cannot build pam inside a qemu-armel chroot due to segfault in w3m

[Matt Fischer]

I am attempting to build pam inside a lucid-based chroot on top of precise/amd64. In the later stages of the build, xsltproc runs and it ends up segfaulting. The build works fine on real hardware.

I will attempt to narrow it down to a simple command you can run and post that as a comment when I get it.

mfisch@caprica:~$ apt-cache policy qemu-user-static
qemu-user-static:
  Installed: 1.0.50-2012.02-0ubuntu1
  Candidate: 1.0.50-2012.02-0ubuntu1
  Version table:
 *** 1.0.50-2012.02-0ubuntu1 0
        500 http://us.archive.ubuntu.com/ubuntu/ precise/universe amd64 Packages
        100 /var/lib/dpkg/status

[Matt Fischer (mfisch)]

In order to repro this you need to install the following packages inside your chroot: w3m xsltproc

Using the file README.xml that I am attaching below, run the following command:

/usr/bin/xsltproc --path . --xinclude --stringparam generate.toc "none" --nonet http://docbook.sourceforge.net/release/xsl/current/html/docbook.xsl README.xml | /usr/bin/w3m -T text/html -dump > ./README

[Matt Fischer (mfisch)]

strace attached and it seems to indicate that xsltproc is not pulling in the outside URL. This could be a dependency issue, please let me investigate further before anyone else looks at this.

[Matt Fischer (mfisch)]

I looked at the stacktraces in that file above and the behavior is odd. The failure is actually in w3m, which appears to be horrible broken:

root@caprica:~# w3m
Absurd stack bottom value
qemu: uncaught target signal 6 (Aborted) - core dumped
Aborted (core dumped)

It appears that w3m is calling futex and is being told "not implemented":

root@caprica:~# qemu-arm-static -strace /usr/bin/w3m
9923 brk(NULL) = 0x00114000
9923 uname(0x40800058) = 0
9923 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
9923 mmap2(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x40820000
9923 access("/etc/ld.so.preload",R_OK) = -1 errno=2 (No such file or directory)
9923 open("/etc/ld.so.cache",O_RDONLY) = 5
9923 fstat64(5,0x407ffc58) = 0
9923 mmap2(NULL,10077,PROT_READ,MAP_PRIVATE,5,0) = 0x40821000
9923 close(5) = 0
9923 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
9923 open("/lib/libm.so.6",O_RDONLY) = 5
9923 read(5,0x407ffd74,512) = 512
9923 fstat64(5,0x407ffc90) = 0
9923 mmap2(NULL,438440,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,5,0) = 0x40824000
9923 mprotect(0x40887000,28672,PROT_NONE) = 0
9923 mmap2(0x4088e000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,5,0x62) = 0x4088e000
9923 close(5) = 0
9923 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
9923 open("/lib/libnsl.so.1",O_RDONLY) = 5
9923 read(5,0x407ffd5c,512) = 512
9923 fstat64(5,0x407ffc78) = 0
9923 mmap2(NULL,4096,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS,-1,0) = 0x40890000
9923 mmap2(NULL,100104,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,5,0) = 0x40891000
9923 mprotect(0x4089f000,28672,PROT_NONE) = 0
9923 mmap2(0x408a6000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,5,0xd) = 0x408a6000
9923 mmap2(0x408a8000,5896,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0) = 0x408a8000
9923 close(5) = 0
9923 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
9923 open("/lib/libdl.so.2",O_RDONLY) = 5
9923 read(5,0x407ffd44,512) = 512
9923 fstat64(5,0x407ffc60) = 0
9923 mmap2(NULL,41136,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,5,0) = 0x408aa000
9923 mprotect(0x408ac000,28672,PROT_NONE) = 0
9923 mmap2(0x408b3000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,5,0x1) = 0x408b3000
9923 close(5) = 0
9923 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
9923 open("/usr/lib/libgc.so.1",O_RDONLY) = 5
9923 read(5,0x407ffd2c,512) = 512
9923 fstat64(5,0x407ffc48) = 0
9923 mmap2(NULL,178364,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,5,0) = 0x408b5000
9923 mprotect(0x408cc000,28672,PROT_NONE) = 0
9923 mmap2(0x408d3000,8192,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_DENYWRITE|MAP_FIXED,5,0x16) = 0x408d3000
9923 mmap2(0x408d5000,47292,PROT_READ|PROT_WRITE,MAP_PRIVATE|MAP_ANONYMOUS|MAP_FIXED,-1,0) = 0x408d5000
9923 close(5) = 0
9923 access("/etc/ld.so.nohwcap",F_OK) = -1 errno=2 (No such file or directory)
9923 open("/lib/libssl.so.0.9.8",O_RDONLY) = 5
9923 read(5,0x407ffd14,512) = 512
9923 fstat64(5,0x407ffc30) = 0
9923 mmap2(NULL,211980,PROT_EXEC|PROT_READ,MAP_PRIVATE|MAP_DENYWRITE,5,0) = 0x408e1000
9...

[Matt Fischer (mfisch)]

Revise my repro steps from #1.

Now you only need to run:

apt-get install w3m
w3m

[Steve Langasek (vorlon)]

Seems to be related to libgc which w3m uses. Even trying to cross-build a debug version of w3m fails because it tries to run mktables at build time which is also linked to libgc:

gdb-multiarch ./mktable
GNU gdb (Ubuntu/Linaro 7.4-0ubuntu1) 7.4
Copyright (C) 2012 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law. Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>...
Reading symbols from /tmp/w3m-0.5.3/mktable...done.
(gdb) set architecture armv5t
(gdb) target remote localhost:1234
Remote debugging using localhost:1234
[New Remote target]
Reading symbols from /lib/ld-linux.so.3...(no debugging symbols found)...done.
Loaded symbols for /lib/ld-linux.so.3
[Switching to Remote target]
0x40801c80 in ?? () from /lib/ld-linux.so.3
(gdb) break main
Breakpoint 1 at 0x8920: file mktable.c, line 30.
(gdb) cont
Continuing.

Breakpoint 1, main (argc=1, argv=0x4080061c, envp=0x40800624) at mktable.c:30
30 {
(gdb) stepi
0x00008924 30 {
(gdb)
30 {
(gdb)
0x00008928 30 {
(gdb)
39 GC_INIT();
(gdb)
0x000088f8 in GC_init ()
(gdb) bt
#0 0x000088f8 in GC_init ()
#1 0x0000892e in main (argc=1, argv=0x4080061c, envp=<optimized out>)
    at mktable.c:39
(gdb) fin
Run till exit from #0 0x000088f8 in GC_init ()

Program received signal SIGSEGV, Segmentation fault.
0x40834de6 in ?? ()

[Steve Langasek (vorlon)]

Backtrace, after getting symbols manually loaded:

(gdb) bt
#0 GC_mark_from (mark_stack_top=0x2c048, mark_stack=0x2c000,
    mark_stack_limit=0x34000) at mark.c:796
#1 0x40835dd0 in GC_mark_some (cold_gc_frame=0x40800434 "\352\023\001")
    at mark.c:401
#2 0x4082fc68 in GC_stopped_mark (stop_func=0x4082fa19 <GC_never_stop_func>)
    at alloc.c:504
#3 0x408301b0 in GC_try_to_collect_inner (
    stop_func=0x4082fa19 <GC_never_stop_func>) at alloc.c:362
#4 0x40837216 in GC_init_inner () at misc.c:735
#5 GC_init_inner () at misc.c:474
#6 0x0000892e in main (argc=1, argv=0x4080061c, envp=<optimized out>)
    at mktable.c:39
(gdb)

Line 796 is:
          deferred = *(word *)limit;

(gdb) print limit
$2 = (ptr_t) 0x408180b8 <Address 0x408180b8 out of bounds>

[Peter Maydell (pmaydell)]

Oh, boehm gc. There are several known problems with that. The OpenSuSE folks have done some work which deals with this but it's not upstream yet (and at least one of the fixes is a hack which won't get accepted upstream and where the right fix is probably at least several weeks work).