Bugzilla Bug 149726

I have run up a brand new Core2Duo box from an AMD64 build CD, and I get a
segmentation fault with vmware-authd.  This may be triggered by logging on to
the box remotely via the vmware console.  

I ran up the same box a second time, from scratch, and repeated the same error.
    The first time I tried this was with the most up to date packages in
portage.  This time I just tried with the 2006.1 build, with the most up to
date vmware (there is only one version currently listed in portage). 

Memtest86+ reports no memory errors after some hours.

The only customization I made to the box was to add --nocona to make.conf, as
described below.

trinity sbin # pwd
/opt/vmware/server/sbin
trinity sbin # ./vmware-authd
Segmentation fault (core dumped)

Core dump follows:
ELF Header:
  Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
  Class:                             ELF32
  Data:                              2's complement, little endian
  Version:                           1 (current)
  OS/ABI:                            UNIX - System V
  ABI Version:                       0
  Type:                              CORE (Core file)
  Machine:                           Intel 80386
  Version:                           0x1
  Entry point address:               0x0
  Start of program headers:          52 (bytes into file)
  Start of section headers:          0 (bytes into file)
  Flags:                             0x0
  Size of this header:               52 (bytes)
  Size of program headers:           32 (bytes)
  Number of program headers:         23
  Size of section headers:           0 (bytes)
  Number of section headers:         0
  Section header string table index: 0

There are no sections in this file.

There are no sections in this file.

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  NOTE           0x000314 0x00000000 0x00000000 0x0046c 0x00000     0
  LOAD           0x001000 0x08048000 0x00000000 0x00000 0x26000 R E 0x1000
  LOAD           0x001000 0x0806e000 0x00000000 0x02000 0x02000 RWE 0x1000
  LOAD           0x003000 0x08070000 0x00000000 0x44000 0x44000 RWE 0x1000
  LOAD           0x047000 0xf7d71000 0x00000000 0x00000 0xe1000 R E 0x1000
  LOAD           0x047000 0xf7e52000 0x00000000 0x12000 0x12000 RWE 0x1000
  LOAD           0x059000 0xf7e64000 0x00000000 0x04000 0x04000 RWE 0x1000
  LOAD           0x05d000 0xf7e68000 0x00000000 0x00000 0x115000 R E 0x1000
  LOAD           0x05d000 0xf7f7d000 0x00000000 0x02000 0x02000 R E 0x1000
  LOAD           0x05f000 0xf7f7f000 0x00000000 0x02000 0x02000 RWE 0x1000
  LOAD           0x061000 0xf7f81000 0x00000000 0x03000 0x03000 RWE 0x1000
  LOAD           0x064000 0xf7f84000 0x00000000 0x00000 0x02000 R E 0x1000
  LOAD           0x064000 0xf7f86000 0x00000000 0x02000 0x02000 RWE 0x1000
  LOAD           0x066000 0xf7f92000 0x00000000 0x01000 0x01000 RWE 0x1000
  LOAD           0x067000 0xf7f93000 0x00000000 0x00000 0x19000 R E 0x1000
  LOAD           0x067000 0xf7fac000 0x00000000 0x01000 0x01000 R E 0x1000
  LOAD           0x068000 0xf7fad000 0x00000000 0x01000 0x01000 RWE 0x1000
  LOAD           0x069000 0xffcc9000 0x00000000 0x06000 0x06000 RWE 0x1000
  LOAD           0x06f000 0xffffe000 0x00000000 0x00000 0x01000 R E 0x1000
  LOAD           0x06f000 0xffffe000 0x00000000 0x01000 0x01000 R E 0x1000
  DYNAMIC        0x06f738 0xffffe738 0x00000000 0x00078 0x00078 R   0x4
  NOTE           0x06f608 0xffffe608 0x00000000 0x00018 0x00018 R   0x4
  GNU_EH_FRAME   0x06f620 0xffffe620 0x00000000 0x00008 0x00008 R   0x4

Dynamic section at offset 0x6f738 contains 10 entries:
  Tag        Type                         Name/Value
 0x0000000e (SONAME)                     Library soname: [linux-gate.so.1]
 0x00000004 (HASH)                       0xffffe0b4
 0x00000005 (STRTAB)                     0xffffe1b8
 0x00000006 (SYMTAB)                     0xffffe0f8
 0x0000000a (STRSZ)                      86 (bytes)
 0x0000000b (SYMENT)                     16 (bytes)
 0x6ffffffc (VERDEF)                     0xffffe228
 0x6ffffffd (VERDEFNUM)                  2
 0x6ffffff0 (VERSYM)                     0xffffe20e
 0x00000000 (NULL)                       0x0

There are no relocations in this file.

There are no unwind sections in this file.

Histogram for bucket list length (total of 3 buckets):
 Length  Number     % of total  Coverage
      0  1          ( 33.3%)
      1  1          ( 33.3%)     25.0%
      2  0          (  0.0%)     25.0%
      3  1          ( 33.3%)    100.0%

No version information found in this file.

Notes at offset 0x00000314 with length 0x0000046c:
  Owner         Data size       Description
  CORE          0x00000090      NT_PRSTATUS (prstatus structure)
  CORE          0x0000007c      NT_PRPSINFO (prpsinfo structure)
  CORE          0x00000090      NT_AUXV (auxiliary vector)
  CORE          0x0000006c      NT_FPREGSET (floating point registers)
  LINUX         0x00000200      NT_PRXFPREG (user_xfpregs structure)

Notes at offset 0x0006f608 with length 0x00000018:
  Owner         Data size       Description
  Linux         0x00000004      Unknown note type: (0x00000000)

trinity ~ # emerge --info
Portage 2.1-r2 (default-linux/amd64/2006.1, gcc-4.1.1, glibc-2.4-r3,
2.6.17-gentoo-r8 x86_64)
=================================================================
System uname: 2.6.17-gentoo-r8 x86_64 Intel(R) Core(TM)2 CPU          6600  @
2.40GHz
Gentoo Base System version 1.12.1
app-admin/eselect-compiler: [Not Present]
dev-java/java-config: [Not Present]
dev-lang/python:     2.4.3-r1
dev-python/pycrypto: 2.0.1-r5
dev-util/ccache:     [Not Present]
dev-util/confcache:  [Not Present]
sys-apps/sandbox:    1.2.17
sys-devel/autoconf:  2.13, 2.59-r7
sys-devel/automake:  1.4_p6, 1.5, 1.6.3, 1.7.9-r1, 1.8.5-r3, 1.9.6-r2
sys-devel/binutils:  2.16.1-r3
sys-devel/gcc-config: 1.3.13-r3
sys-devel/libtool:   1.5.22
virtual/os-headers:  2.6.11-r2
ACCEPT_KEYWORDS="amd64"
AUTOCLEAN="yes"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-O2 -pipe -march=nocona"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /var/bind"
CONFIG_PROTECT_MASK="/etc/env.d /etc/gconf /etc/terminfo"
CXXFLAGS="-O2 -pipe -march=nocona"
DISTDIR="/usr/portage/distfiles"
FEATURES="autoconfig distlocks metadata-transfer sandbox sfperms strict"
GENTOO_MIRRORS="http://distfiles.gentoo.org
http://distro.ibiblio.org/pub/linux/distributions/gentoo"
MAKEOPTS="-j3"
PKGDIR="/usr/portage/packages"
PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --compress
--force --whole-file --delete --delete-after --stats --timeout=180
--exclude='/distfiles' --exclude='/local' --exclude='/packages'"
PORTAGE_TMPDIR="/var/tmp"
PORTDIR="/usr/portage"
SYNC="rsync://rsync.gentoo.org/gentoo-portage"
USE="amd64 berkdb bitmap-fonts cli crypt cups dlloader dri fortran gdbm gpm
ipv6 isdnlog libg++ ncurses nls nptl nptlonly pam pcre perl ppds pppd python
readline reflection session spl ssl symlink tcpd truetype-fonts type1-fonts
udev unicode xorg zlib elibc_glibc input_devices_keyboard input_devices_mouse
input_devices_evdev kernel_linux userland_GNU video_cards_apm video_cards_ark
video_cards_ati video_cards_chips video_cards_cirrus video_cards_cyrix
video_cards_dummy video_cards_fbdev video_cards_glint video_cards_i128
video_cards_i810 video_cards_mga video_cards_neomagic video_cards_nv
video_cards_rendition video_cards_s3 video_cards_s3virge video_cards_savage
video_cards_siliconmotion video_cards_sis video_cards_sisusb video_cards_tdfx
video_cards_tga video_cards_trident video_cards_tseng video_cards_v4l
video_cards_vesa video_cards_vga video_cards_via video_cards_vmware
video_cards_voodoo"
Unset:  CTARGET, EMERGE_DEFAULT_OPTS, INSTALL_MASK, LANG, LC_ALL, LDFLAGS,
LINGUAS, PORTAGE_RSYNC_EXTRA_OPTS, PORTDIR_OVERLAY

32-bit emulation is enabled in my kernel.  Other programs run fine.  VMware
appears to start OK, it is just vmware-authd that seg faults and fails (thus
far).

If I try to connect remotely, via the vmware console, this is the error:

Oct  2 16:42:38 trinity kernel: vmware-authd[1544]: segfault at
000000000000000a
 rip 0000000008064202 rsp 00000000ffb29cb0 error 4

This was the install order (the results of emerge -pv vmware-server prior to
actual emerge):
These are the packages that would be merged, in order:

Calculating dependencies ... done!
[ebuild  N    ] app-emulation/emul-linux-x86-compat-1.0-r1  1,200 kB
[ebuild  N    ] app-emulation/emul-linux-x86-baselibs-2.5.2  5,457 kB
[ebuild  N    ] app-emulation/emul-linux-x86-xlibs-7.0-r2  USE="-opengl"
VIDEO_CARDS="i810 mga s3virge savage sis tdfx trident via -mach64 -r128
-radeon" 10,356 kB
[ebuild  N    ] app-emulation/emul-linux-x86-gtklibs-2.8.8  USE="-qt3" 2,824 kB
[ebuild  N    ] dev-libs/glib-2.10.3  USE="-debug -doc -hardened" 2,708 kB
[ebuild  N    ] dev-perl/XML-Parser-2.34  224 kB
[ebuild  N    ] dev-util/intltool-0.35.0  126 kB
[ebuild  N    ] dev-libs/libxml2-2.6.26  USE="ipv6 python readline -debug -doc
-test" 3,338 kB
[ebuild  N    ] x11-misc/shared-mime-info-0.18-r1  585 kB
[ebuild  N    ] app-emulation/vmware-modules-1.0.0.15  103,028 kB
[ebuild  N    ] sys-apps/xinetd-2.3.14  USE="perl tcpd" 294 kB
[ebuild  N    ] sys-apps/pciutils-2.2.3-r1  1,200 kB
[ebuild  N    ] app-emulation/vmware-server-1.0.1.29996-r1  362 kB

Furthermore, the contents of /etc/pam.d/vmware-authd:
trinity ~ # cat /etc/pam.d/vmware-authd
#%PAM-1.0
auth       sufficient       /emul/linux/x86/lib/security/pam_unix.so shadow
nullok
auth       required         /emul/linux/x86/lib/security/pam_unix_auth.so
shadow nullok
account    required         /emul/linux/x86/lib/security/pam_listfile.so
item=group sense=allow file=/etc/vmware/vmwaregroup onerr=fail
account    sufficient       /emul/linux/x86/lib/security/pam_unix.so
account    required         /emul/linux/x86/lib/security/pam_unix_acct.so

I checked, all of the above /emul/linux.....*.so files exist.

Well, we're a bit out of my league here, but could you please try running
vmware-authd using strace, to see if we can isolate the call that's causing the
strace (or what's happening up to that point)?  A google of the vmtn for
similar set-ups might also do some good.  Let's try the strace first and see
what turns up...

Created an attachment (id=98527) [details]
strace of vmware-authd crash

Good idea... looks like it may be barfing while attempting to write something
out to /dev/log...

For the record:
trinity sbin # ls -l /dev/log
srw-rw-rw- 1 root root 0 Oct  2 17:37 /dev/log

These two lines are also potentially a problem:

open("/opt/vmware/server/lib/lib/libssl.so.0.9.7/libssl.so.0.9.7", O_RDONLY) =
-1 ENOENT (No such file or directory)
open("/opt/vmware/server/lib/lib/libssl.so.0.9.7", O_RDONLY) = -1 ENOENT (No
such file or directory)

That library does not exist.

Ah, yeah, that'd explain it...

I'm going to mark this as a duplicate of bug 148682, since those libraries were
recently removed due to a security issue, and we're currently undecided as to
how to deal with the problem.  Rather than pursueing this bug any further, I'd
follow that one instead.  Sorry for the problems, we're trying to get them
worked out as quickly as possible...

*** This bug has been marked as a duplicate of 148682 ***

I tried this:
trinity libssl.so.0.9.7 # pwd
/opt/vmware/server/lib/lib/libssl.so.0.9.7
trinity libssl.so.0.9.7 # ln -s /emul/linux/x86/usr/lib/libssl.so.0.9.7
libssl.so.0.9.7

and now I get this:
trinity sbin # ./vmware-authd
./vmware-authd: symbol lookup error:
/opt/vmware/server/lib/lib/libssl.so.0.9.7/libssl.so.0.9.7: undefined symbol:
EVP_idea_cbc

Bug 149702 provides steps for linking the 32-bit binary libraries into the
vmware-server package.  Hope that helps...