NetBSD Problem Report #53414

From www@NetBSD.org  Fri Jun 29 23:38:19 2018
Return-Path: <www@NetBSD.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id B079A7A157
	for <gnats-bugs@gnats.NetBSD.org>; Fri, 29 Jun 2018 23:38:19 +0000 (UTC)
Message-Id: <20180629233818.553877A218@mollari.NetBSD.org>
Date: Fri, 29 Jun 2018 23:38:18 +0000 (UTC)
From: jdbaker@mylinuxisp.com
Reply-To: jdbaker@mylinuxisp.com
To: gnats-bugs@NetBSD.org
Subject: mplayer tries to write-enable text segment on NetBSD/i386-8.0_RC2, fails.
X-Send-Pr-Version: www-1.0

>Number:         53414
>Category:       pkg
>Synopsis:       mplayer tries to write-enable text segment on NetBSD/i386-8.0_RC2, fails.
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Fri Jun 29 23:40:00 +0000 2018
>Closed-Date:    
>Last-Modified:  Mon Aug 13 00:50:44 +0000 2018
>Originator:     John D. Baker
>Release:        NetBSD/i386-8.0_RC2, pkgsrc-HEAD (pre-pkgsrc-2018Q2)
>Organization:
>Environment:
NetBSD verthandi 8.0_RC2 NetBSD 8.0_RC2 (VERTHANDI) #30: Sun Jun 24 11:32:15 CDT 2018  sysop@plex760.technoskunk.fur:/r0/build/netbsd-8/obj/i386/sys/arch/i386/compile/VERTHANDI i386

>Description:
Previous appended to pkg/53319, requested to file new PR.

On my i386-8.0_RC2 system, mplayer built from recent pkgsrc-HEAD (in
the freeze before pkgsrc-2018Q2) fails to run as follows:

  $ mplayer
  mplayer: text relocations
  mplayer: Cannot write-enable text segment: Permission denied

Running mplayer through 'ktruss' ends with:

[...]
  1541      1 mplayer  open("/usr/local/lib/libcrypt.so.1", 0, 0xbfb613cc) Err#2 ENOENT
  1541      1 mplayer  open("/lib/libcrypt.so.1", 0, 0xbfb613cc) = 3
  1541      1 mplayer  __fstat50(0x3, 0xbfb613cc)  = 0
  1541      1 mplayer  mmap(0, 0x1000, 0x1, 0x1, 0x3, 0, 0, 0) = 0xaade5000
  1541      1 mplayer  munmap(0xaade5000, 0x1000)  = 0
  1541      1 mplayer  mmap(0, 0xb000, 0x5, 0x2, 0x3, 0, 0, 0) = 0xaaddb000
  1541      1 mplayer  mmap(0xaade1000, 0x2000, 0x3, 0x12, 0x3, 0, 0x5000, 0) = 0xaade1000
  1541      1 mplayer  mmap(0xaade3000, 0x3000, 0x3, 0x1012, 0xffffffff, 0, 0, 0) = 0xaade3000
  1541      1 mplayer  close(0x3)                  = 0
  1541      1 mplayer  write(0x2, 0xbfb619ec, 0x19) = 25
        "mplayer: text relocations"
  1541      1 mplayer  write(0x2, 0xbac88872, 0x1) = 1
        "\n"
  1541      1 mplayer  mprotect(0x26000, 0x2c9000, 0x3) Err#13 EACCES
  1541      1 mplayer  write(0x2, 0xbfb61a00, 0x3c) = 60
        "mplayer: Cannot write-enable text segment: Permission denied"
  1541      1 mplayer  write(0x2, 0xbac88872, 0x1) = 1
        "\n"
  1541      1 mplayer  exit(0x1)

So, mprotect() is being called with prot=3 (-wx) for a region of memory
at 0x26000.

Looking earlier in the 'ktruss' output shows several instances of
"26000".  Two are the requsted length for mmap()ing
"/usr/lib/libexpat.so.2" and "/usr/X11R7/lib/libxcb.so.2", respectively.
Another is a byte offset into "/usr/lib/liblzma.so.2" to be mmap()ed.
The rest are tails of longer addresses either requested of or returned
by mmap().

Not sure what it's doing, then.

Even built with the "debug" option, running mplayer under 'gdb' is
not particularly informative:

[...]
Reading symbols from mplayer...done.
(gdb) run
Starting program: /usr/pkg/bin/mplayer 
/usr/pkg/bin/mplayer: text relocations

Program received signal SIGSEGV, Segmentation fault.
_rtld_relocate_plt_lazy (obj=obj@entry=0xb48d7000)
    at /x/netbsd-8/src/libexec/ld.elf_so/arch/i386/mdreloc.c:210
210			*where += (Elf_Addr)obj->relocbase;
(gdb) bt
#0  _rtld_relocate_plt_lazy (obj=obj@entry=0xb48d7000)
    at /x/netbsd-8/src/libexec/ld.elf_so/arch/i386/mdreloc.c:210
#1  0xbb24c515 in _rtld_relocate_objects (first=0xb48d7000, 
    bind_now=bind_now@entry=false)
    at /x/netbsd-8/src/libexec/ld.elf_so/reloc.c:213
#2  0xbb24ae89 in _rtld (sp=<optimized out>, relocbase=3139731456)
    at /x/netbsd-8/src/libexec/ld.elf_so/rtld.c:694
#3  0xbb2484aa in .rtld_start () from /usr/libexec/ld.elf_so
(gdb) list
205			Elf_Addr *where = (Elf_Addr *)(obj->relocbase + rel->r_offset);
206	
207			assert(ELF_R_TYPE(rel->r_info) == R_TYPE(JMP_SLOT));
208	
209			/* Just relocate the GOT slots pointing into the PLT */
210			*where += (Elf_Addr)obj->relocbase;
211			rdbg(("fixup !main in %s --> %p", obj->path, (void *)*where));
212		}
213	
214		return 0;
(gdb) continue
Continuing.

Program terminated with signal SIGSEGV, Segmentation fault.
The program no longer exists.
(gdb) quit


As some have noted, other ffmpeg3 users work OK on i386 (notably
firefox).

Any clues?  'mplayer' is the last show-stopper keeping me from using
netbsd-8 on my i386 systems.


For the record, my "mplayer" is built with the following options:

PKG_DEFAULT_OPTIONS+=pam ssl oss -cups -pulseaudio -alsa -dbus -gvfs
PKG_DEFAULT_OPTIONS+=-jack -arts
PKG_OPTIONS.mplayer+=aalib caca dts ggi mplayer-ssse3 mplayer-win32 debug

>How-To-Repeat:
See above.  Also affects i386-current.
>Fix:

>Release-Note:

>Audit-Trail:

State-Changed-From-To: open->feedback
State-Changed-By: leot@NetBSD.org
State-Changed-When: Thu, 09 Aug 2018 22:59:24 +0000
State-Changed-Why:
Probably PaX MPROTECT related.


From: Leonardo Taccari <leot@NetBSD.org>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: pkg/53414: mplayer tries to write-enable text segment on NetBSD/i386-8.0_RC2, fails.
Date: Fri, 10 Aug 2018 00:58:11 +0200

 Hello John,

 jdbaker@mylinuxisp.com writes:
 > >Number:         53414
 > >Category:       pkg
 > >Synopsis:       mplayer tries to write-enable text segment on NetBSD/i3=
 86-8.0_RC2, fails.
 > >Confidential:   no
 > >Severity:       serious
 > >Priority:       high
 > >Responsible:    pkg-manager
 > >State:          open
 > >Class:          sw-bug
 > >Submitter-Id:   net
 > >Arrival-Date:   Fri Jun 29 23:40:00 +0000 2018
 > >Originator:     John D. Baker
 > >Release:        NetBSD/i386-8.0_RC2, pkgsrc-HEAD (pre-pkgsrc-2018Q2)
 > >Organization:
 > >Environment:
 > NetBSD verthandi 8.0_RC2 NetBSD 8.0_RC2 (VERTHANDI) #30: Sun Jun 24 11:3=
 2:15 CDT 2018  sysop@plex760.technoskunk.fur:/r0/build/netbsd-8/obj/i386/s=
 ys/arch/i386/compile/VERTHANDI i386
 >
 > >Description:
 > Previous appended to pkg/53319, requested to file new PR.
 >
 > On my i386-8.0_RC2 system, mplayer built from recent pkgsrc-HEAD (in
 > the freeze before pkgsrc-2018Q2) fails to run as follows:
 >
 >   $ mplayer
 >   mplayer: text relocations
 >   mplayer: Cannot write-enable text segment: Permission denied
 > [...]

 Can you please try to add:

  NOT_PAX_MPROTECT_SAFE+=3D bin/mplayer

 in pkgsrc/multimedia/mplayer/Makefile before the
 `USE_TOOLS+=3D pkg-config' line (actually every line is
 probably okay) and then `make replace'?


 Thank you!

From: "John D. Baker" <jdbaker@mylinuxisp.com>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: pkg/53414: mplayer tries to write-enable text segment on
 NetBSD/i386-8.0_RC2, fails.
Date: Sat, 11 Aug 2018 11:44:57 -0500 (CDT)

 On Thu, 9 Aug 2018, Leonardo Taccari wrote:

 >  jdbaker@mylinuxisp.com writes:
 >
 >  > On my i386-8.0_RC2 system, mplayer built from recent pkgsrc-HEAD (in
 >  > the freeze before pkgsrc-2018Q2) fails to run as follows:
 >  >
 >  >   $ mplayer
 >  >   mplayer: text relocations
 >  >   mplayer: Cannot write-enable text segment: Permission denied
 >  > [...]
 >  
 >  Can you please try to add:
 >  
 >   NOT_PAX_MPROTECT_SAFE+= bin/mplayer
 >  
 >  in pkgsrc/multimedia/mplayer/Makefile before the
 >  `USE_TOOLS+= pkg-config' line (actually every line is
 >  probably okay) and then `make replace'?

 Now on i386-8.0_STABLE...

 As I had removed "mplayer" entirely, rather than replace, I performed
 a fresh "package-install" with the above modification to the package
 Makefile.  The resulting 'mplayer' now simply crashes with:

   $ mplayer
   mplayer: text relocations
   Memory fault (core dumped) 

 'gdb' shows:

 [...]
 Core was generated by `mplayer'.
 Program terminated with signal SIGSEGV, Segmentation fault.
 #0  0xbaff1790 in ?? ()
 (gdb) bt
 #0  0xbaff1790 in ?? ()
 #1  0xbb003000 in ?? ()
 Backtrace stopped: previous frame inner to this frame (corrupt stack?)

 I'll see about building with the "debug" option along with
 "INSTALL_UNSTRIPPED=yes" and "C{,XX}FLAGS+=-ggdb"

 -- 
 |/"\ John D. Baker, KN5UKS               NetBSD     Darwin/MacOS X
 |\ / jdbaker[snail]mylinuxisp[flyspeck]com    OpenBSD            FreeBSD
 | X  No HTML/proprietary data in email.   BSD just sits there and works!
 |/ \ GPGkeyID:  D703 4A7E 479F 63F8 D3F4  BD99 9572 8F23 E4AD 1645

From: "John D. Baker" <jdbaker@mylinuxisp.com>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: pkg/53414: mplayer tries to write-enable text segment on
 NetBSD/i386-8.0_RC2, fails.
Date: Sat, 11 Aug 2018 11:47:53 -0500 (CDT)

 On Sat, 11 Aug 2018, John D. Baker wrote:

 > 'gdb' shows:
 > 
 > [...]
 > Core was generated by `mplayer'.
 > Program terminated with signal SIGSEGV, Segmentation fault.
 > #0  0xbaff1790 in ?? ()
 > (gdb) bt
 > #0  0xbaff1790 in ?? ()
 > #1  0xbb003000 in ?? ()
 > Backtrace stopped: previous frame inner to this frame (corrupt stack?)

 Attempting to run 'mplayer' under 'gdb' directly shows:

 $ gdb mplayer
 [...]
 (gdb) run
 Starting program: /usr/pkg/bin/mplayer 
 /usr/pkg/bin/mplayer: text relocations

 Program received signal SIGSEGV, Segmentation fault.
 0xbb3f7790 in _rtld_relocate_plt_lazy () from /usr/libexec/ld.elf_so
 (gdb) bt
 #0  0xbb3f7790 in _rtld_relocate_plt_lazy () from /usr/libexec/ld.elf_so
 #1  0xbb3fb515 in _rtld_relocate_objects () from /usr/libexec/ld.elf_so
 #2  0xbb3f9e89 in _rtld () from /usr/libexec/ld.elf_so
 #3  0xbb3f74aa in .rtld_start () from /usr/libexec/ld.elf_so


 -- 
 |/"\ John D. Baker, KN5UKS               NetBSD     Darwin/MacOS X
 |\ / jdbaker[snail]mylinuxisp[flyspeck]com    OpenBSD            FreeBSD
 | X  No HTML/proprietary data in email.   BSD just sits there and works!
 |/ \ GPGkeyID:  D703 4A7E 479F 63F8 D3F4  BD99 9572 8F23 E4AD 1645

From: "John D. Baker" <jdbaker@mylinuxisp.com>
To: gnats-bugs@NetBSD.org
Cc: 
Subject: Re: pkg/53414: mplayer tries to write-enable text segment on
 NetBSD/i386-8.0_RC2, fails.
Date: Sat, 11 Aug 2018 13:44:23 -0500 (CDT)

 On Sat, 11 Aug 2018, John D. Baker wrote:

 > I'll see about building with the "debug" option along with
 > "INSTALL_UNSTRIPPED=yes" and "C{,XX}FLAGS+=-ggdb"

 Also installed the {,x}debug sets.  Running 'mplayer' by itself may
 produce a core file that 'gdb' interprets as having a corrupt stack
 frame as shown in a previous addendum to this PR.

 Other times, as well as running under 'gdb' directly produces:

 $ gdb mplayer mplayer.core 
 [...]
 Reading symbols from mplayer...done.
 [New process 1]

 warning: Can't read pathname for load map: Unknown error: 4294967295.
 Core was generated by `mplayer'.
 Program terminated with signal SIGSEGV, Segmentation fault.
 #0  _rtld_relocate_plt_lazy (obj=obj@entry=0xb3dd3000)
     at /x/netbsd-8/src/libexec/ld.elf_so/arch/i386/mdreloc.c:210
 210                     *where += (Elf_Addr)obj->relocbase;
 (gdb) bt
 #0  _rtld_relocate_plt_lazy (obj=obj@entry=0xb3dd3000)
     at /x/netbsd-8/src/libexec/ld.elf_so/arch/i386/mdreloc.c:210
 #1  0xbb90d515 in _rtld_relocate_objects (first=0xb3dd3000, 
     bind_now=bind_now@entry=false)
     at /x/netbsd-8/src/libexec/ld.elf_so/reloc.c:213
 #2  0xbb90be89 in _rtld (sp=<optimized out>, relocbase=3146813440)
     at /x/netbsd-8/src/libexec/ld.elf_so/rtld.c:694
 #3  0xbb9094aa in .rtld_start () from /usr/libexec/ld.elf_so



 -- 
 |/"\ John D. Baker, KN5UKS               NetBSD     Darwin/MacOS X
 |\ / jdbaker[snail]mylinuxisp[flyspeck]com    OpenBSD            FreeBSD
 | X  No HTML/proprietary data in email.   BSD just sits there and works!
 |/ \ GPGkeyID:  D703 4A7E 479F 63F8 D3F4  BD99 9572 8F23 E4AD 1645

State-Changed-From-To: feedback->open
State-Changed-By: leot@NetBSD.org
State-Changed-When: Mon, 13 Aug 2018 00:50:44 +0000
State-Changed-Why:
Feedback provided, probably not (or not just) PaX MPROTECT related.


>Unformatted:

NetBSD Home
NetBSD PR Database Search

(Contact us) $NetBSD: query-full-pr,v 1.43 2018/01/16 07:36:43 maya Exp $
$NetBSD: gnats_config.sh,v 1.9 2014/08/02 14:16:04 spz Exp $
Copyright © 1994-2017 The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.