[Bug 452175] Re: Random segfaults when using ld.so explicitly to start a program

[Vitaly "_Vi" Shukela]

Reproducible for me on Debian wheezy/sid with custom kernel "3.3.6-pf".
`echo 0 > /proc/sys/kernel/randomize_va_space` makes `/lib/ld-linux.so.2
/bin/bash` stop crashing with `cannot allocate 3 bytes (8192 bytes
allocated)`. There is "nx" in /proc/cpuinfo flags.

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to bash in Ubuntu.
https://bugs.launchpad.net/bugs/452175

Title:
  Random segfaults when using ld.so explicitly to start a program

Status in “bash” package in Ubuntu:
  Invalid
Status in “linux” package in Ubuntu:
  Fix Released
Status in “bash” source package in Lucid:
  Invalid
Status in “linux” source package in Lucid:
  Fix Released
Status in “bash” source package in Karmic:
  Invalid
Status in “linux” source package in Karmic:
  Fix Released

Bug description:
  SRU Justification:

  Impact: With the current NX emulation, there are cases where the brk
  segment conflicts with the exe randomization.

  Fix: The patch linked to this report moves the brk segment out of the
  way for these cases.

  Testcase: See below

  ---

  It seems that memory allocation fails occasionally, when an optional
  (non-standard, but legal) startup method is used to execute a binary.
  Our application requires that method (scratchbox2) so that's why we
  found it.

  Environment:
  -----------------
  Ubuntu 9.10 Karmic Koala 32bit
  uname -a:
  Linux testub910-32 2.6.31-14-generic #46-Ubuntu SMP Tue Oct 13 16:47:59 UTC 2009 i686 GNU/Linux

  How to reproduce:
  -----------------------
  Use the following loop to do the test: Execute ld.so/ld-linux.so
  explicitly:

  #!/bin/sh
  while true
  do
     /lib/ld-linux.so.2 /bin/bash /usr/bin/which apt-get
  done

  (note that "which" is really a shell script, that is why bash is
  involved)

  This produces occasionally memory allocation errors and coredumps.
  like:
  ...
  /usr/bin/apt-get
  Segmentation fault (core dumped)
  /usr/bin/apt-get
  ..
  /usr/bin/apt-get
  /usr/bin/apt-get
  /bin/bash: xrealloc: ../../../bash/lib/sh/stringvec.c:48: cannot reallocate 276 bytes (0 bytes allocated)
  /usr/bin/apt-get
  ..
  /usr/bin/apt-get
  /usr/bin/apt-get
  /usr/bin/apt-get
  /usr/bin/which: xrealloc: ../bash/input.c:170: cannot reallocate 1100 bytes (0 bytes allocated)
  /usr/bin/apt-get
  ..
  /usr/bin/apt-get
  Segmentation fault (core dumped)
  ...

  Necessary background information:
  --------------------------------
  Using ld.so (=ld-linux.so) explicitly to start a program is a not-so-common
  way to start a binary, but it is still a valid and legal way to do it.
  Scratchbox 2 uses it because it needs to use Maemo's ld.so (the default is
  to use host's ld.so) and Maemo's libraries (default is to use host's
  libraries),
  and additionally we want to set some extra parameters that can only be
  specified when ld.so is executed "from the command line".

  We have tested the similar script in some different environment:
  --------------------------------------------------------------------------------
  In Ubuntu 9.04 Jaunty 32 bit everything works fine without any problem.
  uname -a:
  Linux testmachine 2.6.28-15-generic #52-Ubuntu SMP Wed Sep 9 10:49:34 UTC 2009 i686 GNU/Linux

  In OpenSUSE 11.2 Beta 32bit does not produce the above described problem
  uname -a:
  Linux testmachine 2.6.31.3-1-default #1 SMP 2009-10-08 00:27:25 +0200 i686 i686 i386 GNU/Linux

  I have also compiled the latest stable kernel from kernel.org (2.6.31.4) under karmic koala. If I booting from this new kernel (under the same problematic Ubuntu 9.10 Karmic Koala 32bit machine) then it will NOT produce the above described problem. So I think (I am not an expert so please correct me if I am wrong) it means that the problem is likely to be in an ubuntu specific kernel change.
  uname -a:
  Linux testmachine 2.6.31.4 #1 SMP Thu Oct 15 15:55:55 EEST 2009 i686 GNU/Linux

  Please locate the problem and fix it, if it is possible, before Karmic Koala release.
  Thank you in advance.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/bash/+bug/452175/+subscriptions