Bug 971513 - segfault when installing FreeIPA
segfault when installing FreeIPA
Status: CLOSED ERRATA
Product: Fedora
Classification: Fedora
Component: libbsd (Show other bugs)
19
Unspecified Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Eric Smith
Fedora Extras Quality Assurance
:
Depends On:
Blocks: 971509
  Show dependency treegraph
 
Reported: 2013-06-06 12:58 EDT by Rob Crittenden
Modified: 2013-06-13 02:44 EDT (History)
2 users (show)

See Also:
Fixed In Version: libbsd-0.5.2-1.fc19
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-06-13 02:44:53 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
FreeDesktop.org 65470 None None None Never

  None (edit)
Description Rob Crittenden 2013-06-06 12:58:16 EDT
Description of problem:

We are seeing a segmentation fault in kdb5_util when creating the Kerberos database in a FreeIPA installation.

Version-Release number of selected component (if applicable):
libbsd-0.5.1-1

How reproducible:

Every time

Steps to Reproduce:
1. yum -y install freeipa-server
2. ipa-server-install -a password -p password

Actual results:

Segmentation fault

Additional info:

I paused the IPA install so I could run kdb5_util in gdb to get a stack trace.

(gdb) run create -s -r GREYOAK.COM -x ipa-setup-override-restrictions
(gdb) where
#0  __strchr_sse2 () at ../sysdeps/x86_64/strchr.S:32
#1  0x00007fffec389cdb in spt_init () from /lib64/libbsd.so.0
#2  0x00007ffff7deb4f3 in call_init (env=0x55555577ee10, argv=0x7fffffffe548, 
    argc=7, l=<optimized out>) at dl-init.c:82
#3  _dl_init (main_map=main_map@entry=0x5555557ba770, argc=7, 
    argv=0x7fffffffe548, env=0x55555577ee10) at dl-init.c:131
#4  0x00007ffff7defb04 in dl_open_worker (a=a@entry=0x7fffffffdb98)
    at dl-open.c:566
#5  0x00007ffff7deb304 in _dl_catch_error (
    objname=objname@entry=0x7fffffffdb88, 
    errstring=errstring@entry=0x7fffffffdb90, 
    mallocedp=mallocedp@entry=0x7fffffffdb80, 
    operate=operate@entry=0x7ffff7def770 <dl_open_worker>, 
    args=args@entry=0x7fffffffdb98) at dl-error.c:177
#6  0x00007ffff7def21b in _dl_open (
    file=0x5555557ba6f0 "/usr/lib64/krb5/plugins/kdb/ipadb.so", 
    mode=-2147483646, caller_dlopen=0x7ffff6a143cd <krb5int_open_plugin+349>, 
    nsid=-2, argc=7, argv=<optimized out>, env=0x55555577ee10) at dl-open.c:656
#7  0x00007ffff733502b in dlopen_doit (a=a@entry=0x7fffffffdda0) at dlopen.c:66
#8  0x00007ffff7deb304 in _dl_catch_error (objname=0x555555772cf0, 
    errstring=0x555555772cf8, mallocedp=0x555555772ce8, 
    operate=0x7ffff7334fd0 <dlopen_doit>, args=0x7fffffffdda0)
    at dl-error.c:177
#9  0x00007ffff733562d in _dlerror_run (
    operate=operate@entry=0x7ffff7334fd0 <dlopen_doit>, 
    args=args@entry=0x7fffffffdda0) at dlerror.c:163
#10 0x00007ffff73350c1 in __dlopen (file=<optimized out>, mode=<optimized out>)
    at dlopen.c:87
#11 0x00007ffff6a143cd in krb5int_open_plugin (
    filepath=0x5555557ba6f0 "/usr/lib64/krb5/plugins/kdb/ipadb.so", 
    h=h@entry=0x7fffffffdee8, ep=ep@entry=0x55555577d928) at plugins.c:266
#12 0x00007ffff6a14668 in krb5int_open_plugin_dirs (
    dirnames=dirnames@entry=0x5555557ba490, 
    filebases=filebases@entry=0x7fffffffdf70, 
    dirhandle=dirhandle@entry=0x5555557ba538, ep=ep@entry=0x55555577d928)
    at plugins.c:600
#13 0x00007ffff79a61d8 in kdb_load_library (lib=<synthetic pointer>, 
    lib_name=<optimized out>, kcontext=0x55555577d870) at kdb5.c:391
#14 kdb_find_library (lib=<synthetic pointer>, lib_name=<optimized out>, 
    kcontext=0x55555577d870) at kdb5.c:481
#15 krb5_db_setup_lib_handle (kcontext=0x55555577d870) at kdb5.c:561
#16 0x00007ffff79a65ca in get_vftabl (kcontext=kcontext@entry=0x55555577d870, 
    vftabl_ptr=vftabl_ptr@entry=0x7fffffffe010) at kdb5.c:603
#17 0x00007ffff79a66ab in krb5_db_open (kcontext=0x55555577d870, 
    db_args=db_args@entry=0x55555576faa0, mode=mode@entry=512) at kdb5.c:621
#18 0x00007ffff7bca39e in kadm5_init (context=context@entry=0x55555577d870, 
    client_name=0x7fffffffe7ba "kdb5_util", pass=pass@entry=0x0, 
    service_name=service_name@entry=0x0, 
    params_in=params_in@entry=0x7fffffffe250, 
    struct_version=struct_version@entry=305419777, 
    api_version=api_version@entry=305420036, db_args=0x55555576faa0, 
    server_handle=server_handle@entry=0x7fffffffe178) at server_init.c:263
#19 0x000055555555b1c8 in kadm5_create_magic_princs (
    params=params@entry=0x7fffffffe250, context=0x55555577d870)
    at kadm5_create.c:109
#20 0x000055555555b4be in kadm5_create (
    params=params@entry=0x55555576c680 <global_params>) at kadm5_create.c:92
#21 0x000055555555ab7c in kdb5_create (argc=<optimized out>, 
    argv=<optimized out>) at kdb5_create.c:363
#22 0x00005555555593f3 in main (argc=<optimized out>, argv=<optimized out>)
    at kdb5_util.c:344
Comment 1 Nalin Dahyabhai 2013-06-06 13:13:45 EDT
The top couple of frames in my backtrace (with a little more debuginfo) look like this:

#0  __strchr_sse2 () at ../sysdeps/x86_64/strchr.S:32
#1  0x00007fffec389cdb in spt_copyenv (oldenv=0x55555577ec10)
    at setproctitle.c:94
#2  spt_init (argc=8, argv=0x7fffffffe448, envp=0x55555577ec10)
    at setproctitle.c:172

I think that spt_init's use of the passed-in value of "environ" is causing some trouble because when it calls spt_clearenv(), and spt_clearenv() ends up calling clearenv(), the value is freed before it's read.

Patching spt_clearenv() to behave as if HAVE_CLEARENV isn't defined keeps it from crashing on my system, as the fallback path doesn't actually free the old environment.
Comment 2 Eric Smith 2013-06-06 16:07:57 EDT
I'm going to patch setproctitle to not call clearenv(), as Nalin described, until upstream releases a fixed version.
Comment 3 Fedora Update System 2013-06-06 16:47:23 EDT
libbsd-0.5.1-2.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/libbsd-0.5.1-2.fc19
Comment 4 Fedora Update System 2013-06-07 11:37:44 EDT
Package libbsd-0.5.1-2.fc19:
* should fix your issue,
* was pushed to the Fedora 19 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing libbsd-0.5.1-2.fc19'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2013-10259/libbsd-0.5.1-2.fc19
then log in and leave karma (feedback).
Comment 5 Fedora Update System 2013-06-10 15:48:36 EDT
libbsd-0.5.2-1.fc19 has been submitted as an update for Fedora 19.
https://admin.fedoraproject.org/updates/libbsd-0.5.2-1.fc19
Comment 6 Fedora Update System 2013-06-13 02:44:53 EDT
libbsd-0.5.2-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.