Monday, May 04, 2020

Re: Privoxy crashes on one OpenBSD machine but not another

Hi,

TJ <dll-kmskdm@protonmail.com> writes:
>
> I tried launching the daemon from gdb to diagnose the problem, but the
> package of course has no debug symbols. When gdb ran it from the
> /var/privoxy chroot, the process crashed with a SIGPIPE. When I tested
> it running outside the chroot, it crashed with a SIGABRT due to a
> use-after-free. Privoxy also develops problems resolving its own IP
> address, but this might be a separate issue/misconfiguration.

I had it crashing on me all the time as well two years ago with similiar
symptoms like you describe. I see that Privoxy 3.0.28 has had
substantial improvements but you need to go to current or wait for 6.7
to get that.

I include my, by now, archaeological back traces that seems to indicate
problems with async resolving:

(gdb) info registers
rax 0x322 802
rbx 0xbc1f59ba36a 12927677211498
rcx 0xbc284e5c300 12930081211136
rdx 0xbc234bb12e0 12928736236256
rsi 0xdfdfdfdf 3755991007
rdi 0xbc1f59b87e0 12927677204448
rbp 0xbc1f59ba620 0xbc1f59ba620
rsp 0xbc1f59ba2d0 0xbc1f59ba2d0
r8 0x101010101010101 72340172838076673
r9 0x8080808080808080 -9187201950435737472
r10 0x96a09c9d9693a0ff -7592896771096600321
r11 0x0 0
r12 0xbc234bb1620 12928736237088
r13 0xbbfcfa3cddb 12918450277851
r14 0xbc27819b808 12929866512392
r15 0x1bb 443
rip 0xbbfcf91c7f9 0xbbfcf91c7f9 <load_action_files+109081>
eflags 0x10206 66054
cs 0x2b 43
ss 0x23 35
ds 0x23 35
es 0x23 35
fs 0x23 35
gs 0x23 35
(gdb) bt
#0 0x00000bc293f1e8e5 in getaddrinfo_async_run (as=0xbc296c3d100, ar=0xbc1f59ba138)
at /usr/src/lib/libc/asr/getaddrinfo_async.c:515
#1 0x00000bc293eec63c in _libc_asr_run_sync (as=0xbc296c3d100, ar=0xbc1f59ba138)
at /usr/src/lib/libc/asr/asr.c:148
#2 0x00000bc293f64f46 in _libc_getaddrinfo (hostname=0xbc234bb1620 "scontent.xx.fbcdn.net",
servname=0xbc1f59ba36a "443", hints=0xbc1f59ba330, res=0xbc1f59ba328)
at /usr/src/lib/libc/asr/getaddrinfo.c:47
#3 0x00000bbfcf91c7f9 in load_action_files () from /usr/local/sbin/privoxy
#4 0x00000bbfcf91bd67 in load_action_files () from /usr/local/sbin/privoxy
#5 0x00000bbfcf92040c in load_action_files () from /usr/local/sbin/privoxy
#6 0x00000bbfcf91edf5 in load_action_files () from /usr/local/sbin/privoxy
#7 0x00000bc26629e39e in _rthread_start (v=Variable "v" is not available.
) at /usr/src/lib/librthread/rthread.c:96
#8 0x00000bc293ee9ebb in __tfork_thread () at /usr/src/lib/libc/arch/amd64/sys/tfork_thread.S:75
#9 0x0000000000000000 in ?? ()
(gdb)


Second crash>


Program received signal SIGSEGV, Segmentation fault.
[Switching to thread 490396]
_libc_freeaddrinfo (ai=0x0) at /usr/src/lib/libc/net/freeaddrinfo.c:46
46 free(p->ai_canonname);
(gdb) bt
#0 _libc_freeaddrinfo (ai=0x0) at /usr/src/lib/libc/net/freeaddrinfo.c:46
#1 0x000006925e91cb8d in load_action_files () from /usr/local/sbin/privoxy
#2 0x000006925e91bd67 in load_action_files () from /usr/local/sbin/privoxy
#3 0x000006925e92040c in load_action_files () from /usr/local/sbin/privoxy
#4 0x000006925e91edf5 in load_action_files () from /usr/local/sbin/privoxy
#5 0x00000694ba53c39e in _rthread_start (v=Variable "v" is not available.
) at /usr/src/lib/librthread/rthread.c:96
#6 0x00000694a9946ebb in __tfork_thread () at /usr/src/lib/libc/arch/amd64/sys/tfork_thread.S:75
#7 0x0000000000000000 in ?? ()
(gdb) info reg
rax 0x694be27b000 7235915198464
rbx 0x0 0
rcx 0x694a9c0b080 7235572904064
rdx 0x694ac6d6440 7235617776704
rsi 0x694a9aeddff 7235571736063
rdi 0x0 0
rbp 0x695056a5e80 0x695056a5e80
rsp 0x695056a5e70 0x695056a5e70
r8 0x694ac6d6440 7235617776704
r9 0x0 0
r10 0x2 2
r11 0x0 0
r12 0x694a2d8a020 7235457032224
r13 0x695056a5f30 7237110751024
r14 0x0 0
r15 0x50 80
rip 0x694a9966bb0 0x694a9966bb0 <_libc_freeaddrinfo+16>
eflags 0x10246 66118
cs 0x2b 43
ss 0x23 35
ds 0x23 35
es 0x23 35
fs 0x23 35
gs 0x23 35
(gdb)


Program received signal SIGSEGV, Segmentation fault.
[Switching to thread 260559]
0x0000083d7f02d8e5 in getaddrinfo_async_run (as=0x83e17b97600, ar=0x83e04037548)
at /usr/src/lib/libc/asr/getaddrinfo_async.c:515
515 return AS_FAMILY(as);
Current language: auto; currently minimal
(gdb) bt
#0 0x0000083d7f02d8e5 in getaddrinfo_async_run (as=0x83e17b97600, ar=0x83e04037548)
at /usr/src/lib/libc/asr/getaddrinfo_async.c:515
#1 0x0000083d7effb63c in _libc_asr_run_sync (as=0x83e17b97600, ar=0x83e04037548)
at /usr/src/lib/libc/asr/asr.c:148
#2 0x0000083d7f073f46 in _libc_getaddrinfo (hostname=0x83d7b61e0a0 "www.hammarbyfotboll.se",
servname=0x83e0403777a "80", hints=0x83e04037740, res=0x83e04037738)
at /usr/src/lib/libc/asr/getaddrinfo.c:47
#3 0x0000083b3401c7f9 in load_action_files () from /usr/local/sbin/privoxy
#4 0x0000083b3401bd67 in load_action_files () from /usr/local/sbin/privoxy
#5 0x0000083b3402040c in load_action_files () from /usr/local/sbin/privoxy
#6 0x0000083b3401edf5 in load_action_files () from /usr/local/sbin/privoxy
#7 0x0000083dcce6539e in _rthread_start (v=Variable "v" is not available.
) at /usr/src/lib/librthread/rthread.c:96
#8 0x0000083d7eff8ebb in __tfork_thread () at /usr/src/lib/libc/arch/amd64/sys/tfork_thread.S:75
#9 0x0000000000000000 in ?? ()
(gdb) info regs
Undefined info command: "regs". Try "help info".
(gdb) info reg
rax 0xe2 226
rbx 0x83d7f1a1810 9060218443792
rcx 0x83dd262ac00 9061615709184
rdx 0x83d7f2d1d20 9060219690272
rsi 0xdfdfdfdf 3755991007
rdi 0x83e04035bf0 9062448323568
rbp 0x83e040374b0 0x83e040374b0
rsp 0x83e04035ba0 0x83e04035ba0
r8 0x83d7f2be7e0 9060219611104
r9 0x1f9 505
r10 0x83dfb1811e0 9062298685920
r11 0x83d72c5d000 9060011593728
r12 0x83e04037548 9062448330056
r13 0x83e17b97618 9062779024920
r14 0x83e17b97600 9062779024896
r15 0x83e04036430 9062448325680
rip 0x83d7f02d8e5 0x83d7f02d8e5 <getaddrinfo_async_run+757>
eflags 0x10206 66054
cs 0x2b 43
ss 0x23 35
ds 0x23 35
es 0x23 35
fs 0x23 35
gs 0x23 35
(gdb)

(gdb) bt
#0 thrkill () at -:3
#1 0x00000221d7ad64ae in _libc_abort () at /usr/src/lib/libc/stdlib/abort.c:51
#2 0x00000221d7b20309 in wrterror (d=Variable "d" is not available.
) at /usr/src/lib/libc/stdlib/malloc.c:291
#3 0x00000221d7b20e92 in ofree (argpool=Variable "argpool" is not available.
) at tcb.h:43
#4 0x00000221d7b203e9 in free (ptr=0x221ad578dc0) at /usr/src/lib/libc/stdlib/malloc.c:1430
#5 0x0000021f5c122521 in load_action_files () from /usr/local/sbin/privoxy
#6 0x0000021f5c1218de in load_action_files () from /usr/local/sbin/privoxy
#7 0x0000021f5c11eded in load_action_files () from /usr/local/sbin/privoxy
#8 0x0000022220fc739e in _rthread_start (v=Variable "v" is not available.
) at /usr/src/lib/librthread/rthread.c:96
#9 0x00000221d7abaebb in __tfork_thread () at /usr/src/lib/libc/arch/amd64/sys/tfork_thread.S:75
#10 0x0000000000000000 in ?? ()
(gdb) info reg
rax 0x0 0
rbx 0x5b0 1456
rcx 0x221d7b1b4aa 2344375923882
rdx 0x0 0
rsi 0x6 6
rdi 0x0 0
rbp 0x221bbaa5dc0 0x221bbaa5dc0
rsp 0x221bbaa5d98 0x221bbaa5d98
r8 0x221bbaa5708 2343905679112
r9 0x221d7c63a42 2344377268802
r10 0x221d7abf588 2344375547272
r11 0x246 582
r12 0x221db812180 2344439849344
r13 0x24 36
r14 0x221bbaa5db4 2343905680820
r15 0x2217b55a0c0 2342826385600
rip 0x221d7b1b4aa 0x221d7b1b4aa <thrkill+10>
eflags 0x246 582
cs 0x2b 43
ss 0x23 35
ds 0x23 35
es 0x23 35
fs 0x23 35
gs 0x23 35
(gdb)

The program being debugged has been started already.
Start it from the beginning? (y or n) y

Starting program: /usr/local/sbin/privoxy --no-daemon --user _privoxy._privoxy /etc/privoxy/config
2018-01-24 22:39:17.902 1065fcb67d8 Info: Privoxy version 3.0.26
2018-01-24 22:39:17.903 1065fcb67d8 Info: Program name: /usr/local/sbin/privoxy
privoxy(79271) in free(): use after free 0x106737ce900

Program received signal SIGABRT, Aborted.
[Switching to thread 433384]
thrkill () at -:3
3 -: No such file or directory.
in -
(gdb) bt
#0 thrkill () at -:3
#1 0x000001065fa0d4ae in _libc_abort () at /usr/src/lib/libc/stdlib/abort.c:51
#2 0x000001065fa57309 in wrterror (d=Variable "d" is not available.
) at /usr/src/lib/libc/stdlib/malloc.c:291
#3 0x000001065fa57e92 in ofree (argpool=Variable "argpool" is not available.
) at tcb.h:43
#4 0x000001065fa573e9 in free (ptr=0x1066d0aa880) at /usr/src/lib/libc/stdlib/malloc.c:1430
#5 0x000001040e917623 in load_action_files () from /usr/local/sbin/privoxy
#6 0x000001040e907520 in load_action_files () from /usr/local/sbin/privoxy
#7 0x000001040e9210f4 in load_action_files () from /usr/local/sbin/privoxy
#8 0x000001040e91edf5 in load_action_files () from /usr/local/sbin/privoxy
#9 0x00000106e5dca39e in _rthread_start (v=Variable "v" is not available.
) at /usr/src/lib/librthread/rthread.c:96
#10 0x000001065f9f1ebb in __tfork_thread () at /usr/src/lib/libc/arch/amd64/sys/tfork_thread.S:75
#11 0x0000000000000000 in ?? ()
(gdb)

/gabriel

No comments:

Post a Comment