Bugzilla Bug 151503

On amd64 and ia64 (at least), "make cscope" in a kernel source tree segfaults
with (now marked stable) cscope-15.5.20060927.  It works fine with
cscope-1.15-r6

To duplicate:
  cd /usr/src/linux
  make cscope

Here is the backtrace on amd64, built with -O0 -ggdb:

# gdb cscope
GNU gdb 6.4
Copyright 2005 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "x86_64-pc-linux-gnu"...Using host libthread_db
library "/lib/libthread_db.so.1".

(gdb) run -b
Starting program: /usr/bin/cscope -b

Program received signal SIGSEGV, Segmentation fault.
0x00002b2d7b8c00f9 in strncpy () from /lib/libc.so.6
(gdb) bt
#0  0x00002b2d7b8c00f9 in strncpy () from /lib/libc.so.6
#1  0x0000000000415bf0 in invnewterm () at invlib.c:494
#2  0x0000000000414f5a in invmake (invname=0x574f50 "ncscope.in.out", 
    invpost=0x574f70 "ncscope.po.out", infile=0x68aad0) at invlib.c:216
#3  0x000000000040a106 in build () at build.c:462
#4  0x00000000004182d9 in main (argc=0, argv=0x7fff2f4c9780) at main.c:576
(gdb) p lastinblk
$1 = 4294941112

Portage 2.1.2_pre1 (default-linux/amd64/2005.1, gcc-4.1.1, glibc-2.3.6-r4,
2.6.17-gentoo-r7 x86_64)
=================================================================
System uname: 2.6.17-gentoo-r7 x86_64 Intel(R) Xeon(TM) CPU 3.20GHz
Gentoo Base System version 1.6.15
Last Sync: Unknown
distcc 2.18.3 x86_64-pc-linux-gnu (protocols 1 and 2) (default port 3632)
[enabled]
ccache version 2.3 [enabled]
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.2.11-r1
dev-lang/python:     2.3.5, 2.4.3-r1
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.3
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.18.1
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r4
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.17
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=nocona -O3 -pipe -fomit-frame-pointer"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/NX/etc /usr/NX/home /usr/kde/3.4/env
/usr/kde/3.4/share/config /usr/kde/3.4/shutdown /usr/kde/3.5/env
/usr/kde/3.5/share/config /usr/kde/3.5/shutdown /usr/share/X11/xkb
/usr/share/config /usr/share/texmf/dvipdfm/config/
/usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/
/usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/"
CONFIG_PROTECT_MASK="/etc/DIR_COLORS /etc/X11/Sessions /etc/X11/app-defaults
/etc/X11/dm /etc/X11/ion3 /etc/X11/mwm/system.mwmrc /etc/X11/rstart
/etc/X11/serverconfig /etc/X11/starthere /etc/X11/sysconfig /etc/X11/xdm
/etc/X11/xinit /etc/X11/xkb /etc/asciidoc /etc/bash /etc/bash_completion
/etc/bash_completion.d /etc/conf.d/net.example /etc/conf.d/wireless.example
/etc/cups/mime.convs /etc/cups/mime.types /etc/env.d /etc/filesystems
/etc/gconf /etc/genkernel.conf /etc/gimp /etc/gnome-vfs-2.0 /etc/init.d
/etc/inputrc /etc/lynx /etc/make.conf.example /etc/man.conf /etc/mplayer.conf
/etc/mutt /etc/muttng /etc/nanorc /etc/networks /etc/openldap /etc/pam.d
/etc/postfix/sample /etc/profile /etc/protocols /etc/revdep-rebuild
/etc/screenrc /etc/services /etc/skel /etc/sound /etc/terminfo /etc/udev
/etc/vim /etc/xdg /usr/kde /usr/lib/X11/xkb"
CXXFLAGS="-march=nocona -O3 -pipe -fomit-frame-pointer"
DISTDIR="/usr/distfiles"
FEATURES="assume-digests autoaddcvs autoconfig buildpkg ccache cvs distcc
distlocks keepwork metadata-transfer noclean sandbox sfperms"
GENTOO_MIRRORS="http://gentoo.zko.hp.com/sources
http://gentoo.zko.hp.com/sources
        http://distfiles.gentoo.org 
        http://distro.ibiblio.org/pub/Linux/distributions/gentoo"
LANG="en_US.utf8"
MAKEOPTS="-j4"
PKGDIR="/usr/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/home/agriffis/portage"
PORTDIR_OVERLAY="/home/agriffis/overlay /usr/local/overlays/zko"
SYNC="false"
USE="amd64 X alsa apache2 audiofile bash-completion berkdb bitmap-fonts cli
crypt cscope cups dlloader dri eds elibc_glibc emboss encode fam flac
foomaticdb fortran gcj gif gnome gstreamer gtk gtk2 imap imlib
input_devices_evdev input_devices_keyboard input_devices_mouse insecure-drivers
ipv6 isdnlog jabber java jpeg kde kernel_linux kqemu lzw lzw-tiff motif mozilla
mp3 mpeg msn ncurses nls nptl nptlonly nsplugin nvidia oggvorbis opengl oscar
pam pcre perl png pppd python qt3 qt4 quicktime readline reflection ruby sdl
session socks5 spell spl ssl tcltk tcpd theora tiff truetype truetype-fonts
type1-fonts unicode usb userland_GNU video_cards_apm video_cards_ark
video_cards_ati video_cards_chips video_cards_cirrus video_cards_cyrix
video_cards_dummy video_cards_fbdev video_cards_glint video_cards_i128
video_cards_i810 video_cards_mga video_cards_neomagic video_cards_nv
video_cards_rendition video_cards_s3 video_cards_s3virge video_cards_savage
video_cards_siliconmotion video_cards_sis video_cards_sisusb video_cards_tdfx
video_cards_tga video_cards_trident video_cards_tseng video_cards_v4l
video_cards_vesa video_cards_vga video_cards_via video_cards_vmware
video_cards_voodoo visualization vorbis xorg xpm xv yahoo zlib"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, LDFLAGS, LINGUAS,
PORTAGE_RSYNC_EXTRA_OPTS

Portage 2.1.1 (default-linux/ia64/2006.0, gcc-3.3.2, glibc-2.3.4.20041102-r1,
2.6.17-1.2630.fc6 ia64)
=================================================================
System uname: 2.6.17-1.2630.fc6 ia64 Itanium 2
Gentoo Base System version 1.6.14
Last Sync: Unknown
ccache version 2.4 [disabled]
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: 1.2.11-r1
dev-lang/python:     2.3.5, 2.4.3-r1
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     2.4-r2
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r6
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r1
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r6
ACCEPT_KEYWORDS="ia64"
AUTOCLEAN="yes"
CBUILD="ia64-unknown-linux-gnu"
CFLAGS="-O2 -pipe"
CHOST="ia64-unknown-linux-gnu"
CONFIG_PROTECT="/etc /usr/kde/3.4/env /usr/kde/3.4/share/config
/usr/kde/3.4/shutdown /usr/lib/mozilla/defaults/pref /usr/share/X11/xkb
/usr/share/config /usr/share/texmf/dvipdfm/config/
/usr/share/texmf/dvips/config/ /usr/share/texmf/tex/generic/config/
/usr/share/texmf/tex/platex/config/ /usr/share/texmf/xdvi/"
CONFIG_PROTECT_MASK="/etc/DIR_COLORS /etc/X11/Sessions /etc/X11/app-defaults
/etc/X11/dm /etc/X11/gdm /etc/X11/ion3 /etc/X11/mwm/system.mwmrc
/etc/X11/rstart /etc/X11/serverconfig /etc/X11/starthere /etc/X11/sysconfig
/etc/X11/xdm /etc/X11/xinit /etc/X11/xkb /etc/asciidoc /etc/bash
/etc/bash_completion /etc/bash_completion.d /etc/conf.d/net.example
/etc/conf.d/wireless.example /etc/cups/mime.convs /etc/cups/mime.types
/etc/env.d /etc/filesystems /etc/gconf /etc/genkernel.conf /etc/gimp
/etc/gnome-vfs-2.0 /etc/init.d /etc/inputrc /etc/lynx /etc/make.conf.example
/etc/man.conf /etc/mplayer.conf /etc/mutt /etc/muttng /etc/nanorc /etc/networks
/etc/openldap /etc/pam.d /etc/postfix/sample /etc/profile /etc/protocols
/etc/revdep-rebuild /etc/screenrc /etc/services /etc/skel /etc/sound
/etc/terminfo /etc/udev /etc/vim /etc/xdg /usr/kde /usr/lib/X11/xkb"
CXXFLAGS="-O2 -pipe"
DISTDIR="/usr/distfiles"
FEATURES="assume-digests autoaddcvs autoconfig buildpkg cvs digest distlocks
keepwork metadata-transfer noclean sandbox sfperms"
GENTOO_MIRRORS="http://gentoo.zko.hp.com/sources
http://gentoo.zko.hp.com/sources http://distfiles.gentoo.org"
LANG="en_US.utf8"
LINGUAS=""
MAKEOPTS="-j4"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/home/agriffis/portage"
PORTDIR_OVERLAY="/home/agriffis/overlay /usr/local/overlays/zko"
SYNC="false"
USE="ia64 X apache2 arts audiofile bash-completion berkdb bitmap-fonts cli
crypt cscope cups dlloader dri eds elibc_glibc encode esd flac foomaticdb
fortran gcj gdbm gif gnome gstreamer gtk gtk2 imap imlib input_devices_evdev
input_devices_keyboard input_devices_mouse insecure-drivers ipv6 isdnlog jabber
jpeg kde kernel_linux libg++ libwww mikmod motif mozilla msn ncurses nls nptl
nsplugin ogg oggvorbis opengl oscar oss pam pcre perl png pppd python qt3 qt4
quicktime readline reflection ruby sdl session socks5 spell spl ssl svg tcltk
tcpd theora truetype truetype-fonts type1-fonts udev unicode userland_GNU
video_cards_apm video_cards_ark video_cards_ati video_cards_chips
video_cards_cirrus video_cards_cyrix video_cards_dummy video_cards_fbdev
video_cards_glint video_cards_i128 video_cards_i740 video_cards_i810
video_cards_imstt video_cards_mga video_cards_neomagic video_cards_nv
video_cards_rendition video_cards_s3 video_cards_s3virge video_cards_savage
video_cards_siliconmotion video_cards_sisusb video_cards_tdfx video_cards_tga
video_cards_v4l video_cards_vesa video_cards_vga video_cards_via
video_cards_voodoo visualization vorbis xml2 xmms xorg xv yahoo zlib"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LC_ALL, LDFLAGS,
PORTAGE_RSYNC_EXTRA_OPTS

Note this doesn't happen in my x86 32-bit chroot.  I'm guessing it has to do
with the replacement of magic numbers with sizeof(stuff) in the cscope source

Same problem here, on multiple source trees, constantly.  It makes cscope
completely unusable on amd64.

Created an attachment (id=101639) [details]
fix for 64 bit crash

the attached patch is the result of some brute force attempt at fixing the
amd64 crash, but it seems to work for me at least. upstream should definitely
be asked before widespread inclusion ;-).

PaX Team, would you mind getting upstream to review your patch?

i'm going on vacations and can't deal with this right now, so feel free...

I send the patch upstream, let's see if there is a reaction.

There was a reaction, here a summary:
A real repair can only be done by reimplementing it, as it was hacked for Alpha
many years ago.  The maintainer has no motivation to redo it, so he waits for
someone who has.  But he will investigate further on the patch and tell me.  I
will report.

The maintainer Hans-Bernhard Br

The maintainer Hans-Bernhard Bröker investigated, but could not reproduce the
error on his SuSE 10.1 machine (on AMD4).  He asks, if someone who can
reproduce the bug is able to provide the internal variables of invnewterm()
when crashing.

i just lost my access to the amd64 box i used to use so can't help with this
anymore, sorry... did he try to reproduce it on a kernel source tree? it's
important because cscope did work on other trees i tried it on, only the kernel
(it was 2.6.18 or so) triggered the bug for me.

15.6 is available, but it was not mentioned on the Homepage (SF had it though).
 Hans-Bernhard just noticed, so we first bump cscope and try again.

(In reply to comment #11)
> did he try to reproduce it on a kernel source tree? 

Yes, I did.  I ran 'make cscope' on my Linux box's kernel tree, exactly as in
the original report.  But OTOH, I don't use Gentoo, so my kernel tree is
probably quite different from yours.

(In reply to comment #13)
> (In reply to comment #11)
> > did he try to reproduce it on a kernel source tree? 
> 
> Yes, I did.  I ran 'make cscope' on my Linux box's kernel tree, exactly as in
> the original report.  But OTOH, I don't use Gentoo, so my kernel tree is
> probably quite different from yours.

i don't think the exact kernel tree matters, i used it on a PaX patched one for
example, not that of gentoo. maybe there's a compiler issue as well, although
for my part i didn't use anything special like SSP or PIE (here i compiled it
with gentoo's gcc 3.4.6).

did you also look at the suggested patch and if so can you tell us if it makes
any sense at all or not (i have about 0 cscope internals knowledge, it just
seemed 'plausible' to patch it like this, based on the surrounding code)?

(In reply to comment #14)

> did you also look at the suggested patch and if so can you tell us if it makes
> any sense at all or not (i have about 0 cscope internals knowledge, it just
> seemed 'plausible' to patch it like this, based on the surrounding code)?

The patch feels about right.  But without seeing the actual failure myself,
that's about all I can say bout it.  

The key problem is that invlib.c was written at a time when for all practical
means and purposes, the world was indeed a VAX, i.e. ints, longs and pointers
were all the same 32-bit format.  It's anyone's guess what each of those magic
numbers actually means.  

Given that state, and the mostly complete absence of documentation about how
this code is supposed to work, I'm afraid any serious work on it would have to
start with a rewrite from scratch ;-(  I did that once (exchanged all of
invlib.c by a BerkeleyDB), but performance was a bit too bad, particularly for
source trees comparable in size to the amount of RAM in the machine.  

Can anyone try with 15.6, please?

15.6 doesn't segfault for me.

So I recycle that bug.

amd64 please stabilise cscope 15.6 because of absolute failure on your
platform.

Hans-Bernhard...thanks for your active support.

Done. Thanks, everyone.

better late than never... 15.6 works for me too.  Thanks for getting this
fixed!