0 None None None Never

Description Rob Crittenden 2013-06-06 16:58:16 UTC
Description of problem:

We are seeing a segmentation fault in kdb5_util when creating the Kerberos database in a FreeIPA installation.

Version-Release number of selected component (if applicable):
libbsd-0.5.1-1

How reproducible:

Every time

Steps to Reproduce:
1. yum -y install freeipa-server
2. ipa-server-install -a password -p password

Actual results:

Segmentation fault

Additional info:

I paused the IPA install so I could run kdb5_util in gdb to get a stack trace.

(gdb) run create -s -r GREYOAK.COM -x ipa-setup-override-restrictions
(gdb) where
#0  __strchr_sse2 () at ../sysdeps/x86_64/strchr.S:32
#1  0x00007fffec389cdb in spt_init () from /lib64/libbsd.so.0
#2  0x00007ffff7deb4f3 in call_init (env=0x55555577ee10, argv=0x7fffffffe548, 
    argc=7, l=<optimized out>) at dl-init.c:82
#3  _dl_init (main_map=main_map@entry=0x5555557ba770, argc=7, 
    argv=0x7fffffffe548, env=0x55555577ee10) at dl-init.c:131
#4  0x00007ffff7defb04 in dl_open_worker (a=a@entry=0x7fffffffdb98)
    at dl-open.c:566
#5  0x00007ffff7deb304 in _dl_catch_error (
    objname=objname@entry=0x7fffffffdb88, 
    errstring=errstring@entry=0x7fffffffdb90, 
    mallocedp=mallocedp@entry=0x7fffffffdb80, 
    operate=operate@entry=0x7ffff7def770 <dl_open_worker>, 
    args=args@entry=0x7fffffffdb98) at dl-error.c:177
#6  0x00007ffff7def21b in _dl_open (
    file=0x5555557ba6f0 "/usr/lib64/krb5/plugins/kdb/ipadb.so", 
    mode=-2147483646, caller_dlopen=0x7ffff6a143cd <krb5int_open_plugin+349>, 
    nsid=-2, argc=7, argv=<optimized out>, env=0x55555577ee10) at dl-open.c:656
#7  0x00007ffff733502b in dlopen_doit (a=a@entry=0x7fffffffdda0) at dlopen.c:66
#8  0x00007ffff7deb304 in _dl_catch_error (objname=0x555555772cf0, 
    errstring=0x555555772cf8, mallocedp=0x555555772ce8, 
    operate=0x7ffff7334fd0 <dlopen_doit>, args=0x7fffffffdda0)
    at dl-error.c:177
#9  0x00007ffff733562d in _dlerror_run (
    operate=operate@entry=0x7ffff7334fd0 <dlopen_doit>, 
    args=args@entry=0x7fffffffdda0) at dlerror.c:163
#10 0x00007ffff73350c1 in __dlopen (file=<optimized out>, mode=<optimized out>)
    at dlopen.c:87
#11 0x00007ffff6a143cd in krb5int_open_plugin (
    filepath=0x5555557ba6f0 "/usr/lib64/krb5/plugins/kdb/ipadb.so", 
    h=h@entry=0x7fffffffdee8, ep=ep@entry=0x55555577d928) at plugins.c:266
#12 0x00007ffff6a14668 in krb5int_open_plugin_dirs (
    dirnames=dirnames@entry=0x5555557ba490, 
    filebases=filebases@entry=0x7fffffffdf70, 
    dirhandle=dirhandle@entry=0x5555557ba538, ep=ep@entry=0x55555577d928)
    at plugins.c:600
#13 0x00007ffff79a61d8 in kdb_load_library (lib=<synthetic pointer>, 
    lib_name=<optimized out>, kcontext=0x55555577d870) at kdb5.c:391
#14 kdb_find_library (lib=<synthetic pointer>, lib_name=<optimized out>, 
    kcontext=0x55555577d870) at kdb5.c:481
#15 krb5_db_setup_lib_handle (kcontext=0x55555577d870) at kdb5.c:561
#16 0x00007ffff79a65ca in get_vftabl (kcontext=kcontext@entry=0x55555577d870, 
    vftabl_ptr=vftabl_ptr@entry=0x7fffffffe010) at kdb5.c:603
#17 0x00007ffff79a66ab in krb5_db_open (kcontext=0x55555577d870, 
    db_args=db_args@entry=0x55555576faa0, mode=mode@entry=512) at kdb5.c:621
#18 0x00007ffff7bca39e in kadm5_init (context=context@entry=0x55555577d870, 
    client_name=0x7fffffffe7ba "kdb5_util", pass=pass@entry=0x0, 
    service_name=service_name@entry=0x0, 
    params_in=params_in@entry=0x7fffffffe250, 
    struct_version=struct_version@entry=305419777, 
    api_version=api_version@entry=305420036, db_args=0x55555576faa0, 
    server_handle=server_handle@entry=0x7fffffffe178) at server_init.c:263
#19 0x000055555555b1c8 in kadm5_create_magic_princs (
    params=params@entry=0x7fffffffe250, context=0x55555577d870)
    at kadm5_create.c:109
#20 0x000055555555b4be in kadm5_create (
    params=params@entry=0x55555576c680 <global_params>) at kadm5_create.c:92
#21 0x000055555555ab7c in kdb5_create (argc=<optimized out>, 
    argv=<optimized out>) at kdb5_create.c:363
#22 0x00005555555593f3 in main (argc=<optimized out>, argv=<optimized out>)
    at kdb5_util.c:344

Comment 1 Nalin Dahyabhai 2013-06-06 17:13:45 UTC
The top couple of frames in my backtrace (with a little more debuginfo) look like this:

#0  __strchr_sse2 () at ../sysdeps/x86_64/strchr.S:32
#1  0x00007fffec389cdb in spt_copyenv (oldenv=0x55555577ec10)
    at setproctitle.c:94
#2  spt_init (argc=8, argv=0x7fffffffe448, envp=0x55555577ec10)
    at setproctitle.c:172

I think that spt_init's use of the passed-in value of "environ" is causing some trouble because when it calls spt_clearenv(), and spt_clearenv() ends up calling clearenv(), the value is freed before it's read.

Patching spt_clearenv() to behave as if HAVE_CLEARENV isn't defined keeps it from crashing on my system, as the fallback path doesn't actually free the old environment.

Comment 2 Eric Smith 2013-06-06 20:07:57 UTC
I'm going to patch setproctitle to not call clearenv(), as Nalin described, until upstream releases a fixed version.

Comment 3 Fedora Update System 2013-06-06 20:47:23 UTC
libbsd-0.5.1-2.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/libbsd-0.5.1-2.fc19

Comment 4 Fedora Update System 2013-06-07 15:37:44 UTC
Package libbsd-0.5.1-2.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libbsd-0.5.1-2.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-10259/libbsd-0.5.1-2.fc19
then log in and leave karma (feedback).

Comment 5 Fedora Update System 2013-06-10 19:48:36 UTC
libbsd-0.5.2-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/libbsd-0.5.2-1.fc19

Comment 6 Fedora Update System 2013-06-13 06:44:53 UTC
libbsd-0.5.2-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.