Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 568714 - sys-apps/sandbox: internal memory corruption w/using internal realloc leads to random segfaults
Summary: sys-apps/sandbox: internal memory corruption w/using internal realloc leads t...
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal
Assignee: Gentoo Office Team
URL:
Whiteboard:
Keywords:
: 568814 568822 568894 (view as bug list)
Depends on:
Blocks:
 
Reported: 2015-12-19 09:09 UTC by tman
Modified: 2015-12-25 20:18 UTC (History)
10 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments
/mnt/portage/logs/app-office:libreoffice-5.0.4.2:20151219-090348.lo (app-office:libreoffice-5.0.4.2:20151219-090348.log,28.76 KB, text/x-log)
2015-12-19 09:09 UTC, tman
Details
Fix realloc in sandbox memory.c (fix-realloc.patch,1.54 KB, patch)
2015-12-19 16:28 UTC, Denis Lisov
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description tman 2015-12-19 09:09:09 UTC
config.status: creating config_host/config_mpl.h
config.status: creating config_host/config_orcus.h
config.status: creating config_host/config_kde4.h
config.status: creating config_host/config_mingw.h
config.status: creating config_host/config_oox.h
config.status: creating config_host/config_options.h
config.status: creating config_host/config_test.h
config.status: creating config_host/config_telepathy.h
config.status: creating config_host/config_typesizes.h
config.status: creating config_host/config_vcl.h
config.status: creating config_host/config_vclplug.h
config.status: creating config_host/config_version.h
config.status: creating config_host/config_oauth2.h
config.status: creating config_host/config_poppler.h
****************************************************************************

To build, issue:
/usr/bin/make

For details, run:
/usr/bin/make help

After the build has finished, you can immediately run it using:
instdir/program/soffice

If you want to run the smoketest, issue:
/usr/bin/make check

perl "/var/tmp/portage/app-office/libreoffice-5.0.4.2/work/libreoffice-5.0.4.2/helpcontent2/helpers/create_ilst.pl" -dir=icon-themes/galaxy/res/helpimg > "/var/tmp/portage/app-office/libreoffice-5.0.4.2/work/helpcontent2/source/auxiliary//helpimg.ilst"
Automatic fetching of external tarballs is disabled.
mkdir -p /var/tmp/portage/app-office/libreoffice-5.0.4.2/work/libreoffice-5.0.4.2/instdir
Makefile:247: recipe for target 'build' failed
make: *** [build] Segmentation fault
 * ERROR: app-office/libreoffice-5.0.4.2::gentoo failed (compile phase):
 *   (no error message)
 *
 * Call stack:
 *     ebuild.sh, line 133:  Called src_compile
 *   environment, line 7317:  Called die
 * The specific snippet of code:
 *       make ${target} || die
 *
 * If you need support, post the output of `emerge --info '=app-office/libreoffice-5.0.4.2::gentoo'`,
 * the complete build log and the output of `emerge -pqv '=app-office/libreoffice-5.0.4.2::gentoo'`.
!!! When you file a bug report, please include the following information:
GENTOO_VM=oracle-jdk-bin-1.8  CLASSPATH="" JAVA_HOME="/opt/oracle-jdk-bin-1.8.0.66"
JAVACFLAGS="-source 1.6 -target 1.6" COMPILER=""
and of course, the output of emerge --info =libreoffice-5.0.4.2
 * The complete build log is located at '/mnt/portage/logs/app-office:libreoffice-5.0.4.2:20151219-090348.log'.
 * The ebuild environment file is located at '/var/tmp/portage/app-office/libreoffice-5.0.4.2/temp/environment'.
 * Working directory: '/var/tmp/portage/app-office/libreoffice-5.0.4.2/work/libreoffice-5.0.4.2'
 * S: '/var/tmp/portage/app-office/libreoffice-5.0.4.2/work/libreoffice-5.0.4.2'


Reproducible: Always




Portage 2.2.26 (python 3.4.3-final-0, default/linux/amd64/13.0/desktop, gcc-5.3.0, glibc-2.22-r1, 4.3.3-gentoo x86_64)
=================================================================
System uname: Linux-4.3.3-gentoo-x86_64-Intel-R-_Core-TM-_i7-3740QM_CPU_@_2.70GHz-with-gentoo-2.2
KiB Mem:    24626776 total,  19590672 free
KiB Swap:   26488828 total,  26488828 free
Timestamp of repository gentoo: Sat, 19 Dec 2015 08:30:01 +0000
Timestamp of repository poly-c: Fri, 18 Dec 2015 07:42:19 +0000
sh bash 4.3_p42
ld GNU ld (Gentoo 2.25.1 p1.1) 2.25.1
app-shells/bash:          4.3_p42::gentoo
dev-java/java-config:     2.2.0::gentoo
dev-lang/perl:            5.22.0::gentoo
dev-lang/python:          2.7.11-r1::gentoo, 3.4.3-r6::gentoo, 3.5.1-r1::gentoo
dev-util/cmake:           3.4.1::gentoo
dev-util/pkgconfig:       0.29::gentoo
sys-apps/baselayout:      2.2::gentoo
sys-apps/openrc:          0.19.1::gentoo
sys-apps/sandbox:         2.10::gentoo
sys-devel/autoconf:       2.13::gentoo, 2.69-r1::gentoo
sys-devel/automake:       1.11.6-r2::gentoo, 1.13.4-r1::gentoo, 1.14.1-r1::gentoo, 1.15-r1::gentoo
sys-devel/binutils:       2.25.1-r1::gentoo
sys-devel/gcc:            5.3.0::gentoo
sys-devel/gcc-config:     1.8::gentoo
sys-devel/libtool:        2.4.6-r1::gentoo
sys-devel/make:           4.1-r1::gentoo
sys-kernel/linux-headers: 4.3::gentoo (virtual/os-headers)
sys-libs/glibc:           2.22-r1::gentoo
Repositories:

gentoo
    location: /usr/portage
    sync-type: rsync
    sync-uri: rsync://rsync.gentoo.org/gentoo-portage
    priority: -1000

amielke-overlay
    location: /mnt/portage/local/layman/amielke-overlay
    masters: gentoo
    priority: 0

x-portage
    location: /mnt/portage
    masters: gentoo

bitcoin
    location: /mnt/portage/local/layman/bitcoin
    masters: gentoo
    priority: 1

brother-overlay
    location: /mnt/portage/local/layman/brother-overlay
    masters: gentoo
    priority: 2

bumblebee
    location: /mnt/portage/local/layman/bumblebee
    masters: gentoo
    priority: 3

dotnet
    location: /mnt/portage/local/layman/dotnet
    masters: gentoo
    priority: 4

dr
    location: /mnt/portage/local/layman/dr
    masters: gentoo
    priority: 5

media-overlay
    location: /mnt/portage/local/layman/media-overlay
    masters: gentoo
    priority: 6

poly-c
    location: /mnt/portage/local/layman/poly-c
    masters: gentoo
    priority: 7

steam-overlay
    location: /mnt/portage/local/layman/steam-overlay
    masters: gentoo
    priority: 8

ixit
    location: /mnt/portage/local/layman/ixit
    masters: gentoo
    priority: 9

lokal
    location: /mnt/portage/local/local-overlay
    masters: gentoo
    priority: 10

ACCEPT_KEYWORDS="amd64 ~amd64"
ACCEPT_LICENSE="*"
CBUILD="x86_64-pc-linux-gnu"
CFLAGS="-march=core-avx-i -O2 -pipe"
CHOST="x86_64-pc-linux-gnu"
CONFIG_PROTECT="/etc /usr/lib64/libreoffice/program/sofficerc /usr/share/gnupg/qualified.txt /var/lib/hsqldb"
CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/dconf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php5.6/ext-active/ /etc/php/apache2-php7.0/ext-active/ /etc/php/cgi-php5.6/ext-active/ /etc/php/cgi-php7.0/ext-active/ /etc/php/cli-php5.6/ext-active/ /etc/php/cli-php7.0/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo /etc/texmf/language.dat.d /etc/texmf/language.def.d /etc/texmf/updmap.d /etc/texmf/web2c"
CXXFLAGS="-march=core-avx-i -O2 -pipe"
DISTDIR="/mnt/portage/distfiles"
FCFLAGS="-O2 -pipe"
FEATURES="assume-digests binpkg-logs config-protect-if-modified distlocks fail-clean fixlafiles merge-sync news nodoc noinfo parallel-fetch parallel-install preserve-libs protect-owned sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr"
FFLAGS="-O2 -pipe"
GENTOO_MIRRORS="http://distfiles.gentoo.org"
LANG="C"
LC_ALL=""
LDFLAGS="-Wl,-O1 -Wl,--as-needed"
MAKEOPTS="-j9"
PKGDIR="/mnt/portage/packages"
PORTAGE_CONFIGROOT="/"
Comment 1 tman 2015-12-19 09:09:28 UTC
Created attachment 419666 [details]
/mnt/portage/logs/app-office:libreoffice-5.0.4.2:20151219-090348.lo
Comment 2 Juergen Rose 2015-12-19 14:49:13 UTC
same here.
Comment 3 Ulrich Müller gentoo-dev 2015-12-19 14:55:49 UTC
I see the same problem here, with gcc-4.9.3 and sandbox-2.10.

Downgrading to sandbox-2.9 appears to fix it. (Still compiling, though. :)
CCing sandbox maintainers.
Comment 4 Perfect Gentleman 2015-12-19 15:09:41 UTC
confirm
Comment 5 Denis Lisov 2015-12-19 15:52:07 UTC
I'm seeing a similar segfault with sandbox-2.10 and debugging it. Seems to be an error in sandbox's memory allocation functions, going to check this.
Comment 6 Denis Lisov 2015-12-19 15:59:52 UTC
In my case the sagfault happens in /bin/bash ebuild.sh with the partial backtrace

(gdb) bt 2
#0  0x00007f87f320db63 in sb_check_envp (envp=envp@entry=0x1383dc0, mod_cnt=mod_cnt@entry=0x7ffe4ac15e20) at /var/tmp/portage/sys-apps/sandbox-2.10/work/sandbox-2.10/libsandbox/libsandbox.c:1238
#1  0x00007f87f3210fd6 in execve_DEFAULT (path=0x1349fd0 "/bin/mkdir", argv=0xefb510, envp=0x1383dc0) at /var/tmp/portage/sys-apps/sandbox-2.10/work/sandbox-2.10/libsandbox/wrapper-funcs/__wrapper_exec.c:160
(More stack frames follow...)

The segfault happens in the str_list_add_item macro when setting the terminator pointer. The array size is almost one memory page, while the write seems to happen right after the page end.
Comment 7 Denis Lisov 2015-12-19 16:28:13 UTC
Created attachment 419826 [details, diff]
Fix realloc in sandbox memory.c

Seems to work for me (well, not finished yet, but way past the previous segfault point) with the attached patch to sandbox. Feel free to test it, sandbox ebuilds apply user patches by default.
Comment 8 SpanKY gentoo-dev 2015-12-19 18:15:42 UTC
(In reply to Denis Lisov from comment #7)

good catch.  this logic error has always been in this code, but i guess largely flew under the radar as it was only 4 or 8 bytes at the end of the map.  it might have been noticed by some people as occasional/unreproducible segfaults (ugh).  the reason it's more noticeable in sandbox-2.10 is that i increased the alignment to fix another bug which means increasing the size of the offset -- now it's 8 or 16 bytes.

added to sandbox:
http://gitweb.gentoo.org/proj/sandbox.git/commit/?id=529a388ebb1b4e9d6ad8a1bb61dd8211833a5976

and to 2.10-r1:
http://gitweb.gentoo.org/repo/gentoo.git/commit/?id=33a9bf25d218173400e1115011ed867e84b4bf38
Comment 9 Andreas K. Hüttel archtester gentoo-dev 2015-12-19 19:38:01 UTC
*** Bug 568814 has been marked as a duplicate of this bug. ***
Comment 10 Andreas K. Hüttel archtester gentoo-dev 2015-12-19 20:09:05 UTC
*** Bug 568822 has been marked as a duplicate of this bug. ***
Comment 11 Andreas K. Hüttel archtester gentoo-dev 2015-12-25 20:18:04 UTC
*** Bug 568894 has been marked as a duplicate of this bug. ***