automount segfault if get_query_dn fails

[Hugh Warrington]

Binary package hint: autofs5

# lsb_release -rd
Description: Ubuntu 10.04 LTS
Release: 10.04

# apt-cache policy autofs5
autofs5:
  Installed: 5.0.4-3.1ubuntu5
  Candidate: 5.0.4-3.1ubuntu5
  Version table:
 *** 5.0.4-3.1ubuntu5 0
        500 http://gb.archive.ubuntu.com/ubuntu/ lucid/main Packages
        100 /var/lib/dpkg/status

Possibly related to https://bugs.launchpad.net/ubuntu/+source/autofs5/+bug/512595.

After upgrading 9.04 -> 10.04, my automounts from LDAP no longer appear. Instead, I get the following in dmesg at the rate of one per second:

[ 62.189700] automount[5011]: segfault at 0 ip 00007f956cb1c022 sp 00007fff3cd1a978 error 4 in libc-2.11.1.so[7f956ca99000+178000]
[ 63.301490] automount[5023]: segfault at 0 ip 00007f2de5007022 sp 00007fff33695618 error 4 in libc-2.11.1.so[7f2de4f84000+178000]
[ 64.328963] automount[5038]: segfault at 0 ip 00007fdc5f4b4022 sp 00007fffb09a47a8 error 4 in libc-2.11.1.so[7fdc5f431000+178000]
...

I guess something is trying to repeatedly respawn automount. Here's a couple of pointers for anyone trying to debug (sensitive info turned to *****):

# automount -dvf
Starting automounter version 5.0.4, master map /etc/auto.master
using kernel protocol version 5.01
lookup_nss_read_master: reading master file /etc/auto.master
parse_init: parse(sun): init gathered global options: (null)
lookup_read_master: lookup(file): read entry +auto.master
lookup_nss_read_master: reading master ldap auto.master
parse_server_string: lookup(ldap): Attempting to parse LDAP information from string "auto.master".
parse_server_string: lookup(ldap): mapname auto.master
parse_ldap_config: lookup(ldap): ldap authentication configured with the following options:
parse_ldap_config: lookup(ldap): use_tls: 0, tls_required: 0, auth_required: 1, sasl_mech: (null)
parse_ldap_config: lookup(ldap): user: (null), secret: unspecified, client principal: (null) credential cache: (null)
find_server: trying server uri ldap://*****
do_bind: lookup(ldap): auth_required: 1, sasl_mech (null)
do_bind: lookup(ldap): ldap anonymous bind returned 0
get_query_dn: lookup(ldap): check search base list
get_query_dn: lookup(ldap): query failed for search dn ou=aufo.master,ou=autofs,dc=*****,dc=*****,dc=com: No such object
Segmentation fault (core dumped)

# strace automount -f 2>&1 | tail -n20
poll([{fd=7, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, -1) = 1 ([{fd=7, revents=POLLIN}])
read(7, "0\f\2\1\1a\7\n", 8) = 8
read(7, "\1\0\4\0\4\0", 6) = 6
open("/etc/default/autofs", O_RDONLY) = 8
fcntl(8, F_SETFD, FD_CLOEXEC) = 0
fstat(8, {st_mode=S_IFREG|0644, st_size=3708, ...}) = 0
mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7fb316bc6000
read(8, "#\n# Define default options for a"..., 4096) = 3708
read(8, "", 4096) = 0
close(8) = 0
munmap(0x7fb316bc6000, 4096) = 0
write(7, "0\201\203\2\1\2c~\0045ou=aufo.master,ou=auto"..., 134) = 134
poll([{fd=7, events=POLLIN|POLLPRI|POLLERR|POLLHUP}], 1, -1) = 1 ([{fd=7, revents=POLLIN}])
read(7, "02\2\1\2e-\n", 8) = 8
read(7, "\1 \4&ou=autofs,dc=*****,dc=ac"..., 44) = 44
write(2, "get_query_dn: lookup(ldap): quer"..., 124get_query_dn: lookup(ldap): query failed for search dn ou=aufo.master,ou=autofs,dc=*****,dc=*****,dc=com: No such object) = 124
write(2, "\n", 1
) = 1
--- SIGSEGV (Segmentation fault) @ 0 (0) ---
+++ killed by SIGSEGV (core dumped) +++

[Hugh Warrington (x-launchpad-hughw-org)]

Ok, fixed the problem thanks to an eagle-eyed colleague. If you look at the end of the 'automount -dvf' trace above, I made a typo:

get_query_dn: lookup(ldap): query failed for search dn ou=aufo.master,ou=autofs,dc=*****,dc=*****,dc=com: No such object

is looking for ou=aufo.master rather than ou=auto.master (f -> t). The query correctly returns 'No such object', but then the response of automount shouldn't be a segfault.

[Chuck Short (zulcss)]

Thank you for taking the time to report this bug and helping to make Ubuntu better. Please try to obtain a backtrace following the instructions at http://wiki.ubuntu.com/DebuggingProgramCrash and upload the backtrace (as an attachment) to the bug report. This will greatly help us in tracking down your problem.

[Hugh Warrington (x-launchpad-hughw-org)]

Here's the gdb transcript, potentially sensitive info eliminated.

I followed the instructions to get debug symbols, but gdb still says

Reading symbols from /usr/lib/debug/usr/sbin/automount...(no debugging symbols found)

(the file does exist).

[Chuck Short (zulcss)]

Thanks what does your nsswitch.conf look like?

chuck

[Hugh Warrington (x-launchpad-hughw-org)]

Here's my nsswitch.conf

[Chuck Short (zulcss)]

Thanks for the information, I should have enough to look at properly.
chuck

[Rob Shinn (rob-shinn)]

Broken here also; I use some indirect LDAP mounts and some program mounts, and automount will even segfault on the program mounts if the LDAP entries for the indirect LDAP mounts cannot be resolved. This should *not* be low priority; in a production enterprise environment, if an LDAP server cannot be reached, *all* autofs functionality stops, rather than just the specific entries relating to that LDAP server. And everyone wonders why enterprise IT organizations don't take Ubuntu seriously. :-/

[Hugh Warrington (x-launchpad-hughw-org)]

+1 to comment #7. If 'dmesg fills with segfaults and my machine becomes practically unusable' is low priority, I shudder to think what is high.

[Rob Shinn (rob-shinn)]

This bug was fixed in RHEL 5.5 as part of RHBA-2009:1468, why is this still not fixed in Ubuntu 10.04, nearly 2 years later? http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/5/html/5.5_Technical_Notes/autofs.html