ruby_xfree segmentation fault

Bug #2049197 reported by Toni
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
ruby3.0 (Ubuntu)
Invalid
Undecided
Unassigned
Jammy
Fix Released
Undecided
Lucas Kanashiro
Lunar
Won't Fix
Undecided
Unassigned
Mantic
Invalid
Undecided
Unassigned
Noble
Invalid
Undecided
Unassigned
ruby3.1 (Ubuntu)
Invalid
Undecided
Unassigned
Jammy
Invalid
Undecided
Unassigned
Lunar
Invalid
Undecided
Unassigned
Mantic
Fix Released
Undecided
Lucas Kanashiro
Noble
Invalid
Undecided
Unassigned
ruby3.2 (Ubuntu)
Fix Released
Undecided
Lucas Kanashiro
Jammy
Invalid
Undecided
Unassigned
Lunar
Invalid
Undecided
Unassigned
Mantic
Invalid
Undecided
Unassigned
Noble
Fix Released
Undecided
Lucas Kanashiro

Bug Description

[Impact]

Users might face a segfault when using ruby_free.

[Test Plan]

# apt update && apt install -y ruby ruby-nokogiri
# cat > reproducer.rb <<EOF
require 'nokogiri'

# must have an error in it to cause pthread_setspecific to be called
html = "<div foo='asdf>asdf</div>"

Thread.new { Nokogiri::HTML4::Document.parse(html) }
sleep 3 # THREAD_CACHE_TIME

exit 0
EOF
# while true; do ruby reproducer.rb; done

After a while (this may take several minutes to manifest) I got the reported error:

[BUG] Segmentation fault at 0x0000000000000440[BUG] Segmentation fault at 0x0000000000000440
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu]

-- Machine register context ------------------------------------------------
 RIP: 0x00007c8ec2ac2fcb RBP: 0x000059ae2e596d20 RSP: 0x00007c8ebc5fed70
 RAX: 0x0000000000000000 RBX: 0x00007c8ebc5ff640 RCX: 0x0000000000000006
 RDX: 0x0000000000000002[BUG] [BUG] Segmentation fault at 0x0000000000000440
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu]

-- Machine register context ------------------------------------------------
 RIP: 0x000075c4b4ec2fcb RBP: 0x000062693580e190 RSP: 0x000075c4ae9fed70
 RAX: 0x0000000000000000 RBX: 0x000075c4ae9ff640 RCX: 0x0000000000000006
 RDX: 0x0000000000000002 RDI: 0x000062693580e190 RSI: 0x0000000000000000
  R8: 0x000075c4ae9fede4 R9: 0x00000000000000ca R10: 0x0000000000000000
 R11: 0x0000000000000246 R12: 0x000075c4b5170b40
 R13: 0x000075c4ae9fedc0

The fixed package should not segfault under this condition.

[Where Problems could occur]

The upstream patch to fix this tries to address a timing issue, where depending on the order of things might cause a segfault. The assumption might not be true and users could still get a segfault under some very specific scenario that was not initially considered.

[Original Description]

After looking through the source it seems there is a bug in all current ruby3.X packages affecting at least versions >=22.04 that causes segfault relatively rarely. Even though rare with repetitions running small wrappers it will be seen quite a bit, up to dozens of times in a day.

There exists a patch upstream, could that be picked to Ubuntu repo(s)?

The fix and other resources:
https://github.com/ruby/ruby/pull/7663
https://bugs.ruby-lang.org/issues/19580
https://gitlab.com/gitlab-org/omnibus-gitlab/-/commit/bd949e2b40cc434a1e4d72be2bff6523e8a91904

Related branches

Toni (tonisa)
description: updated
Revision history for this message
Athos Ribeiro (athos-ribeiro) wrote :

Thanks for reporting this issue.

I was able to reproduce this in a fresh jammy installation in a VM.

Reproducer (as proposed in https://github.com/ruby/ruby/pull/7663):

# apt update && apt install -y ruby ruby-nokogiri

# cat > reproducer.rb <<EOF
require 'nokogiri'

# must have an error in it to cause pthread_setspecific to be called
html = "<div foo='asdf>asdf</div>"

Thread.new { Nokogiri::HTML4::Document.parse(html) }
sleep 3 # THREAD_CACHE_TIME

exit 0
EOF

# while true; do ruby reproducer.rb; done

After a while (this may take several minutes to manifest) I got the reported error:

[BUG] Segmentation fault at 0x0000000000000440[BUG] Segmentation fault at 0x0000000000000440
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu]

-- Machine register context ------------------------------------------------
 RIP: 0x00007c8ec2ac2fcb RBP: 0x000059ae2e596d20 RSP: 0x00007c8ebc5fed70
 RAX: 0x0000000000000000 RBX: 0x00007c8ebc5ff640 RCX: 0x0000000000000006
 RDX: 0x0000000000000002[BUG] [BUG] Segmentation fault at 0x0000000000000440
ruby 3.0.2p107 (2021-07-07 revision 0db68f0233) [x86_64-linux-gnu]

-- Machine register context ------------------------------------------------
 RIP: 0x000075c4b4ec2fcb RBP: 0x000062693580e190 RSP: 0x000075c4ae9fed70
 RAX: 0x0000000000000000 RBX: 0x000075c4ae9ff640 RCX: 0x0000000000000006
 RDX: 0x0000000000000002 RDI: 0x000062693580e190 RSI: 0x0000000000000000
  R8: 0x000075c4ae9fede4 R9: 0x00000000000000ca R10: 0x0000000000000000
 R11: 0x0000000000000246 R12: 0x000075c4b5170b40
 R13: 0x000075c4ae9fedc0

Changed in ruby3.0 (Ubuntu Noble):
status: New → Triaged
Changed in ruby3.0 (Ubuntu Mantic):
status: New → Triaged
Changed in ruby3.0 (Ubuntu Lunar):
status: New → Triaged
Changed in ruby3.0 (Ubuntu Jammy):
status: New → Triaged
Revision history for this message
Lucas Kanashiro (lucaskanashiro) wrote :

Lunar is EOL, so marking its task as Won't Fix.

Changed in ruby3.0 (Ubuntu Lunar):
status: Triaged → Won't Fix
Changed in ruby3.1 (Ubuntu Jammy):
status: New → Invalid
Changed in ruby3.0 (Ubuntu Mantic):
status: Triaged → Invalid
Changed in ruby3.0 (Ubuntu Noble):
status: Triaged → Invalid
Changed in ruby3.1 (Ubuntu Lunar):
status: New → Invalid
Changed in ruby3.1 (Ubuntu Noble):
status: New → Invalid
Changed in ruby3.2 (Ubuntu Jammy):
status: New → Invalid
Changed in ruby3.2 (Ubuntu Lunar):
status: New → Invalid
Changed in ruby3.2 (Ubuntu Mantic):
status: New → Invalid
Changed in ruby3.2 (Ubuntu Noble):
status: New → Triaged
Changed in ruby3.1 (Ubuntu Mantic):
status: New → Triaged
Changed in ruby3.0 (Ubuntu Jammy):
assignee: nobody → Lucas Kanashiro (lucaskanashiro)
Changed in ruby3.1 (Ubuntu Mantic):
assignee: nobody → Lucas Kanashiro (lucaskanashiro)
Changed in ruby3.2 (Ubuntu Noble):
assignee: nobody → Lucas Kanashiro (lucaskanashiro)
tags: added: server-todo
Revision history for this message
Lucas Kanashiro (lucaskanashiro) wrote :

This is fixed in ruby3.2/3.2.3-1build2 in Noble.

Changed in ruby3.2 (Ubuntu Noble):
status: Triaged → Fix Released
description: updated
Revision history for this message
Timo Aaltonen (tjaalton) wrote : Please test proposed package

Hello Toni, or anyone else affected,

Accepted ruby3.1 into mantic-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ruby3.1/3.1.2-7ubuntu3.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-mantic to verification-done-mantic. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-mantic. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in ruby3.1 (Ubuntu Mantic):
status: Triaged → Fix Committed
tags: added: verification-needed verification-needed-mantic
Revision history for this message
Timo Aaltonen (tjaalton) wrote :

Hello Toni, or anyone else affected,

Accepted ruby3.0 into jammy-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/ruby3.0/3.0.2-7ubuntu2.5 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-jammy to verification-done-jammy. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-jammy. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

Changed in ruby3.0 (Ubuntu Jammy):
status: Triaged → Fix Committed
tags: added: verification-needed-jammy
Revision history for this message
Ubuntu SRU Bot (ubuntu-sru-bot) wrote : Autopkgtest regression report (ruby3.1/3.1.2-7ubuntu3.1)

All autopkgtests for the newly accepted ruby3.1 (3.1.2-7ubuntu3.1) for mantic have finished running.
The following regressions have been reported in tests triggered by the package:

passenger/6.0.17+ds-1build1 (arm64)
ruby-defaults/1:3.1 (i386)
ruby-rblineprof/0.3.7-2build5 (s390x)
ruby3.1/3.1.2-7ubuntu3.1 (i386)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/mantic/update_excuses.html#ruby3.1

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Revision history for this message
Ubuntu SRU Bot (ubuntu-sru-bot) wrote : Autopkgtest regression report (ruby3.0/3.0.2-7ubuntu2.5)

All autopkgtests for the newly accepted ruby3.0 (3.0.2-7ubuntu2.5) for jammy have finished running.
The following regressions have been reported in tests triggered by the package:

passenger/6.0.10-3build2 (amd64)
puma/5.5.2-2ubuntu2 (ppc64el)
ruby-commonmarker/0.23.2-2 (ppc64el)
ruby-kyotocabinet/1.34-0.1build1 (armhf)
ruby-prof/1.3.1-2build2 (arm64)

Please visit the excuses page listed below and investigate the failures, proceeding afterwards as per the StableReleaseUpdates policy regarding autopkgtest regressions [1].

https://people.canonical.com/~ubuntu-archive/proposed-migration/jammy/update_excuses.html#ruby3.0

[1] https://wiki.ubuntu.com/StableReleaseUpdates#Autopkgtest_Regressions

Thank you!

Revision history for this message
Lucas Kanashiro (lucaskanashiro) wrote :

# Verification Mantic

root@ruby31-segfault-fix:~# dpkg -l ruby3.1
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-================-============-======================================================
ii ruby3.1 3.1.2-7ubuntu3.1 amd64 Interpreter of object-oriented scripting language Ruby
root@ruby31-segfault-fix:~# cat reproducer.rb
require 'nokogiri'

# must have an error in it to cause pthread_setspecific to be called
html = "<div foo='asdf>asdf</div>"

Thread.new { Nokogiri::HTML4::Document.parse(html) }
sleep 3 # THREAD_CACHE_TIME

exit 0
root@ruby31-segfault-fix:~# time while true; do ruby reproducer.rb; done
^Creproducer.rb:7:in `sleep': Interrupt
 from reproducer.rb:7:in `<main>'

real 8m5.499s
user 0m10.297s
sys 0m4.874s

More than 8 minutes running the script without any segfault.

# Verification Jammy

root@ruby30-segfault-fix:~# dpkg -l ruby3.0
Desired=Unknown/Install/Remove/Purge/Hold
| Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend
|/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad)
||/ Name Version Architecture Description
+++-==============-================-============-======================================================
ii ruby3.0 3.0.2-7ubuntu2.5 amd64 Interpreter of object-oriented scripting language Ruby
root@ruby30-segfault-fix:~# cat reproducer.rb
require 'nokogiri'

# must have an error in it to cause pthread_setspecific to be called
html = "<div foo='asdf>asdf</div>"

Thread.new { Nokogiri::HTML4::Document.parse(html) }
sleep 3 # THREAD_CACHE_TIME

exit 0
root@ruby30-segfault-fix:~# time while true; do ruby reproducer.rb; done
^Creproducer.rb:7:in `sleep': Interrupt
 from reproducer.rb:7:in `<main>'

real 8m4.811s
user 0m10.094s
sys 0m4.370s

More than 8 minutes running the script without any segfault.

tags: added: verification-done verification-done-jammy verification-done-mantic
removed: verification-needed verification-needed-jammy verification-needed-mantic
Revision history for this message
Lucas Kanashiro (lucaskanashiro) wrote :

FWIW there is no autopkgtest regression now.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ruby3.1 - 3.1.2-7ubuntu3.1

---------------
ruby3.1 (3.1.2-7ubuntu3.1) mantic; urgency=medium

  * d/p/fix-ruby_xfree-segfault.patch: fix occasional segfault (LP: #2049197).
  * Replace expired certificate in tests with upstream patch (LP: #2051380).
    - d/p/renew-test-certificates-d3933fc753187a055a4904af82f5f3794c88c416.patch

 -- Lucas Kanashiro <email address hidden> Wed, 20 Mar 2024 17:39:43 -0300

Changed in ruby3.1 (Ubuntu Mantic):
status: Fix Committed → Fix Released
Revision history for this message
Andreas Hasenack (ahasenack) wrote : Update Released

The verification of the Stable Release Update for ruby3.1 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package ruby3.0 - 3.0.2-7ubuntu2.5

---------------
ruby3.0 (3.0.2-7ubuntu2.5) jammy; urgency=medium

  * d/p/fix-ruby_xfree-segfault.patch: fix occasional segfault (LP: #2049197).
  * Replace expired certificate in tests with upstream patch (LP: #2051380).
    - d/p/renew-test-certificates-d3933fc753187a055a4904af82f5f3794c88c416.patch

 -- Lucas Kanashiro <email address hidden> Wed, 20 Mar 2024 17:50:02 -0300

Changed in ruby3.0 (Ubuntu Jammy):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.