[focal SRU] davfs2 unable to unmount: segfault error 4 in libc.so

[Sascha]

[IMPACT]

umount.davfs consistently segfault in focal. This leads to a number of medium severity issues.

- inability to unmount (this might have security implications)
- inability to remount
- autofs fails to unmount
- reports of higher load in multi-user environments
- computer "hangs" on shutdown waiting for successful umount completion

[TEST CASE]

No need for a specific test case, simply mount a resource via davfs2.mount. Calling umount.davfs2 on that mount in focal will result in a segfault every time. Exit code 255 and failure is recorded in syslog. The mount stays mounted.

To verify the fix from #2 which is the backport of the fix from upstream, simply recompile davfs2 and try the procedure once more to see if the problem has been solved.

[REGRESSION POTENTIAL]

I will leave this mostly to others to evaluate. Currently, umount.davfs2 is completely dysfunctional so it's hard to imagine a regression for a binary that isn't doing anything except segfaulting.

[racb] Code that parses its own pidfile is being fixed. It was segfaulting before, so as mentioned it is unlikely to break further as a cause of this patch, except the normal latent bug being exposed on rebuild risk. If there is a problem with the pidfile parsing being introduced, then code further down this path could break.

[OTHER INFO]

groovy and later versions have already been fixed via a new upstream release. Upstream discussion of the a and m mixup can be found at the links below. Duplicate bug 1859293 also has some very good background.

[ORIGINAL REPORT]

I am getting segfaults everytime I want to unmount my webdav online-space (segfault error 4).

Hardware failure is impossible as I see - because error already reported on project page (and fixed).
Error should be fixed in davfs 1.5.6 (Maybe easiest to bump to version 1.5.6 on ubuntu repos ?) :)

See (line 4-6): http://cvs.savannah.nongnu.org/viewvc/davfs2/davfs2/ChangeLog?revision=1.156&view=markup&pathrev=MAIN

See 2: https://savannah.nongnu.org/bugs/?func=detailitem&item_id=56286#options

EDIT: Using Ubuntu 20.04 x64

[Woodrow Shen (woodrow-shen)]

I also hit the same problem on focal as well, and I'd like to sru focal for this patch first as it is really annoying, and do NMU for upstream release version 1.5.6 on debian and groovy later.

[Woodrow Shen (woodrow-shen)]

Hi,

I already did NMU upload to debian/groovy, so lets keep tracking focal SRU afterward.

[greensysadmin (greensysdmin)]

Can confirm I also have this bug on a fresh install of Ubuntu Mate 20.04.

I manually installed the deb from groovy (1.5.6) with dpkg and it solved it, so if 20.04.1 can upstream that same version that would be great, since I plan to upgrade my other machines after that first point release and reply on davfs2 for daily workflow.

[Woodrow Shen (woodrow-shen)]

I'd like to remove myself from assignee as this is still blocked by sponsoring queue, unless someone who has MOTU can help to proceed the SRU.

[Sascha (zoidy-s)]

Fixed in Ubuntu 20.10 release - There is davfs2 1.6.0 in Repos.

davfs2 1.6.0 has fixed this issue

[Vasya Pupkin (shadowlmd)]

Can this fix please be ported to Ubuntu 20.04?

[Vasya Pupkin (shadowlmd)]

I'd also like to raise the importance because it's not just annoying, it's causing real issues when used with autofs which tries to unmount filesystem after a period of inactivity and fails. Filesystem remains mounted and causes additional load on server in multiuser environment.

[Vasya Pupkin (shadowlmd)]

Can someone please explain what is the problem with porting 1 line (actually 1 character) fix to current LTS (20.04)? Is is some serious business that requires lots of approvals and paperwork or something like that?

[Rolf Leggewie (r0lf)]

@shadowlmd You might find the answer to your question at https://wiki.ubuntu.com/StableReleaseUpdates Besides the "paperwork" you need to find a dev with sufficient privileges who is aware of the problem and interested in fixing it.

[Rolf Leggewie (r0lf)]

I can confirm that the debdiff from #2 fixes the issue. Thank you.

I will upload a bugfixed package to my LTS PPA https://launchpad.net/~r0lf/+archive/ubuntu/stable

[Robie Basak (racb)]

Uploaded the debdiff in comment 1, with a couple of minor changes:

1) I ran update-maintainer to comply with https://wiki.ubuntu.com/DebianMaintainerField
2) I tweaked the version string to 1.5.5-1ubuntu0.1 to fit the scheme recommended at https://wiki.ubuntu.com/SecurityTeam/UpdatePreparation#Update_the_packaging (via https://wiki.ubuntu.com/StableReleaseUpdates#Procedure).

Thank you to everyone who helped.

Now awaiting SRU team review.

[Mathew Hodson (mhodson)]

Fixed in Ubuntu Groovy and later.

---
davfs2 (1.5.6-0.1) unstable; urgency=medium

  * Non-maintainer upload.
  * New upstream version.
  * Standards-Version: 4.5.0
  * Fix incompatible neon library version by adding 31 to configure.ac.
  * Fix a lintian warning of debian-watch-uses-insecure-uri.

 -- Hsieh-Tseng Shen <email address hidden> Thu, 18 Jun 2020 13:58:12 +0800

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Rolf Leggewie (r0lf)]

Am I the only one to think that Ubuntu is slowly collapsing under the weight of its self-inflicted bureaucracy?

[Vasya Pupkin (shadowlmd)]

This is an example of complete bureaucratic failure causing an easy to fix bug plaguing LTS release for almost a year. I will try to get all my infrastructure away from Ubuntu as soon as I can. CentOS Stream and Arch Linux seem to do a much better job. Ubuntu is pathetic.

[Chris Halse Rogers (raof)]

Hello Sascha, or anyone else affected,

Accepted davfs2 into focal-proposed. The package will build now and be available at https://launchpad.net/ubuntu/+source/davfs2/1.5.5-1ubuntu0.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, what testing has been performed on the package and change the tag from verification-needed-focal to verification-done-focal. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed-focal. In either case, without details of your testing we will not be able to proceed.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance for helping!

N.B. The updated package will be released to -updates after the bug(s) fixed by this package have been verified and the package has been in -proposed for a minimum of 7 days.

[Vasya Pupkin (shadowlmd)]

Package 1.5.5-1ubuntu0.1 fixes bug for me. I tested manual and automatic (via autofs) unmounting davfs mounts. No segfaults.

[Daniel von Obernitz (itzonban)]

Same here, Package 1.5.5-1ubuntu0.1 fixes the bug. Thanks!

[Brian Murray (brian-murray)]

The verification of the Stable Release Update for davfs2 has completed successfully and the package is now being released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package davfs2 - 1.5.5-1ubuntu0.1

---------------
davfs2 (1.5.5-1ubuntu0.1) focal; urgency=medium

  * Fix segmentation fault druing umount.davfs2. (LP: #1883025)

 -- Hsieh-Tseng Shen <email address hidden> Thu, 18 Jun 2020 10:07:37 +0800