ruby_xfree segmentation fault
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
ruby3.0 (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Jammy |
Fix Released
|
Undecided
|
Lucas Kanashiro | ||
Lunar |
Won't Fix
|
Undecided
|
Unassigned | ||
Mantic |
Invalid
|
Undecided
|
Unassigned | ||
Noble |
Invalid
|
Undecided
|
Unassigned | ||
ruby3.1 (Ubuntu) |
Invalid
|
Undecided
|
Unassigned | ||
Jammy |
Invalid
|
Undecided
|
Unassigned | ||
Lunar |
Invalid
|
Undecided
|
Unassigned | ||
Mantic |
Fix Released
|
Undecided
|
Lucas Kanashiro | ||
Noble |
Invalid
|
Undecided
|
Unassigned | ||
ruby3.2 (Ubuntu) |
Fix Released
|
Undecided
|
Lucas Kanashiro | ||
Jammy |
Invalid
|
Undecided
|
Unassigned | ||
Lunar |
Invalid
|
Undecided
|
Unassigned | ||
Mantic |
Invalid
|
Undecided
|
Unassigned | ||
Noble |
Fix Released
|
Undecided
|
Lucas Kanashiro |
Bug Description
[Impact]
Users might face a segfault when using ruby_free.
[Test Plan]
# apt update && apt install -y ruby ruby-nokogiri
# cat > reproducer.rb <<EOF
require 'nokogiri'
# must have an error in it to cause pthread_setspecific to be called
html = "<div foo='asdf>
Thread.new { Nokogiri:
sleep 3 # THREAD_CACHE_TIME
exit 0
EOF
# while true; do ruby reproducer.rb; done
After a while (this may take several minutes to manifest) I got the reported error:
[BUG] Segmentation fault at 0x0000000000000
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu]
-- Machine register context -------
RIP: 0x00007c8ec2ac2fcb RBP: 0x000059ae2e596d20 RSP: 0x00007c8ebc5fed70
RAX: 0x0000000000000000 RBX: 0x00007c8ebc5ff640 RCX: 0x0000000000000006
RDX: 0x0000000000000
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu]
-- Machine register context -------
RIP: 0x000075c4b4ec2fcb RBP: 0x000062693580e190 RSP: 0x000075c4ae9fed70
RAX: 0x0000000000000000 RBX: 0x000075c4ae9ff640 RCX: 0x0000000000000006
RDX: 0x0000000000000002 RDI: 0x000062693580e190 RSI: 0x0000000000000000
R8: 0x000075c4ae9fede4 R9: 0x00000000000000ca R10: 0x0000000000000000
R11: 0x0000000000000246 R12: 0x000075c4b5170b40
R13: 0x000075c4ae9fedc0
The fixed package should not segfault under this condition.
[Where Problems could occur]
The upstream patch to fix this tries to address a timing issue, where depending on the order of things might cause a segfault. The assumption might not be true and users could still get a segfault under some very specific scenario that was not initially considered.
[Original Description]
After looking through the source it seems there is a bug in all current ruby3.X packages affecting at least versions >=22.04 that causes segfault relatively rarely. Even though rare with repetitions running small wrappers it will be seen quite a bit, up to dozens of times in a day.
There exists a patch upstream, could that be picked to Ubuntu repo(s)?
The fix and other resources:
https:/
https:/
https:/
Related branches
- Sergio Durigan Junior (community): Approve
- git-ubuntu bot: Approve
- Canonical Server Reporter: Pending requested
-
Diff: 345 lines (+317/-0)4 files modifieddebian/changelog (+8/-0)
debian/patches/fix-ruby_xfree-segfault.patch (+46/-0)
debian/patches/renew-test-certificates-844672256e8e843a7e3a52b7e3c9bb8ea4c328b4.patch (+260/-0)
debian/patches/series (+3/-0)
- git-ubuntu bot: Approve
- Sergio Durigan Junior (community): Approve
- Canonical Server Reporter: Pending requested
-
Diff: 344 lines (+316/-0)4 files modifieddebian/changelog (+8/-0)
debian/patches/fix-ruby_xfree-segfault.patch (+46/-0)
debian/patches/renew-test-certificates-844672256e8e843a7e3a52b7e3c9bb8ea4c328b4.patch (+260/-0)
debian/patches/series (+2/-0)
Thanks for reporting this issue.
I was able to reproduce this in a fresh jammy installation in a VM.
Reproducer (as proposed in https:/ /github. com/ruby/ ruby/pull/ 7663):
# apt update && apt install -y ruby ruby-nokogiri
# cat > reproducer.rb <<EOF
require 'nokogiri'
# must have an error in it to cause pthread_setspecific to be called asdf</div> "
html = "<div foo='asdf>
Thread.new { Nokogiri: :HTML4: :Document. parse(html) }
sleep 3 # THREAD_CACHE_TIME
exit 0
EOF
# while true; do ruby reproducer.rb; done
After a while (this may take several minutes to manifest) I got the reported error:
[BUG] Segmentation fault at 0x0000000000000 440[BUG] Segmentation fault at 0x0000000000000440
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu]
-- Machine register context ------- ------- ------- ------- ------- ------- ------ 002[BUG] [BUG] Segmentation fault at 0x0000000000000440
RIP: 0x00007c8ec2ac2fcb RBP: 0x000059ae2e596d20 RSP: 0x00007c8ebc5fed70
RAX: 0x0000000000000000 RBX: 0x00007c8ebc5ff640 RCX: 0x0000000000000006
RDX: 0x0000000000000
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu]
-- Machine register context ------- ------- ------- ------- ------- ------- ------
RIP: 0x000075c4b4ec2fcb RBP: 0x000062693580e190 RSP: 0x000075c4ae9fed70
RAX: 0x0000000000000000 RBX: 0x000075c4ae9ff640 RCX: 0x0000000000000006
RDX: 0x0000000000000002 RDI: 0x000062693580e190 RSI: 0x0000000000000000
R8: 0x000075c4ae9fede4 R9: 0x00000000000000ca R10: 0x0000000000000000
R11: 0x0000000000000246 R12: 0x000075c4b5170b40
R13: 0x000075c4ae9fedc0