AFAICT the pan newsreader hands garbage to gnutls, which then hands garbage to glibc, which then segfaults. I'm no expert, so it's just my guess. sys-libs/glibc Installed versions: 2.18-r1(2.2)^s(05:55:55 PM 02/18/2014)(multilib -debug -gd -hardened -nscd -profile -selinux -suid -systemtap -vanilla CROSSCOMPILE_OPTS="-headers-only") net-libs/gnutls Installed versions: 3.2.11(04:24:41 PM 02/20/2014)(crywrap cxx dane pkcs11 zlib -doc -examples -guile -nls -static-libs -test Reproducible: Sometimes Steps to Reproduce: 1. This is a rare event and I don't know how to reproduce. 2. Downloading articles or headers with latest pan.git newsreader. 3. Pan can run for hours between segfaults, sometimes even over night. (gdb) bt #0 0x00007ffff3c16f13 in malloc_consolidate (av=av@entry=0x7ffff3f3f620 <main_arena>) at malloc.c:4087 #1 0x00007ffff3c18196 in _int_malloc (av=0x7ffff3f3f620 <main_arena>, bytes=5515) at malloc.c:3372 #2 0x00007ffff3c1a460 in __GI___libc_malloc (bytes=5515) at malloc.c:2855 #3 0x00007ffff4bcb0b9 in _mbuffer_alloc (payload_size=5435, maximum_size=5435) at gnutls_mbuffers.c:264 #4 0x00007ffff4bcb285 in _mbuffer_linearize (buf=buf@entry=0x7fffc810f460) at gnutls_mbuffers.c:325 #5 0x00007ffff4bc653f in recv_headers (ms=0x7ffffff7c8ec, record=0x7ffffff7c940, htype=4294967295, type=GNUTLS_APPLICATION_DATA, session=0x7fffc810eba0) at gnutls_record.c:1048 #6 _gnutls_recv_in_buffers (session=session@entry=0x7fffc810eba0, type=type@entry=GNUTLS_APPLICATION_DATA, htype=htype@entry=4294967295, ms=ms@entry=0) at gnutls_record.c:1163 #7 0x00007ffff4bc7da6 in _gnutls_recv_int (session=0x7fffc810eba0, type=type@entry=GNUTLS_APPLICATION_DATA, htype=htype@entry=4294967295, data=0x7ffffff7ca10 "\370\260\326\372\266=M\021\020 \021=J\260\367\351\275X\300`?|\325\350վ,^\221i%u\340μ\b\324X\037\235\227\327\300Y#\257\313\376L}\354\255\061.\245\204;\324\366\273Õ>^J\221\332Rd'\271\253%\203M\355=M\036\211\247\371\244i0~\214\026eՉ]\304\307u?!W\016\270\021\236#\365\330A\230({\305b\213\234*\250\277խ=}(\273m\031\246%\230\221\r\n\\\345)\327\022\360+\330\370\t\253\375\016Tb\177ݝ\tC\224\314\333\061+ZDe\264\241\066,\320\021@U\325J\262)ܸ@V\324ẓ\257i\340\062Y\241$\vh\257s{4\270\353݈ \307\002I\266"..., data_size=524288, seq=seq@entry=0x0, ms=0) at gnutls_record.c:1405 #8 0x00007ffff4bc82c5 in gnutls_record_recv (session=<optimized out>, data=<optimized out>, data_size=<optimized out>) at gnutls_record.c:1582 #9 0x0000000000558f5c in pan::GIOChannelSocketGnuTLS::gnutls_read_line (this=this@entry=0x7fffc80026f0, g=g@entry=0x19be4a0, ret=ret@entry=0x7fffffffca58, System uname: Linux-3.13.4-gentoo-x86_64-AMD_A6-3600_APU_with_Radeon-tm-_HD_Graphics-with-gentoo-2.2 KiB Mem: 3534148 total, 196484 free KiB Swap: 4144732 total, 4082656 free Timestamp of tree: Sun, 23 Feb 2014 17:00:01 +0000 ld GNU ld (GNU Binutils) 2.24 app-shells/bash: 4.2_p45-r1 dev-java/java-config: 2.2.0 dev-lang/python: 2.7.6, 3.3.4 dev-util/cmake: 2.8.12.2 dev-util/pkgconfig: 0.28 sys-apps/baselayout: 2.2 sys-apps/openrc: 0.12.4 sys-apps/sandbox: 2.6-r1 sys-devel/autoconf: 2.13, 2.69 sys-devel/automake: 1.9.6-r3, 1.11.6, 1.12.6, 1.13.4, 1.14.1 sys-devel/binutils: 2.23.2, 2.24-r2 sys-devel/gcc: 4.7.3-r1, 4.8.2 sys-devel/gcc-config: 1.8 sys-devel/libtool: 2.4.2 sys-devel/make: 4.0-r1 sys-kernel/linux-headers: 3.13 (virtual/os-headers) sys-libs/glibc: 2.18-r1 Repositories: gentoo mate-overlay ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-march=native -O2 -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--keep-going=y --quiet-build=n" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-logs compressdebug config-protect-if-modified distlocks ebuild-locks fixlafiles merge-sync news parallel-fetch preserve-libs protect-owned sandbox sfperms splitdebug strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://gentoo.oregonstate.edu http://www.ibiblio.org/pub/linux/distributions/gentoo" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j4" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages" PORTAGE_TMPDIR="/var/tmp" PORTDIR="/usr/portage"USE="3dnow 3dnowext 64bit X X509 a52 aac acl adns aio alsa amd64 amr apng archive aspell audio autoipd automount autotools avahi bash-completion berkdb bittorrent bluetooth bonobo boost bufferevents bzip2 cairo cdda cdparanoia cdr cdrom cjk cli client clutter cmake corefonts cracklib crypt css cups cxx dane dbus dconf device-mapper dhcpcd dri drm dts dv dvd dvdr ecc elisp emboss enca encode evo exceptions exif extensions fame fat fax ffmpeg flac fltk fontconfig fpx frei0r ftp fts3 fuse g3dvl gallium gcj gcrypt gdbm gdu geoip geoloc gif gimp gles gles1 gles2 glib glut gmp gnome-keyring gnome-print gnutls gpg graphite gstreamer gtk gtk2 gudev h323 hpcups html http hwdb iconv icu imagemagick imap imlib introspection iplayer ipv6 java java6 javascript jbig jbootstrap jce jit jpeg jpeg2k kqemu kvm lame lcms libburn libkms libnotify libsecret libssh2 libwww live llvm-gcc logrotate lua lzma lzo mad madwifi md5sum mdev mdnsresponder-compat mime mimencode minizip mjpeg mms mmx mmxext mng modperl modplug modules mozdom mp3 mp4 mpeg mplayer mta mtp multilib multislot nat-pmp ncurses net netpbm network networking networkmanager nfs nfsv3 nfsv4 nfsv41 nntp nocd nptl nsplugin offensive ogg ogg123 opengl openmp openntpd openrc opensslcrypt opus oss pam pam_ssh pango parted passfile passwordsave pcap pcre pdf pdfimport perl pgf pkcs11 playlist png pnm policykit pop posix postproc ppds ppp pppd pulseaudio pvr python python2 qemu qt4 quicktime rar rdesktop rdoc rdp readline real regex rtsp samba scanner sdl secure-delete security sendto session sha512 sharedmem sip smime smp smtp sockets spell sqlite sqlite3 sse sse2 ssh ssl startup-notification stream svg swat symlink sysfs syslog system-boost system-sqlite systemd sysvipc tcpd templates tga tgif theora threads threadsafe thunderbird tiff tk tls tor tor-hardening transcode truetype twolame type3 udev udisks unicode unlock-notify upower usb utils uudeview uuencode vala vdpau vga video vorbis vte wav weather webgl webkit2 webm webp win32codecs wma wxwidgets x264 xanim xcb xft xine xml xorg xpm xrandr xterm xv xvid xvmc youtube yv12 zip zlib" ABI_X86="64" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="kexi words flow plan sheets stage tables krita karbon braindump author" CAMERAS="ptp2" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="evdev" KERNEL="linux" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" LINGUAS="en" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php5-5" PYTHON_SINGLE_TARGET="python2_7" PYTHON_TARGETS="python2_7 python3_3" RUBY_TARGETS="ruby19" USERLAND="GNU" VIDEO_CARDS="fglrx vga vesa" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CPPFLAGS, CTARGET, INSTALL_MASK, LC_ALL, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS, SYNC, USE_PYTHON PORTDIR_OVERLAY="/var/lib/layman/mate"
I have been hitting this too, but not with gnutls. Portage 2.2.8-r1 (hardened/linux/amd64, gcc-4.8.2, glibc-2.18-r1, 3.13.2-hardened-r3 x86_64) ================================================================= System uname: Linux-3.13.2-hardened-r3-x86_64-Intel-R-_Core-TM-_i3_CPU_M_330_@_2.13GHz-with-gentoo-2.2 KiB Mem: 1777884 total, 771400 free KiB Swap: 8193020 total, 8058796 free Timestamp of tree: Tue, 25 Feb 2014 13:30:01 +0000 ld GNU ld (GNU Binutils) 2.24 app-shells/bash: 4.2_p45-r1 dev-java/java-config: 2.2.0 dev-lang/python: 2.7.6, 3.3.4 dev-util/cmake: 2.8.12.2 dev-util/pkgconfig: 0.28 sys-apps/baselayout: 2.2 sys-apps/openrc: 0.12.4 sys-apps/sandbox: 2.6-r1 sys-devel/autoconf: 2.13, 2.69 sys-devel/automake: 1.11.6, 1.13.4, 1.14.1 sys-devel/binutils: 2.22-r1, 2.23.1, 2.24-r2 sys-devel/gcc: 4.5.3-r2, 4.6.3, 4.8.2 sys-devel/gcc-config: 1.8 sys-devel/libtool: 2.4.2 sys-devel/make: 4.0-r1 sys-kernel/linux-headers: 3.13 (virtual/os-headers) sys-libs/glibc: 2.18-r1 Repositories: gentoo hardened-dev gentoo-haskell lonewolf seden ACCEPT_KEYWORDS="amd64 ~amd64" ACCEPT_LICENSE="*" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-march=native -pipe -fstack-check -ggdb" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt /var/bind /var/lib/hsqldb" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/g\ entoo-release /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language\ .def.d /etc/texmf/updmap.d /etc/texmf/web2c" CXXFLAGS="-march=native -pipe -fstack-check -ggdb" DISTDIR="/usr/portage-distfiles" FCFLAGS="-O2 -pipe" FEATURES="binpkg-logs collision-protect config-protect-if-modified distlocks ebuild-locks fixlafiles install\ sources merge-sync multilib-strict news noclean nostrip parallel-fetch preserve-libs protect-owned sandbox s\ fperms strict unknown-features-warn unmerge-logs unmerge-orphans userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://distfiles.gentoo.org" LANG="en_US.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" MAKEOPTS="-j1" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --w\ hole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/p\ ackages" PORTAGE_TMPDIR="/mnt/var/tmp" PORTDIR="/usr/portage" PORTDIR_OVERLAY="/usr/local/portage/hardened-development /usr/local/portage/haskell /usr/local/portage/lonew\ olf /usr/local/portage/seden" SYNC="rsync://rsync.gentoo.org/gentoo-portage"
FWIW, I just got exactly the same segfault in glibc-2.19
Assigning to maintainers. Reassign to us in case this needs any security handling.
is it new behavior ? i.e. did you see the crash only after upgrading to glibc 2.18+ ? i'd guess that this isn't a bug in glibc, but as you said, pan doing something bad which manifests itself as a segfault later on in glibc. glibc crashing due to corruption/garbage from elsewhere does not a bug in glibc make. if you're feeling adventurous, i think you can try building pan with -fsanitize=address in your CFLAGS & LDFLAGS. that's good at catching memory bugs.
Created attachment 376504 [details] Debugging output from pan compiled with -fsanitize=address
(In reply to walt from comment #5) ah that's a great log. looks like it is a bug in pan. someone will have to build it locally to correlate the symbols though (not sure why asan doesn't do a better job of symbolizing its reports).
I would report this to upstream too: https://bugzilla.gnome.org/query.cgi?product=Pan Otherwise I am not sure if will be fixed soon :/
(In reply to SpanKY from comment #6) > (In reply to walt from comment #5) > > ah that's a great log. looks like it is a bug in pan. Definitely. My big worry was that the segfault happens in a system library and not in pan. You said above that it's not neccesarily a glibc bug, but can we know for certain it's not? That's way above my pay grade :) > someone will have to > build it locally to correlate the symbols though (not sure why asan doesn't > do a better job of symbolizing its reports). ISTR that one of the standard binutils makes it easy to correlate the symbols but I can't remember which one(s). Can you? Pacho, I just posted an upstream report. May take some time because pan is maintained by one busy volunteer these days.
Created attachment 376524 [details] fsanitize output with source code citations added The utility I couldn't remember turns out to be addr2line, which is how I generated the source code citations at the end of each line. The glib and glibc libraries have the debugging symbols detached with splitdebug and I haven't figured out yet how to get addr2line to use those files. Any hints would be welcome :) Thanks.
Happy to report that upstream's maintainer commited a fix for this bug today: commit 4c6d3bd7fc0dbd1ce1ad7e40690948b39764a89f Author: Heinrich Müller <heinrich.mueller82@gmail.com> Date: Sat May 10 09:55:24 2014 +0200 fix use-after-free Thanks to Mike for your hint about -fsanitize. Without your hint I couldn't have given Heinrich enough information to fix this bug :)
0.140 should have this solved
