Bug 998937 - [abrt] ypbind-1.37.1-3.fc19: __netlink_free_handle: Process /usr/sbin/ypbind was killed by signal 6 (SIGABRT)
[abrt] ypbind-1.37.1-3.fc19: __netlink_free_handle: Process /usr/sbin/ypbind ...
Status: CLOSED EOL
Product: Fedora
Classification: Fedora
Component: ypbind (Show other bugs)
19
x86_64 Unspecified
unspecified Severity unspecified
: ---
: ---
Assigned To: Matej Mužila
Fedora Extras Quality Assurance
abrt_hash:67ce037c2643bf90d5c91fa33e5...
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-08-20 07:34 EDT by Edgar Hoch
Modified: 2015-02-17 11:50 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2015-02-17 11:50:43 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
File: backtrace (20.22 KB, text/plain)
2013-08-20 07:34 EDT, Edgar Hoch
no flags Details
File: cgroup (158 bytes, text/plain)
2013-08-20 07:34 EDT, Edgar Hoch
no flags Details
File: core_backtrace (13.85 KB, text/plain)
2013-08-20 07:34 EDT, Edgar Hoch
no flags Details
File: dso_list (1.84 KB, text/plain)
2013-08-20 07:35 EDT, Edgar Hoch
no flags Details
File: environ (193 bytes, text/plain)
2013-08-20 07:35 EDT, Edgar Hoch
no flags Details
File: limits (1.29 KB, text/plain)
2013-08-20 07:35 EDT, Edgar Hoch
no flags Details
File: maps (9.67 KB, text/plain)
2013-08-20 07:35 EDT, Edgar Hoch
no flags Details
File: open_fds (400 bytes, text/plain)
2013-08-20 07:35 EDT, Edgar Hoch
no flags Details
File: proc_pid_status (889 bytes, text/plain)
2013-08-20 07:35 EDT, Edgar Hoch
no flags Details
File: var_log_messages (12.76 KB, text/plain)
2013-08-20 07:35 EDT, Edgar Hoch
no flags Details
Lines with ypbind from /var/log/messages (35.39 KB, text/plain)
2013-08-20 15:21 EDT, Edgar Hoch
no flags Details

  None (edit)
Description Edgar Hoch 2013-08-20 07:34:45 EDT
Description of problem:
The system was booting.


[New LWP 829]
[New LWP 872]
[New LWP 849]
[New LWP 850]
Traceback (most recent call last):
  File "/usr/share/gdb/auto-load/usr/lib64/libgobject-2.0.so.0.3600.3-gdb.py", line 9, in <module>
    from gobject import register
  File "/usr/share/glib-2.0/gdb/gobject.py", line 3, in <module>
    import gdb.backtrace
ImportError: No module named backtrace
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
Core was generated by `/usr/sbin/ypbind -n'.
Program terminated with signal 6, Aborted.
#0  0x00007fcf38853a19 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56	../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.

Thread 4 (Thread 0x7fcf306cf700 (LWP 850)):
#0  __lll_lock_wait () at ../nptl/sysdeps/unix/sysv/linux/x86_64/lowlevellock.S:135
No locals.
#1  0x00007fcf38e00ba1 in _L_lock_790 () from /lib64/libpthread.so.0
No symbol table info available.
#2  0x00007fcf38e00aa7 in __GI___pthread_mutex_lock (mutex=mutex@entry=0x7fcf3a02e140 <search_lock>) at pthread_mutex_lock.c:64
        type = 0
        id = 850
#3  0x00007fcf39e29ec6 in do_binding () at serv_list.c:1105
        i = <optimized out>
        active = <optimized out>
#4  0x00007fcf39e2adc2 in go_online () at ypbind_dbus_nm.c:105
No locals.
#5  dbus_filter (connection=0x7fcf28001460, message=0x7fcf280042a0, user_data=<optimized out>) at ypbind_dbus_nm.c:176
        state = NM_STATE_CONNECTED_GLOBAL
        handled = <optimized out>
        connection = 0x7fcf28001460
        user_data = <optimized out>
        message = 0x7fcf280042a0
        handled = DBUS_HANDLER_RESULT_NOT_YET_HANDLED
#6  0x00007fcf397a19e6 in dbus_connection_dispatch (connection=connection@entry=0x7fcf28001460) at dbus-connection.c:4631
        filter = <optimized out>
        next = 0x0
        message = 0x7fcf280042a0
        link = <optimized out>
        filter_list_copy = 0x7fcf28000a20
        message_link = 0x7fcf28000a08
        result = DBUS_HANDLER_RESULT_NOT_YET_HANDLED
        pending = <optimized out>
        reply_serial = <optimized out>
        status = <optimized out>
        found_object = 32719
        __FUNCTION__ = "dbus_connection_dispatch"
#7  0x00007fcf399e2cc5 in message_queue_dispatch (source=source@entry=0x7fcf28005500, callback=<optimized out>, user_data=<optimized out>) at dbus-gmain.c:90
        connection = 0x7fcf28001460
#8  0x00007fcf3925ee06 in g_main_dispatch (context=0x7fcf280018a0) at gmain.c:3054
        dispatch = 0x7fcf399e2cb0 <message_queue_dispatch>
        was_in_call = 0
        user_data = 0x0
        callback = 0x0
        cb_funcs = 0x0
        cb_data = 0x0
        need_destroy = <optimized out>
        current_source_link = {data = 0x7fcf28005500, next = 0x0}
        source = 0x7fcf28005500
        current = 0x7fcf28005160
        i = 0
#9  g_main_context_dispatch (context=context@entry=0x7fcf280018a0) at gmain.c:3630
No locals.
#10 0x00007fcf3925f158 in g_main_context_iterate (context=0x7fcf280018a0, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>) at gmain.c:3701
        max_priority = 0
        timeout = 0
        some_ready = 1
        nfds = <optimized out>
        allocated_nfds = 2
        fds = 0x7fcf280055a0
#11 0x00007fcf3925f55a in g_main_loop_run (loop=0x7fcf28000990) at gmain.c:3895
        __PRETTY_FUNCTION__ = "g_main_loop_run"
#12 0x00007fcf39e2afe1 in watch_dbus_nm (param=<optimized out>) at ypbind_dbus_nm.c:416
        status = 1
        loop = <optimized out>
        dbus_init_ret = 1
#13 0x00007fcf38dfec53 in start_thread (arg=0x7fcf306cf700) at pthread_create.c:308
        __res = <optimized out>
        pd = 0x7fcf306cf700
        now = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140527847405312, 8619424248616730436, 0, 140527847406016, 140527847405312, 140733883108152, -8646849203350257852, -8646866134193520828}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
        pagesize_m1 = <optimized out>
        sp = <optimized out>
        freesize = <optimized out>
#14 0x00007fcf3891313d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
No locals.

Thread 3 (Thread 0x7fcf30ed0700 (LWP 849)):
#0  0x00007fcf38e05d41 in do_sigwait (sig=0x7fcf30ecfd6c, set=<optimized out>) at ../sysdeps/unix/sysv/linux/sigwait.c:61
        __arg4 = 8
        __arg2 = 0
        _a3 = 0
        _a1 = 140527855795600
        resultvar = <optimized out>
        __arg3 = 0
        __arg1 = 140527855795600
        _a4 = 8
        _a2 = 0
        ret = <optimized out>
        tmpset = {__val = {829, 140527855798016, 0, 0, 0, 0, 0, 140528005702488, 140527034957840, 140527855795552, 140527855795488, 140527989137211, 4294967295, 0, 140527855795600, 140528005704080}}
#1  __sigwait (set=set@entry=0x7fcf30ecfd90, sig=sig@entry=0x7fcf30ecfd6c) at ../sysdeps/unix/sysv/linux/sigwait.c:99
        oldtype = 0
        result = 128
#2  0x00007fcf39e26ee3 in sig_handler (v_param=<optimized out>) at ypbind-mt.c:443
        ret = <optimized out>
        lock = {l_type = 0, l_whence = 0, l_start = 0, l_len = 0, l_pid = 0}
        sigs_to_catch = {__val = {87047, 0 <repeats 15 times>}}
        caught = 0
#3  0x00007fcf38dfec53 in start_thread (arg=0x7fcf30ed0700) at pthread_create.c:308
        __res = <optimized out>
        pd = 0x7fcf30ed0700
        now = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140527855798016, 8619424248616730436, 0, 140527855798720, 140527855798016, 140733883108152, -8646848104375500988, -8646866134193520828}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
        pagesize_m1 = <optimized out>
        sp = <optimized out>
        freesize = <optimized out>
#4  0x00007fcf3891313d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
No locals.

Thread 2 (Thread 0x7fcf2fece700 (LWP 872)):
#0  0x00007fcf388da71d in nanosleep () at ../sysdeps/unix/syscall-template.S:81
No locals.
#1  0x00007fcf388da5b4 in __sleep (seconds=0) at ../sysdeps/unix/sysv/linux/sleep.c:137
        ts = {tv_sec = 11, tv_nsec = 636465800}
        set = {__val = {65536, 0 <repeats 15 times>}}
        oset = {__val = {87047, 140527839010192, 140528008225044, 140528006107096, 1, 0, 140528041050592, 1376985848, 140527571830976, 0, 18446744069414584320, 0, 0, 0, 34359738369, 140528041050592}}
        result = <optimized out>
#2  0x00007fcf39e2a50e in test_bindings (param=<optimized out>) at serv_list.c:1141
        success = 0
        lastcheck = 0
#3  0x00007fcf38dfec53 in start_thread (arg=0x7fcf2fece700) at pthread_create.c:308
        __res = <optimized out>
        pd = 0x7fcf2fece700
        now = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140527839012608, 8619424248616730436, 0, 140527839013312, 140527839012608, 4294967295, -8646903081030631612, -8646866134193520828}, mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x0, 0x0}, data = {prev = 0x0, cleanup = 0x0, canceltype = 0}}}
        not_first_call = <optimized out>
        pagesize_m1 = <optimized out>
        sp = <optimized out>
        freesize = <optimized out>
#4  0x00007fcf3891313d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113
No locals.

Thread 1 (Thread 0x7fcf39dbf800 (LWP 829)):
#0  0x00007fcf38853a19 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
        resultvar = 0
        pid = 829
        selftid = 829
#1  0x00007fcf38855128 in __GI_abort () at abort.c:90
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0x7fcf3899944d, sa_sigaction = 0x7fcf3899944d}, sa_mask = {__val = {3, 140733883101820, 4, 140527984543264, 1, 140527984551929, 3, 140733883101796, 12, 140527984551933, 2, 140527984551933, 2, 140733883102608, 140733883102608, 140733883104368}}, sa_flags = 16, sa_restorer = 0x7fff291c3790}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x00007fcf38893d47 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fcf3899bb88 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:196
        ap = {{gp_offset = 40, fp_offset = 48, overflow_arg_area = 0x7fff291c3c80, reg_save_area = 0x7fff291c3b90}}
        ap_copy = {{gp_offset = 16, fp_offset = 48, overflow_arg_area = 0x7fff291c3c80, reg_save_area = 0x7fff291c3b90}}
        fd = 2
        on_2 = <optimized out>
        list = <optimized out>
        nlist = <optimized out>
        cp = <optimized out>
        written = <optimized out>
#3  0x00007fcf3889b0e8 in malloc_printerr (ptr=<optimized out>, str=0x7fcf3899bc40 "double free or corruption (out)", action=3) at malloc.c:4916
        buf = "00007fcf3bf80980"
        cp = <optimized out>
#4  _int_free (av=0x7fcf38bd7780 <main_arena>, p=<optimized out>, have_lock=0) at malloc.c:3768
        size = <optimized out>
        fb = <optimized out>
        nextchunk = <optimized out>
        nextsize = <optimized out>
        nextinuse = <optimized out>
        prevsize = <optimized out>
        bck = <optimized out>
        fwd = <optimized out>
        errstr = 0x7fcf3899bc40 "double free or corruption (out)"
        locked = <optimized out>
#5  0x00007fcf3893460b in __netlink_free_handle (h=h@entry=0x7fff291c3dc0) at ../sysdeps/unix/sysv/linux/ifaddrs.c:86
        tmpptr = 0x7fcf3bf81650
        ptr = <optimized out>
        saved_errno = 9
#6  0x00007fcf38934b08 in getifaddrs_internal (ifap=ifap@entry=0x7fff291c3f40) at ../sysdeps/unix/sysv/linux/ifaddrs.c:815
        nh = {fd = 9, pid = 829, seq = 1376985551, nlm_list = 0x7fcf3bf80980, end_ptr = 0x7fcf3bf81850}
        nlp = <optimized out>
        ifas = <optimized out>
        i = <optimized out>
        newlink = <optimized out>
        newaddr = <optimized out>
        newaddr_idx = <optimized out>
        map_newlink_data = <optimized out>
        ifa_data_size = <optimized out>
        ifa_data_ptr = <optimized out>
        result = 0
#7  0x00007fcf38935700 in __GI_getifaddrs (ifap=ifap@entry=0x7fff291c3f40) at ../sysdeps/unix/sysv/linux/ifaddrs.c:831
        res = 0
#8  0x00007fcf3894096e in is_network_up (sock=<optimized out>) at clnt_udp.c:277
        ifa = 0x7fcf3bf81890
        run = <optimized out>
#9  clntudp_call (cl=<optimized out>, proc=2, xargs=0x0, argsp=0x0, xresults=0x7fcf38945d50 <__GI_xdr_bool>, resultsp=0x7fff291c4090 "", utimeout=...) at clnt_udp.c:386
        cu = 0x7fcf3bf7c1e0
        xdrs = 0x7fcf3bf7c238
        outlen = 0
        inlen = <optimized out>
        fromlen = 689717424
        fd = {fd = 8, events = 1, revents = 0}
        milliseconds = 5000
        from = {sin_family = 25954, sin_port = 26482, sin_addr = {s_addr = 1936287085}, sin_zero = "e.ims.un"}
        reply_msg = {rm_xid = 562608583, rm_direction = CALL, ru = {RM_cmb = {cb_rpcvers = 2, cb_prog = 0, cb_vers = 0, cb_proc = 0, cb_cred = {oa_flavor = 0, oa_base = 0x7fff291c4090 "", oa_length = 949247312}, cb_verf = {oa_flavor = 24, oa_base = 0x2 <Address 0x2 out of bounds>, oa_length = 1006113264}}, RM_rmb = {rp_stat = (unknown: 2), ru = {RP_ar = {ar_verf = {oa_flavor = 0, oa_base = 0x0, oa_length = 0}, ar_stat = SUCCESS, ru = {AR_versions = {low = 140733883105424, high = 140527984205136}, AR_results = {where = 0x7fff291c4090 "", proc = 0x7fcf38945d50 <__GI_xdr_bool>}}}, RP_dr = {rj_stat = RPC_MISMATCH, ru = {RJ_versions = {low = 0, high = 0}, RJ_why = AUTH_OK}}}}}}
        reply_xdrs = {x_op = (unknown: 17760), x_ops = 0x7fcf38937624 <__GI_authnone_create+276>, x_public = 0x0, x_private = 0x7fcf3893e327 <_create_xid+119> "\203=\306\354)", x_base = 0x7fff291c3f80 "\307\271\210!", x_handy = 949246123}
        time_waited = {tv_sec = 0, tv_usec = 0}
        ok = <optimized out>
        nrefreshes = <optimized out>
        timeout = {tv_sec = 0, tv_usec = 0}
        anyup = 0
#10 0x00007fcf39e28d7e in ping_all (list=0x7fcf3bf7c1e0) at serv_list.c:915
        TIMEOUT00 = {tv_sec = 0, tv_usec = 0}
        clnt = 0x7fcf3bf7c1c0
        pings = <optimized out>
        s_in = {sin_family = 2, sin_port = 37378, sin_addr = {s_addr = 2608806541}, sin_zero = "\000\000\000\000\000\000\000"}
        any = 0x7fcf3bf7c1a8
        found = 0
        xid_seed = 689717392
        xid_lookup = <optimized out>
        sock = 8
        dontblock = 1
        clnt_res = 0
        i = 3
        pings_count = 3
        cu = 0x7fcf3bf7c1e0
        domain = 0x7fcf3bf7c1e0 "\b"
        old_active = -1
#11 0x00007fcf39e2a1e7 in test_bindings_once (lastcheck=lastcheck@entry=1, req_domain=req_domain@entry=0x7fcf3bf7c120 "mydomain") at serv_list.c:1274
        domain = 0x7fcf3bf7c1e0 "\b"
        out = 1
        status = RPC_SUCCESS
        i = 0
        active = -1
#12 0x00007fcf39e2790d in ypbindproc_domain (domain_name=0x7fcf3bf7c120 "mydomain", result=0x7fff291c41d0, rqstp=<optimized out>) at ypbind_server.c:88
No locals.
#13 0x00007fcf39e27785 in ypbindprog_2 (rqstp=0x7fff291c4240, transp=0x7fcf3bf7c820) at ypbind_svc.c:176
        argument = {ypbindproc_domain_2_arg = 0x7fcf3bf7c120 "mydomain", ypbindproc_setdom_2_arg = {ypsetdom_domain = 0x7fcf3bf7c120 "mydomain", ypsetdom_binding = {ypbind_binding_addr = "\000\000\000", ypbind_binding_port = "\000"}, ypsetdom_vers = 0}}
        result = {ypbindproc_domain_2_res = {ypbind_status = YPBIND_FAIL_VAL, ypbind_resp_u = {ypbind_error = 2, ypbind_bindinfo = {ypbind_binding_addr = "\002\000\000", ypbind_binding_port = "\000"}}}}
        retval = <optimized out>
        xdr_argument = 0x7fcf39e27280 <ypbind_xdr_domainname>
        xdr_result = 0x7fcf39e27300 <ypbind_xdr_resp>
        local = 0x7fcf39e27be0 <ypbindproc_domain_2_svc>
#14 0x00007fcf38943991 in __GI_svc_getreq_common (fd=fd@entry=6) at svc.c:534
        s = <optimized out>
        high_vers = <optimized out>
        r = {rq_prog = 100007, rq_vers = 2, rq_proc = 1, rq_cred = {oa_flavor = 0, oa_base = 0x7fff291c4340 "\020F\034)\377\177", oa_length = 0}, rq_clntcred = 0x7fff291c4660 "`\034\370;\317\177", rq_xprt = 0x7fcf3bf7c820}
        why = <optimized out>
        low_vers = <optimized out>
        prog_found = <optimized out>
        stat = <optimized out>
        msg = {rm_xid = 1174538895, rm_direction = CALL, ru = {RM_cmb = {cb_rpcvers = 2, cb_prog = 100007, cb_vers = 2, cb_proc = 1, cb_cred = {oa_flavor = 0, oa_base = 0x7fff291c4340 "\020F\034)\377\177", oa_length = 0}, cb_verf = {oa_flavor = 0, oa_base = 0x7fff291c44d0 "\001\200\255\373", oa_length = 0}}, RM_rmb = {rp_stat = (unknown: 2), ru = {RP_ar = {ar_verf = {oa_flavor = 100007, oa_base = 0x2 <Address 0x2 out of bounds>, oa_length = 1}, ar_stat = SUCCESS, ru = {AR_versions = {low = 140733883106112, high = 0}, AR_results = {where = 0x7fff291c4340 "\020F\034)\377\177", proc = 0x0}}}, RP_dr = {rj_stat = (AUTH_ERROR | unknown: 100006), ru = {RJ_versions = {low = 2, high = 1}, RJ_why = AUTH_REJECTEDCRED}}}}}}
        xprt = 0x7fcf3bf7c820
        cred_area = "\020F\034)\377\177\000\000\322\301\300\071\317\177\000\000P_\340\070\317\177\000\000\320D\034)\377\177\000\000\000\000\000\000\377\177\000\000\000\000\000\000\000\000\000\000\320\\!9\317\177\000\000\322\301\300\071\317\177\000\000\230\t\342\071\317\177", '\000' <repeats 26 times>, "\240\272\300\071\317\177\000\000\310H\034)\377\177\000\000\b\020\342\071\317\177\000\000\000\000\000\000\000\000\000\000\270H\034)\377\177\000\000\000\000\000\000\000\000\000\000\240\272\300\071\317\177\000\000h\rT9\317\177\000\000\000\000@\222\070R\376\377\001\000\000\000\000\000\000\000\300\000\000\000\000\000\000\000\221\273\343\326\000\200\377\377\r\000\000\000\317\177\000\000"...
#15 0x00007fcf38943ade in __GI_svc_getreq_poll (pfdp=pfdp@entry=0x7fcf3bf80f90, pollretval=1) at svc.c:460
        p = 0x7fcf3bf80f90
        i = 0
        fds_found = 0
#16 0x00007fcf389472cf in __GI_svc_run () at svc_run.c:96
        max_pollfd = <optimized out>
        i = <optimized out>
        my_pollfd = 0x7fcf3bf80f90
        last_max_pollfd = 3
#17 0x00007fcf39e25b7d in main (argc=<optimized out>, argv=<optimized out>) at ypbind-mt.c:1000
        i = <optimized out>
        sigs_to_block = {__val = {87047, 0 <repeats 15 times>}}
        sig_thread = 140527855798016
        ping_thread = 140527839012608
        dbus_thread = 140527847405312
        disable_dbus = <optimized out>
        st = {st_dev = 64770, st_ino = 2490371, st_nlink = 2, st_mode = 16877, st_uid = 0, st_gid = 0, __pad0 = 0, st_rdev = 0, st_size = 4096, st_blksize = 4096, st_blocks = 8, st_atim = {tv_sec = 1376985393, tv_nsec = 431664848}, st_mtim = {tv_sec = 1376985393, tv_nsec = 431664848}, st_ctim = {tv_sec = 1376985393, tv_nsec = 431664848}, __unused = {0, 0, 0}}
        configcheck_only = <optimized out>
From                To                  Syms Read   Shared Object Library
0x00007fcf399e2570  0x00007fcf399f3bb4  Yes         /lib64/libdbus-glib-1.so.2
0x00007fcf39799840  0x00007fcf397c1c94  Yes         /lib64/libdbus-1.so.3
0x00007fcf3954dad0  0x00007fcf3957ab60  Yes         /lib64/libgobject-2.0.so.0
0x00007fcf39231260  0x00007fcf392ca12c  Yes         /lib64/libglib-2.0.so.0
0x00007fcf39013da0  0x00007fcf39014b3a  Yes         /lib64/libsystemd-daemon.so.0
0x00007fcf38dfc790  0x00007fcf38e073c4  Yes         /lib64/libpthread.so.0
0x00007fcf38be2110  0x00007fcf38beed94  Yes         /lib64/libnsl.so.1
0x00007fcf3883d410  0x00007fcf3897fd30  Yes         /lib64/libc.so.6
0x00007fcf384f5970  0x00007fcf385adc7c  Yes         /lib64/libgio-2.0.so.0
0x00007fcf382bf2c0  0x00007fcf382c20bc  Yes         /lib64/librt.so.1
0x00007fcf380b6870  0x00007fcf380baf58  Yes         /lib64/libffi.so.6
0x00007fcf37eb1ed0  0x00007fcf37eb29d0  Yes         /lib64/libdl.so.2
0x00007fcf39bffae0  0x00007fcf39c19c3a  Yes         /lib64/ld-linux-x86-64.so.2
0x00007fcf37cae120  0x00007fcf37caefd8  Yes         /lib64/libgmodule-2.0.so.0
0x00007fcf37a99170  0x00007fcf37aa55f0  Yes         /lib64/libz.so.1
0x00007fcf3787a260  0x00007fcf3788be9c  Yes         /lib64/libselinux.so.1
0x00007fcf3765da40  0x00007fcf3766c71c  Yes         /lib64/libresolv.so.2
0x00007fcf373f75f0  0x00007fcf3743fcc8  Yes         /lib64/libpcre.so.1
0x00007fcf2f4c31e0  0x00007fcf2f4ca3cc  Yes         /lib64/libnss_files.so.2
0x00007fcf2f2adaf0  0x00007fcf2f2bd198  Yes         /lib64/libgcc_s.so.1
$1 = 0x7fcf39e1d000 ""
$2 = 0x0
rax            0x0	0
rbx            0x0	0
rcx            0xffffffffffffffff	-1
rdx            0x6	6
rsi            0x33d	829
rdi            0x33d	829
rbp            0x7fff291c3c70	0x7fff291c3c70
rsp            0x7fff291c3238	0x7fff291c3238
r8             0x0	0
r9             0xe	14
r10            0x8	8
r11            0x202	514
r12            0xa	10
r13            0x7fff291c3790	140733883103120
r14            0x59	89
r15            0x2	2
rip            0x7fcf38853a19	0x7fcf38853a19 <__GI_raise+57>
eflags         0x202	[ IF ]
cs             0x33	51
ss             0x2b	43
ds             0x0	0
es             0x0	0
fs             0x0	0
gs             0x0	0
Dump of assembler code for function __GI_raise:
   0x00007fcf388539e0 <+0>:	mov    %fs:0x2d4,%eax
   0x00007fcf388539e8 <+8>:	mov    %eax,%ecx
   0x00007fcf388539ea <+10>:	mov    %fs:0x2d0,%esi
   0x00007fcf388539f2 <+18>:	test   %esi,%esi
   0x00007fcf388539f4 <+20>:	jne    0x7fcf38853a28 <__GI_raise+72>
   0x00007fcf388539f6 <+22>:	mov    $0xba,%eax
   0x00007fcf388539fb <+27>:	syscall 
   0x00007fcf388539fd <+29>:	mov    %eax,%ecx
   0x00007fcf388539ff <+31>:	mov    %eax,%fs:0x2d0
   0x00007fcf38853a07 <+39>:	mov    %eax,%esi
   0x00007fcf38853a09 <+41>:	movslq %edi,%rdx
   0x00007fcf38853a0c <+44>:	movslq %esi,%rsi
   0x00007fcf38853a0f <+47>:	movslq %ecx,%rdi
   0x00007fcf38853a12 <+50>:	mov    $0xea,%eax
   0x00007fcf38853a17 <+55>:	syscall 
=> 0x00007fcf38853a19 <+57>:	cmp    $0xfffffffffffff000,%rax
   0x00007fcf38853a1f <+63>:	ja     0x7fcf38853a3a <__GI_raise+90>
   0x00007fcf38853a21 <+65>:	repz retq 
   0x00007fcf38853a23 <+67>:	nopl   0x0(%rax,%rax,1)
   0x00007fcf38853a28 <+72>:	test   %eax,%eax
   0x00007fcf38853a2a <+74>:	jg     0x7fcf38853a09 <__GI_raise+41>
   0x00007fcf38853a2c <+76>:	mov    %eax,%ecx
   0x00007fcf38853a2e <+78>:	neg    %ecx
   0x00007fcf38853a30 <+80>:	test   $0x7fffffff,%eax
   0x00007fcf38853a35 <+85>:	cmove  %esi,%ecx
   0x00007fcf38853a38 <+88>:	jmp    0x7fcf38853a09 <__GI_raise+41>
   0x00007fcf38853a3a <+90>:	mov    0x38341f(%rip),%rdx        # 0x7fcf38bd6e60
   0x00007fcf38853a41 <+97>:	neg    %eax
   0x00007fcf38853a43 <+99>:	mov    %eax,%fs:(%rdx)
   0x00007fcf38853a46 <+102>:	or     $0xffffffffffffffff,%rax
   0x00007fcf38853a4a <+106>:	retq   
End of assembler dump.

Version-Release number of selected component:
ypbind-1.37.1-3.fc19

Additional info:
reporter:       libreport-2.1.6
backtrace_rating: 4
cmdline:        /usr/sbin/ypbind -n
crash_function: __netlink_free_handle
executable:     /usr/sbin/ypbind
kernel:         3.10.7-200.fc19.x86_64
runlevel:       unknown
uid:            0

Truncated backtrace:
Thread no. 1 (10 frames)
 #5 __netlink_free_handle at ../sysdeps/unix/sysv/linux/ifaddrs.c:86
 #6 getifaddrs_internal at ../sysdeps/unix/sysv/linux/ifaddrs.c:815
 #7 getifaddrs at ../sysdeps/unix/sysv/linux/ifaddrs.c:831
 #8 is_network_up at clnt_udp.c:277
 #9 clntudp_call at clnt_udp.c:386
 #10 ping_all at serv_list.c:915
 #11 test_bindings_once at serv_list.c:1274
 #12 ypbindproc_domain at ypbind_server.c:88
 #13 ypbindprog_2 at ypbind_svc.c:176
 #14 svc_getreq_common at svc.c:534
Comment 1 Edgar Hoch 2013-08-20 07:34:51 EDT
Created attachment 788442 [details]
File: backtrace
Comment 2 Edgar Hoch 2013-08-20 07:34:54 EDT
Created attachment 788443 [details]
File: cgroup
Comment 3 Edgar Hoch 2013-08-20 07:34:58 EDT
Created attachment 788444 [details]
File: core_backtrace
Comment 4 Edgar Hoch 2013-08-20 07:35:01 EDT
Created attachment 788445 [details]
File: dso_list
Comment 5 Edgar Hoch 2013-08-20 07:35:05 EDT
Created attachment 788446 [details]
File: environ
Comment 6 Edgar Hoch 2013-08-20 07:35:08 EDT
Created attachment 788447 [details]
File: limits
Comment 7 Edgar Hoch 2013-08-20 07:35:12 EDT
Created attachment 788448 [details]
File: maps
Comment 8 Edgar Hoch 2013-08-20 07:35:18 EDT
Created attachment 788449 [details]
File: open_fds
Comment 9 Edgar Hoch 2013-08-20 07:35:25 EDT
Created attachment 788450 [details]
File: proc_pid_status
Comment 10 Edgar Hoch 2013-08-20 07:35:28 EDT
Created attachment 788451 [details]
File: var_log_messages
Comment 11 Honza Horak 2013-08-20 08:22:17 EDT
Thank you for the report, but I don't see ypbind doing anything wrong. Is that failure reproducible? If it happened only once, I'd say it could be caused by some unspecified memory problem.
Comment 12 Edgar Hoch 2013-08-20 08:54:41 EDT
The failure was reproducible. It occurs after each reboot of a fresh installed system (yesterday, with kickstart). /var/log/messages contains lines like this:

Aug 20 13:47:04 myhost ypbind[819]: *** Error in `/usr/sbin/ypbind': corrupted double-linked list: 0x00007fcd3934c310 ***
Aug 20 13:47:04 myhost ypbind[819]: *** Error in `/usr/sbin/ypbind': corrupted double-linked list: 0x00007fcd3934c350 ***

When I have started ypbind by hand (systemctl restart ypbind), then it works as expected, no crash.


In the meentime I found that firewalld.service was disabled. I had a line "firewall --disable" in my kickstart file, but this line was ignored in the last weeks by kickstart / anaconda. It seems that something has changed - it is fine that the kickstart option is honored now.

Now I have enabled firewalld.service manually and rebooted the host again - two times. Now - with firewalld.service enabled - ypbind starts and don't crash and works fine.

So this is ok for me, you may close the bug.


But I am wondering about the message about the corrupted double-linked list. ypbind got a timeout, it founds no nis servers, if firewalld was disabled.

Now I tried it again to reboot with firewalld disabled. Now ypbind crashes again:

Aug 20 14:50:50 myhost ypbind[818]: *** Error in `/usr/sbin/ypbind': free(): invalid next size (normal): 0x00007f8d146c0260 ***
...

If I enable firewalld again then ypbind does not crash.
So it is reproducible.
Comment 13 Honza Horak 2013-08-20 10:03:40 EDT
(In reply to Edgar Hoch from comment #12)
> The failure was reproducible. It occurs after each reboot of a fresh
> installed system (yesterday, with kickstart). /var/log/messages contains
> lines like this:
> 
> Aug 20 13:47:04 myhost ypbind[819]: *** Error in `/usr/sbin/ypbind':
> corrupted double-linked list: 0x00007fcd3934c310 ***
> Aug 20 13:47:04 myhost ypbind[819]: *** Error in `/usr/sbin/ypbind':
> corrupted double-linked list: 0x00007fcd3934c350 ***

Memory corruption again, but a bit different message this time, so I'd wonder if the backtrace looks the same or not.

> When I have started ypbind by hand (systemctl restart ypbind), then it works
> as expected, no crash.

But this time the firewall was fixed and ypbind was able to connect to YP servers, right?

> But I am wondering about the message about the corrupted double-linked list.
> ypbind got a timeout, it founds no nis servers, if firewalld was disabled.

In this case a SIGTERM is sent to ypbind, which is how the daemon was always turned off, so it shouldn't be the problem.

> Now I tried it again to reboot with firewalld disabled. Now ypbind crashes
> again:
> 
> Aug 20 14:50:50 myhost ypbind[818]: *** Error in `/usr/sbin/ypbind': free():
> invalid next size (normal): 0x00007f8d146c0260 ***

Again a different message. Was the firewall fixed this time so ypbind was able to connect to YP servers?

> If I enable firewalld again then ypbind does not crash.
> So it is reproducible.

I see some changes in relevant part of code in glibc, especially the following chunk seems suspicious to me, since enabling strict-aliasing could make problem in some memory operations. But it's just a guess:

diff -rup glibc-2.16-75f0d304/sunrpc/Makefile glibc-2.18/sunrpc/Makefile
--- glibc-2.16-75f0d304/sunrpc/Makefile 2013-08-20 15:21:08.131164559 +0200
+++ glibc-2.18/sunrpc/Makefile  2013-08-11 00:52:55.000000000 +0200
@@ -150,10 +150,6 @@ sunrpc-CPPFLAGS = -D_RPC_THREAD_SAFE_
 CPPFLAGS += $(sunrpc-CPPFLAGS)
 BUILD_CPPFLAGS += $(sunrpc-CPPFLAGS)
 
-CFLAGS-clnt_tcp.c += -fno-strict-aliasing
-CFLAGS-clnt_udp.c += -fno-strict-aliasing
-CFLAGS-clnt_unix.c += -fno-strict-aliasing
-
 $(objpfx)tst-getmyaddr: $(common-objpfx)linkobj/libc.so
 $(objpfx)tst-xdrmem: $(common-objpfx)linkobj/libc.so
 $(objpfx)tst-xdrmem2: $(common-objpfx)linkobj/libc.so
Comment 14 Edgar Hoch 2013-08-20 15:21:05 EDT
Created attachment 788605 [details]
Lines with ypbind from /var/log/messages

I attached an extract of /var/log/messages with the lines containing ypbind. I hope this helps.
Comment 15 Edgar Hoch 2013-08-20 15:26:07 EDT
(In reply to Honza Horak from comment #13)
> But this time the firewall was fixed and ypbind was able to connect to YP
> servers, right?

I only have enabled the firewall (systemctl enable firewalld) and have rebooted. The network interface is configured to zone "work".

> > But I am wondering about the message about the corrupted double-linked list.
> > ypbind got a timeout, it founds no nis servers, if firewalld was disabled.
> 
> In this case a SIGTERM is sent to ypbind, which is how the daemon was always
> turned off, so it shouldn't be the problem.
> 
> > Now I tried it again to reboot with firewalld disabled. Now ypbind crashes
> > again:
> > 
> > Aug 20 14:50:50 myhost ypbind[818]: *** Error in `/usr/sbin/ypbind': free():
> > invalid next size (normal): 0x00007f8d146c0260 ***
> 
> Again a different message. Was the firewall fixed this time so ypbind was
> able to connect to YP servers?

I have disableed the firewall this time.

For testing, I have enabled the firewall and rebooted, disabled the firewall and rebooted, enabled again...
Comment 16 Honza Horak 2013-08-21 04:12:19 EDT
Thank you for your feedback and also bug #999121 reported. It is weird that the daemon crashes in different places and with different signals. What seems clear that something is terribly wrong with memory. But it's not clear to me if it is in ypbind/glibc/kernel or it can be some more general problem (memory physically damaged).

I understand that the bug could have been there for some time already and just didn't show up because the firewalld was enabled. But still, it could give some clue if you would be able to downgrade ypbind, glibc and eventually kernel to some of the older builds and see if it helps. Otherwise I don't have any concrete idea where to start.
Comment 17 Fedora Admin XMLRPC Client 2014-09-11 11:17:54 EDT
This package has changed ownership in the Fedora Package Database.  Reassigning to the new owner of this component.
Comment 18 Fedora End Of Life 2015-01-09 14:31:49 EST
This message is a notice that Fedora 19 is now at end of life. Fedora 
has stopped maintaining and issuing updates for Fedora 19. It is 
Fedora's policy to close all bug reports from releases that are no 
longer maintained. Approximately 4 (four) weeks from now this bug will
be closed as EOL if it remains open with a Fedora 'version' of '19'.

Package Maintainer: If you wish for this bug to remain open because you
plan to fix it in a currently maintained version, simply change the 'version' 
to a later Fedora version.

Thank you for reporting this issue and we are sorry that we were not 
able to fix it before Fedora 19 is end of life. If you would still like 
to see this bug fixed and are able to reproduce it against a later version 
of Fedora, you are encouraged  change the 'version' to a later Fedora 
version prior this bug is closed as described in the policy above.

Although we aim to fix as many bugs as possible during every release's 
lifetime, sometimes those efforts are overtaken by events. Often a 
more recent Fedora release includes newer upstream software that fixes 
bugs or makes them obsolete.
Comment 19 Fedora End Of Life 2015-02-17 11:50:43 EST
Fedora 19 changed to end-of-life (EOL) status on 2015-01-06. Fedora 19 is
no longer maintained, which means that it will not receive any further
security or bug fix updates. As a result we are closing this bug.

If you can reproduce this bug against a currently maintained version of
Fedora please feel free to reopen this bug against that version. If you
are unable to reopen this bug, please file a new report against the
current release. If you experience problems, please add a comment to this
bug.

Thank you for reporting this bug and we are sorry it could not be fixed.

Note You need to log in before you can comment on or make changes to this bug.