bugGNU FreeIPMI - Bugs: bug #43913, Segmentation fault with...

 
 

bug #43913: Segmentation fault with driver-type=lan20

Submitter:  jbd <jbdenis>
Submitted:  Fri 02 Jan 2015 01:59:49 PM UTC
   
 
Category:  bmc-config Severity:  3 - Normal
Priority:  5 - Normal Item Group:  Crash
Status:  Fixed Privacy:  Public
Assigned to:  chu11 Open/Closed:  Closed
Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment Rich Markup
   

Tue 06 Jan 2015 07:51:08 PM UTC, comment #5: 

I've added a change into libfreeipmi to only call "gcry_control (GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread)" once.

After making that change it appears everything works.  Patch will be posted to mailing list for testing.

Albert Chu <chu11>
Group administrator
Tue 06 Jan 2015 07:18:16 PM UTC, comment #4: 

Setting --fanout to '1' doesn't lead to a segfault.  It appears there may be a change to the initialization routines within libgcrypt so that if multiple threads call them simultaneously there is a problem.

Albert Chu <chu11>
Group administrator
Tue 06 Jan 2015 01:21:54 AM UTC, comment #3: 

On mailing list, Jean indicates issue is w/ libgcrypt 1.6.2. 
After some trial and error, it appears this began with libgcrypt 1.6.0.  On my system, I see the trace

Program terminated with signal 11, Segmentation fault.
#0  __pthread_mutex_lock (mutex=0x0) at pthread_mutex_lock.c:50
50        unsigned int type = PTHREAD_MUTEX_TYPE (mutex);
(gdb) bt
#0  __pthread_mutex_lock (mutex=0x0) at pthread_mutex_lock.c:50
#1  0x00002aaaab80509d in lock_fsm () at fips.c:225
#2  0x00002aaaab805905 in _gcry_fips_is_operational () at fips.c:367
#3  0x00002aaaab7ffee3 in _gcry_vcontrol (cmd=<value optimized out>, arg_ptr=<value optimized out>) at global.c:474
#4  0x00002aaaab7fdfed in gcry_control (cmd=<value optimized out>) at visibility.c:79
#5  0x00002aaaab2a1fcc in crypt_init () at libcommon/ipmi-crypt.c:84
#6  0x00002aaaab2962e9 in ipmi_rmcpplus_init () at interface/ipmi-rmcpplus-interface.c:218

it devolves down into this code in pthread in glibc.


int
__pthread_mutex_lock (mutex)
pthread_mutex_t *mutex;
{
assert (sizeof (mutex->__size) >= sizeof (mutex->__data));
unsigned int type = PTHREAD_MUTEX_TYPE (mutex);

PTHREAD_MUTEX_TYPE is a macro that dereferences the mutex.  So there's the segfault.

The issue is why is __pthread_mutex_lock() being called with a bad pointer.

It should be noted that this appears to be an issue that only arises when multiple nodes are specified.

> ipmi-config -h "node1" --listsections --driver-type="lan20"

./ipmi-config: invalid hostname

> ipmi-config -h "node[0-1]" --listsections --driver-type="lan20"

Segmentation fault (core dumped)

So it may have to do with a minor change in the API in regards to initializing the library.  More investigation needed ...

Albert Chu <chu11>
Group administrator
Mon 05 Jan 2015 10:20:04 PM UTC, comment #2: 

Hi Jean, it does appear to be an issue in gcrypt.  IPMI 2.0 (i.e. lan20) uses libgcrypt while the default (IPMI 1.5) does not.  So if this is in libgcrypt it would make sense.

What version of libgcrypt is on your system?

Albert Chu <chu11>
Group administrator
Fri 02 Jan 2015 03:31:38 PM UTC, comment #1: 

The problem seems to be within libgcrypt :

$ gdb --quiet /usr/local/sbin/ipmi-config core
Reading symbols from /usr/local/sbin/ipmi-config...done.
[New LWP 31571]
[New LWP 31573]
[New LWP 31575]
[New LWP 31570]
[New LWP 31569]
[New LWP 31574]
[New LWP 31572]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/local/sbin/ipmi-config --driver-type=lan20 --listsections -h node[0-1000]'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  __GI___pthread_mutex_lock (mutex=0x3) at ../nptl/pthread_mutex_lock.c:66
66      ../nptl/pthread_mutex_lock.c: No such file or directory.
(gdb) bt
#0  __GI___pthread_mutex_lock (mutex=0x3) at ../nptl/pthread_mutex_lock.c:66
#1  0x00007fd59351daaa in _gcry_ath_mutex_lock (lock=lock@entry=0x7fd5937ea2a8 <fsm_lock>) at ath.c:338
#2  0x00007fd59351bf4d in lock_fsm () at fips.c:225
#3  0x00007fd59351c75d in _gcry_fips_is_operational () at fips.c:367
#4  0x00007fd59351628b in _gcry_vcontrol (cmd=0, arg_ptr=0x7fd594106c44 <default_mutexattr>, arg_ptr@entry=0x7fd59244bba0) at global.c:476
#5  0x00007fd593513089 in gcry_control (cmd=cmd@entry=GCRYCTL_INITIALIZATION_FINISHED) at visibility.c:79
#6  0x00007fd5939855bc in crypt_init () at libcommon/ipmi-crypt.c:84
#7  0x00007fd593979759 in ipmi_rmcpplus_init () at interface/ipmi-rmcpplus-interface.c:218
#8  0x00007fd59393856e in ipmi_ctx_open_outofband_2_0 (ctx=0x7fd5840009e0, hostname=0xeeb390 "node1", username=0x0, password=0x0, k_g=0x0, k_g_len=0, privilege_level=4 '\004', cipher_suite_id=3 '\003', session_timeout=0, retransmission_timeout=0, workaround_flags=0,
    flags=0) at api/ipmi-api.c:687
#9  0x000000000043a81c in ipmi_open (progname=0x7fffac65b34e "/usr/local/sbin/ipmi-config", hostname=0xeeb390 "node1", common_args=0x7fffac659c20, pstate=0x7fd59244bed0) at tool-common.c:75
#10 0x0000000000409267 in _ipmi_config (pstate=0x7fd59244bed0, hostname=0xeeb390 "node1", arg=0x7fffac659c00) at ipmi-config.c:79
#11 0x00000000004390f6 in _pstdout_func_entry (arg=0xeeb320) at pstdout.c:1138
#12 0x00007fd5940fd0a4 in start_thread (arg=0x7fd59244c700) at pthread_create.c:309
#13 0x00007fd592f45ccd in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111


(file #32749)

jbd <jbdenis>
Fri 02 Jan 2015 01:59:49 PM UTC, original submission:  

Hello,

I'm running freeipmi 1.4.7 from source on a debian jessie.

I'm able to get a core dump 100% of the time using this command line :

$ /usr/local/sbin/ipmi-config  --driver-type=lan20 --listsections -h node[0-1000]
Segmentation fault

Without --driver-type, I have a normal behaviour :

$ /usr/local/sbin/ipmi-config --listsections -h node[0-1000]
...
node999: /usr/local/sbin/ipmi-config: invalid hostname
node997: /usr/local/sbin/ipmi-config: invalid hostname

I hope this is easily reproducible on your side.

Jean-Baptiste

jbd <jbdenis>

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #32775:  gcrypt.patch added by chu11 (2KiB - application/octet-stream - proposed patch)
file #32749:  core.gz added by jbdenis (277KiB - application/gzip - Core file)

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by chu11 (Posted a comment)
  • -email is unavailable- added by jbdenis (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 5 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2015-01-07 chu11 StatusNone Fixed
        Assigned toNone chu11
        Open/ClosedOpen Closed
    2015-01-06 chu11 Attached File- Added gcrypt.patch, #32775
    2015-01-02 jbdenis Attached File- Added core.gz, #32749

    Back to the top

    Powered by Savane 3.13-f8d8.
    Corresponding source code