linux-image-4.13.0-12-generic, linux-image-4.10.0-24-generic, linux-image-4.8.0-56-generic, linux-image-4.4.0-81-generic, linux-image-3.13.0-121-generic | Regression: many user-space apps crashing

[Gunter Ohrner]

Distribution: Ubuntu 16.04 x64 (Flavour: KDE Neon User Edition 5.10)

linux-image-4.4.0-81-generic appears to contain a regression, probably related to the CVE-2017-1000364 fix backport / patch.

Using this kernel, the Oracle Java browser plugin always crashes during stack-related actions on initialization. This means, the plugin completely stopped working.

It works perfectly fine in linux-image-4.4.0-79-generic (vurlerable to CVE-2017-1000364) as well as linux-image-4.11.6-041106-generic, which also contains a fix for CVE-2017-1000364.

uname -a:

> Linux Zweiblum 4.4.0-81-generic #104-Ubuntu SMP Wed Jun 14 08:17:06 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

I tested Oracle Java 1.8 u131 as well as 1.6 u64 in Firefox 51.0.1 as well as Iceweasel / Firefox/3.5.16 in a chroot.

Using linux-image-4.4.0-81-generic it crashes in all combinations while with both other kernels it works.

I was not able to obtain any detailed crash information from Firefox 51.0.1, but Iceweasel 3.5.16 crashed completely, allowing me to obtain a stack trace which shows the relation to stack operations performed by the plugin, even without proper debug symbols:

> (gdb) bt full
> #0 0x00007fa06d805307 in _expand_stack_to(unsigned char*) () from /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> No symbol table info available.
> #1 0x00007fa06d8053ae in os::Linux::manually_expand_stack(JavaThread*, unsigned char*) ()
> from /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> No symbol table info available.
> #2 0x00007fa06d80cf0b in JVM_handle_linux_signal () from /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> No symbol table info available.
> #3 0x00007fa06d802e13 in signalHandler(int, siginfo*, void*) () from /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> No symbol table info available.
> #4 <signal handler called>

I first assumed a bug in the Java plugin, but it works fine in Linux 4.11.6.

The crash will be triggered by any applet, for example the test applet at:

* https://java.com/en/download/installed8.jsp

I'm running the Ubuntu 16.04 based KDE Neon distribution which somehow apparently does not allow me to use apport to report this bug:

> $ LANG= apport-cli linux-image-4.4.0-81-generic
>
> *** Collecting problem information
>
> The collected information can be sent to the developers to improve the
> application. This might take a few minutes.
> .........
>
> *** Problem in linux-image-4.4.0-81-generic
>
> The problem cannot be reported:
>
> This is not an official KDE package. Please remove any third party package and try again.

If someone can tell me how to get apport working for this package, I can use it to collect additional information, but (unfortunately?) the problem should be fairly easy to reproduce...

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Jarda Sladek (jaroslav-sladek)]

The same bug appears on 17.04. 4.10.0-24-generic, which contains CVE-2017-1000364 fix, causes Oracle java plugin to crash. 4.10.0-22-generic, in exactly the same setup, works fine. The console error from Firefox (what most users will see) is

###!!! [Parent][MessageChannel::Call] Error: Channel error: cannot send/recv

This makes Java Plugin on latest version of Ubuntu completely unusable.

[Yuexiang Zhang (xfeep)]

This bug affects not only Oracle Java plugin but also those applications based on JNI Invocation API. Here is a very simple example to reproduce it.

#include <jni.h>

int main(int argc, char *args[]) {
     JavaVM *jvm;
     JNIEnv *env;
     JavaVMInitArgs vm_args;
     JavaVMOption options [1];
     options[0].optionString = "-Djava.class.path=/usr/lib/java";
     vm_args.version = JNI_VERSION_1_6;
     vm_args.nOptions = 1;
     vm_args.options = options;
     vm_args.ignoreUnrecognized = 0;

     JNI_CreateJavaVM(&jvm, (void**)&env, &vm_args); //crash at this line
            /**............**/

     (*jvm)->DestroyJavaVM(jvm);
            return 0;
}

[Damjan Jovanovic (damjan-jov)]

This is a ***MASSIVE REGRESSION*** affecting many or even all native applications that use the Java Invocation API, including at least Eclipse (crashes a few seconds after startup), and LibreOffice Base with any JDBC database connector (instant crash as soon as it tries to load the JVM).

[Moritz Bechler (bechler)]

This should affect all embedded java uses which launch the JVM on the main thread (the regular java launcher does not do that) and is caused by the known buggy (http://www.openwall.com/lists/oss-security/2017/06/22/6) custom CVE-2017-1000364 fix. Testing the upstream patch on debian it seems to be fine (https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=865549).

[nezero (nezero)]

https://bugs.launchpad.net/ubuntu/+source/commons-daemon/+bug/1700010

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Norbert (nrbrtx)]

Scilab is affected too. It uses openjdk-8.
See bug 1699892 for details.
Scilab is crashing with new kernel (linux-image-3.13.0-121-generic in Trusty / linux-image-4.4.0-81-generic in Xenial), but works with previous one (linux-image-3.13.0-119-generic in Trusty / linux-image-4.4.0-78-generic in Xenial).

[Norbert (nrbrtx)]

Also you can check comments on bug 1698919.
The (incomplete) list of affected applications include:
* LPCxpresso (see https://community.nxp.com/thread/453939 )
* RMongo (see https://stackoverflow.com/a/44699417 )
* Ubiquity UniFi (see
https://community.ubnt.com/t5/UniFi-Wireless/UniFi-Controller-failed-after-dist-upgrade/td-p/1967779
)

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Norbert (nrbrtx)]

Octave in Trusty is affected too (see bug 1699594).

[Arthur Edwards (edwardsah3)]

Interestingly, octave 4.2 comes up successfully under 4.40-81 under Ubuntu
16.04.

On Jun 23, 2017 4:45 PM, "Norbert" <email address hidden> wrote:

> Octave in Trusty is affected too (see bug 1699594).
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (1699594).
> https://bugs.launchpad.net/bugs/1699772
>
> Title:
> linux-image-4.4.0-81-generic, linux-image-3.13.0-121-generic
> Regression: many user-space apps crashing
>
> Status in commons-daemon package in Ubuntu:
> Confirmed
> Status in eclipse package in Ubuntu:
> Confirmed
> Status in imagej package in Ubuntu:
> Confirmed
> Status in libreoffice package in Ubuntu:
> Confirmed
> Status in linux package in Ubuntu:
> Confirmed
> Status in octave package in Ubuntu:
> Confirmed
> Status in scilab package in Ubuntu:
> Confirmed
>
> Bug description:
> Distribution: Ubuntu 16.04 x64 (Flavour: KDE Neon User Edition 5.10)
>
> linux-image-4.4.0-81-generic appears to contain a regression, probably
> related to the CVE-2017-1000364 fix backport / patch.
>
> Using this kernel, the Oracle Java browser plugin always crashes
> during stack-related actions on initialization. This means, the plugin
> completely stopped working.
>
>
> It works perfectly fine in linux-image-4.4.0-79-generic (vurlerable to
> CVE-2017-1000364) as well as linux-image-4.11.6-041106-generic, which
> also contains a fix for CVE-2017-1000364.
>
>
> uname -a:
>
> > Linux Zweiblum 4.4.0-81-generic #104-Ubuntu SMP Wed Jun 14 08:17:06
> UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
>
>
> I tested Oracle Java 1.8 u131 as well as 1.6 u64 in Firefox 51.0.1 as
> well as Iceweasel / Firefox/3.5.16 in a chroot.
>
> Using linux-image-4.4.0-81-generic it crashes in all combinations
> while with both other kernels it works.
>
>
> I was not able to obtain any detailed crash information from Firefox
> 51.0.1, but Iceweasel 3.5.16 crashed completely, allowing me to obtain a
> stack trace which shows the relation to stack operations performed by the
> plugin, even without proper debug symbols:
>
>
> > (gdb) bt full
> > #0 0x00007fa06d805307 in _expand_stack_to(unsigned char*) () from
> /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #1 0x00007fa06d8053ae in os::Linux::manually_expand_stack(JavaThread*,
> unsigned char*) ()
> > from /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #2 0x00007fa06d80cf0b in JVM_handle_linux_signal () from
> /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #3 0x00007fa06d802e13 in signalHandler(int, siginfo*, void*) () from
> /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #4 <signal handler called>
>
>
> I first assumed a bug in the Java plugin, but it works fine in Linux
> 4.11.6.
>
>
> The crash will be triggered by any applet, for example the test applet
> at:
>
> * https://java.com/en/download/installed8.jsp
>
>
> I'm running the Ubuntu 16.04 based KDE Neon distribution which somehow
> apparently does not allow me t...

[Joshua R. Poulson (jrp)]

Applications that use jsvc can increase their thread stack space with -Xss1280k or larger (Red Hat, for example, suggested -Xss2m which is much larger).

[Norbert (nrbrtx)]

I confirm issue with full installation of Octave 3.8.1-1ubuntu1 on Trusty
(
dpkg -l | grep octave | grep "^ii" | awk '{print $2;}'
liboctave2:i386 octave octave-audio octave-benchmark octave-biosig octave-common octave-communications octave-communications-common octave-control octave-data-smoothing octave-dataframe
octave-doc octave-econometrics octave-epstk octave-financial octave-fpl octave-ga octave-gdf octave-general octave-geometry octave-gmt octave-gsl octave-htmldoc octave-image octave-info octave-io octave-lhapdf:i386 octave-linear-algebra octave-mapping octave-miscellaneous octave-missing-functions octave-mpi octave-nan octave-nlopt octave-nnet octave-nurbs octave-ocs octave-octcdf octave-octgpr octave-odepkg octave-openmpi-ext octave-optim octave-optiminterp octave-parallel octave-pfstools octave-plot octave-psychtoolbox-3 octave-quaternion octave-signal octave-sockets octave-specfun octave-splines octave-statistics octave-strings octave-struct octave-sundials octave-symbolic octave-tsa octave-vlfeat:i386 octave-vrml octave-zenity qtoctave
)
it crashes on 3.13.0-121-generic. strace says that segmentation fault is after loading openjdk and mmap something. Octave starts normally with 3.13.0-119-generic.

[Norbert (nrbrtx)]

Current state of the problem: Ubuntu kernel developers will prepare new patch in a few days (see https://lists.ubuntu.com/archives/ubuntu-devel-discuss/2017-June/017507.html).

John Johansen:
"The kernel team is aware of the issue, and will be releasing updated
kernels when they are available.

There are currently no plans to revert the kernel patch until the
replacement patches are ready due to the nature of the security
vulnerability. If the regression is preventing you from using the
applications you require then we currently recommend you reboot into
the previous kernel."

[Norbert (nrbrtx)]

Python-jpype is affected too - see https://stackoverflow.com/questions/44719488/segmentation-fault-when-starting-jvm-using-jpype .

[Norbert (nrbrtx)]

ImageJ is affected too (see http://forum.imagej.net/t/unable-to-start-imagej-on-ubuntu-16-04-2-fresh-install/5757/3 ).

[Norbert (nrbrtx)]

Other Xenial kernels (linux-image-4.8.0-56-generic, linux-image-4.10.0-24-generic) are affected too.

For today there is only one kernel with fixed problems - 4.11.6-1 in Debian sid (https://packages.debian.org/sid/linux-image-4.11.0-1-686).

[Norbert (nrbrtx)]

Texas Instruments Code Composer Studio (http://www.ti.com/tool/ccstudio, Eclipse based) is affected too (see http://e2e.ti.com/support/development_tools/code_composer_studio/f/81/p/604599/2226461#2226461 ).

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Norbert (nrbrtx)]

Scilab is still crashing with kernel from xenial-proposed (4.4.0-82.105).
"JAVA_TOOL_OPTIONS=-Xss1280k scilab" helps, but it is not a solution.

[Norbert (nrbrtx)]

With latest proposed kernel (4.4.0-83.106) Scilab does not crash.

[Norbert (nrbrtx)]

Rustc is affected too (see https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=866185 ).

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[nezero (nezero)]

4.4.0-83.106 appears to be in the release repo's now and looks like it's fixed the issue for JSVC (commons-daemon (Ubuntu))

[Damjan Jovanovic (damjan-jov)]

4.4.0-83 fixes Eclipse, but LibreOffice Base still crashes with JDBC drivers.

[Lachezar Dobrev (lachezar)]

Kernel 4.10.0-26 (deb version 4.10.0-26.30) seems to have fixed crashes in Eclipse.

[J. Klaus Krieger (ike85659ms127b)]

Upgrade to "Linux ... 4.10.0-26-generic #30-Ubuntu SMP Tue Jun 27 09:30:12 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux" (Ubuntu 17.04 with XFCE under VMware WS Pro 12.5.7 build-5813279) fixed my problems with "jsvc" (starting "tomcat" 8.5.16) and kernel 4.10.0-24.28 ... catching "signal 11" immediately after start.

Many thanks to all of You, having helped to solve the problem!

[Norbert (nrbrtx)]

Scilab and test C-Java program from bug 1700270 work normally with linux-image-4.4.0-83-generic, linux-image-4.8.0-58-generic, linux-image-4.10.0-26-generic.
Thank you!

[Arthur Edwards (edwardsah3)]

Thanks very much. I have installed it, and you're right.

Art Edwards

On Jun 29, 2017 3:02 PM, "Norbert" <email address hidden> wrote:

> Scilab and test C-Java program from bug 1700270 work normally with
> linux-image-4.4.0-83-generic, linux-image-4.8.0-58-generic,
> linux-image-4.10.0-26-generic.
> Thank you!
>
> ** Changed in: linux (Ubuntu)
> Status: Confirmed => Fix Released
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (1699594).
> https://bugs.launchpad.net/bugs/1699772
>
> Title:
> linux-image-4.10.0-24-generic, linux-image-4.8.0-56-generic, linux-
> image-4.4.0-81-generic, linux-image-3.13.0-121-generic Regression:
> many user-space apps crashing
>
> Status in commons-daemon package in Ubuntu:
> Confirmed
> Status in eclipse package in Ubuntu:
> Confirmed
> Status in imagej package in Ubuntu:
> Confirmed
> Status in libreoffice package in Ubuntu:
> Confirmed
> Status in linux package in Ubuntu:
> Fix Released
> Status in octave package in Ubuntu:
> Confirmed
> Status in python-jpype package in Ubuntu:
> Confirmed
> Status in rustc package in Ubuntu:
> Confirmed
> Status in scilab package in Ubuntu:
> Confirmed
> Status in linux package in Debian:
> Confirmed
>
> Bug description:
> Distribution: Ubuntu 16.04 x64 (Flavour: KDE Neon User Edition 5.10)
>
> linux-image-4.4.0-81-generic appears to contain a regression, probably
> related to the CVE-2017-1000364 fix backport / patch.
>
> Using this kernel, the Oracle Java browser plugin always crashes
> during stack-related actions on initialization. This means, the plugin
> completely stopped working.
>
>
> It works perfectly fine in linux-image-4.4.0-79-generic (vurlerable to
> CVE-2017-1000364) as well as linux-image-4.11.6-041106-generic, which
> also contains a fix for CVE-2017-1000364.
>
>
> uname -a:
>
> > Linux Zweiblum 4.4.0-81-generic #104-Ubuntu SMP Wed Jun 14 08:17:06
> UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
>
>
> I tested Oracle Java 1.8 u131 as well as 1.6 u64 in Firefox 51.0.1 as
> well as Iceweasel / Firefox/3.5.16 in a chroot.
>
> Using linux-image-4.4.0-81-generic it crashes in all combinations
> while with both other kernels it works.
>
>
> I was not able to obtain any detailed crash information from Firefox
> 51.0.1, but Iceweasel 3.5.16 crashed completely, allowing me to obtain a
> stack trace which shows the relation to stack operations performed by the
> plugin, even without proper debug symbols:
>
>
> > (gdb) bt full
> > #0 0x00007fa06d805307 in _expand_stack_to(unsigned char*) () from
> /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #1 0x00007fa06d8053ae in os::Linux::manually_expand_stack(JavaThread*,
> unsigned char*) ()
> > from /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #2 0x00007fa06d80cf0b in JVM_handle_linux_signal () from
> /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #3 0x00007fa06d802e13 in signalHandler(int, siginfo*, void*) () from
> /opt/java-8-oracle/jre/lib/amd64/server/li...

[Arthur Edwards (edwardsah3)]

Thanks!

On Jul 4, 2017 3:41 PM, "Bug Watch Updater" <email address hidden>
wrote:

> ** Changed in: linux (Debian)
> Status: Fix Released => Confirmed
>
> --
> You received this bug notification because you are subscribed to a
> duplicate bug report (1699594).
> https://bugs.launchpad.net/bugs/1699772
>
> Title:
> linux-image-4.10.0-24-generic, linux-image-4.8.0-56-generic, linux-
> image-4.4.0-81-generic, linux-image-3.13.0-121-generic Regression:
> many user-space apps crashing
>
> Status in commons-daemon package in Ubuntu:
> Confirmed
> Status in eclipse package in Ubuntu:
> Confirmed
> Status in imagej package in Ubuntu:
> Confirmed
> Status in libreoffice package in Ubuntu:
> Confirmed
> Status in linux package in Ubuntu:
> Fix Released
> Status in octave package in Ubuntu:
> Confirmed
> Status in python-jpype package in Ubuntu:
> Confirmed
> Status in rustc package in Ubuntu:
> Confirmed
> Status in scilab package in Ubuntu:
> Confirmed
> Status in linux package in Debian:
> Confirmed
>
> Bug description:
> Distribution: Ubuntu 16.04 x64 (Flavour: KDE Neon User Edition 5.10)
>
> linux-image-4.4.0-81-generic appears to contain a regression, probably
> related to the CVE-2017-1000364 fix backport / patch.
>
> Using this kernel, the Oracle Java browser plugin always crashes
> during stack-related actions on initialization. This means, the plugin
> completely stopped working.
>
>
> It works perfectly fine in linux-image-4.4.0-79-generic (vurlerable to
> CVE-2017-1000364) as well as linux-image-4.11.6-041106-generic, which
> also contains a fix for CVE-2017-1000364.
>
>
> uname -a:
>
> > Linux Zweiblum 4.4.0-81-generic #104-Ubuntu SMP Wed Jun 14 08:17:06
> UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
>
>
> I tested Oracle Java 1.8 u131 as well as 1.6 u64 in Firefox 51.0.1 as
> well as Iceweasel / Firefox/3.5.16 in a chroot.
>
> Using linux-image-4.4.0-81-generic it crashes in all combinations
> while with both other kernels it works.
>
>
> I was not able to obtain any detailed crash information from Firefox
> 51.0.1, but Iceweasel 3.5.16 crashed completely, allowing me to obtain a
> stack trace which shows the relation to stack operations performed by the
> plugin, even without proper debug symbols:
>
>
> > (gdb) bt full
> > #0 0x00007fa06d805307 in _expand_stack_to(unsigned char*) () from
> /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #1 0x00007fa06d8053ae in os::Linux::manually_expand_stack(JavaThread*,
> unsigned char*) ()
> > from /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #2 0x00007fa06d80cf0b in JVM_handle_linux_signal () from
> /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #3 0x00007fa06d802e13 in signalHandler(int, siginfo*, void*) () from
> /opt/java-8-oracle/jre/lib/amd64/server/libjvm.so
> > No symbol table info available.
> > #4 <signal handler called>
>
>
> I first assumed a bug in the Java plugin, but it works fine in Linux
> 4.11.6.
>
>
> The crash will be triggered by any applet, for example th...

[Norbert (nrbrtx)]

I can confirm that LibreOffice Base is crashing on Ubuntu 17.04 during database creation (launched Base, in 'Database Wizard' selected 'Create a new database', 'Embedded database:' -> 'HSQLDB Embedded', click 'Next', click 'Finish', save database file in /tmp/db.odb). After that Base is crashing silently.
I can't install libreoffice-dbg package on zesty (I reported bug 1702556 about it).
LibreOffice Writer does not crash in Zesty.

[Norbert (nrbrtx)]

Libreoffice Base 5.1.6.2 is crashing on Ubuntu 16.04 LTS.
What I did:
0. Installed all updates, "uname -a"
 Linux flash-1604 4.4.0-83-generic #106-Ubuntu SMP Mon Jun 26 17:54:25 UTC 2017 i686 i686 i686 GNU/Linux
1. "sudo apt-get install libreoffice-dbg ure-dbg uno-libs3-dbg libglib2.0-0-dbg"
3. run "gdb --args /usr/lib/libreoffice/program/soffice.bin --base", in Database Wizard selected 'Create a new database', 'Embedded database:' -> 'HSQLDB Embedded', click 'Next', click 'Finish', save database file in /tmp/db.odb.
   "run"
   "bt full"
    Got this backtrace: (see atachment).

[Norbert (nrbrtx)]

Libreoffice Base 5.3.1.2 is crashing on Ubuntu 17.04.
What I did:
0. Installed all updates, "uname -a"
 Linux ubuntu-zesty 4.10.0-26-generic #30-Ubuntu SMP Tue Jun 27 09:29:33 UTC 2017 i686 i686 i686 GNU/Linux
1. "apt-get install libreoffice-core-dbgsym libreoffice-writer-dbgsym ure-dbgsym uno-libs3-dbgsym libreoffice-gtk3-dbgsym libglib2.0-0-dbgsym"
3. run "gdb --args /usr/lib/libreoffice/program/soffice.bin --base", in Database Wizard selected 'Create a new database', 'Embedded database:' -> 'HSQLDB Embedded', click 'Next', click 'Finish', save database file in /tmp/db.odb.
   "run"
   "bt full"
    Got this backtrace: (see atachment).

[Rostislav Stříbrný (rstribrn)]

Hi,
problem still present on linux-image-4.8.0-58-generic with these conditions:
    - while executing JVM launched from >>32-bit<< C (on 64-bit kernel)
    - defining "higher" JVM stack size (eg. -Xss2048k JVM argument)

=> causes JVM segmentation fault

Attached test case (sources + binary + output logs): Bug1699772_i386_jvm_segfault_problem.tgz
test_case1.c (32-bit) => using -Xss1024k => RUNS OK.
test_case2.c (32-bit) => using -Xss2048k => Segmentation fault.
test_case1.c (64-bit) => using -Xss1024k => RUNS OK.
test_case2.c (64-bit) => using -Xss2048k => RUNS OK.

My system:
cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.2 LTS"

with linux-generic-hwe-16.04

uname -a
Linux L34001100621 4.8.0-58-generic #63~16.04.1-Ubuntu SMP Mon Jun 26 18:08:51 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux

[Luke (lukebenes)]

There are 2 workarounds for this issue:

Add kernel parameter stack_guard_gap=1

Or

Start Libreoffice, click on Tools, click on options and under Libreoffice section click on Advanced.
And instead of changing parameteres, considering I don't use java in Libreoffice, I've simply deselected "Use a Java runtime environment".

from: https://bbs.archlinux.org/viewtopic.php?id=227597

[Cloph-0 (cloph-0)]

pointers to the openjdk code / showing why only 32bit is affected

https://<email address hidden>/msg1437925.html

[Michael-stahl (michael-stahl)]

*** Bug 109327 has been marked as a duplicate of this bug. ***

[Iplaw67-h (iplaw67-h)]

*** Bug 108854 has been marked as a duplicate of this bug. ***

[Iplaw67-h (iplaw67-h)]

*** Bug 109101 has been marked as a duplicate of this bug. ***

[Iplaw67-h (iplaw67-h)]

*** Bug 110748 has been marked as a duplicate of this bug. ***

[Michael-stahl (michael-stahl)]

*** Bug 109014 has been marked as a duplicate of this bug. ***

[Iplaw67-h (iplaw67-h)]

*** Bug 112357 has been marked as a duplicate of this bug. ***

[Iplaw67-h (iplaw67-h)]

*** Bug 112479 has been marked as a duplicate of this bug. ***

[Luke (lukebenes)]

The build time manifestation of this bug is a CppunitTest_dbaccess_hsqldb_test or CppunitTest_dbaccess_RowSetClones test failure. For details see:

http://nabble.documentfoundation.org/CppunitTest-dbaccess-hsqldb-test-CppunitTest-dbaccess-RowSetClones-Failing-after-System-Update-td4218769.html

[Xiscofauli (xiscofauli)]

*** Bug 112930 has been marked as a duplicate of this bug. ***

[julien2412 (serval2412-6)]

*** Bug 113491 has been marked as a duplicate of this bug. ***

[Beluga (beluga)]

*** Bug 113904 has been marked as a duplicate of this bug. ***

[Mikekaganski (mikekaganski)]

*** Bug 114689 has been marked as a duplicate of this bug. ***

[Mikekaganski (mikekaganski)]

*** Bug 114898 has been marked as a duplicate of this bug. ***

[Xiscofauli (xiscofauli)]

*** Bug 114639 has been marked as a duplicate of this bug. ***

[Xiscofauli (xiscofauli)]

*** Bug 114638 has been marked as a duplicate of this bug. ***

[Aron Budea (baron-z)]

*** Bug 114977 has been marked as a duplicate of this bug. ***

[Jan-Peter Rühmann (jpruehmann)]

Why then every other Java Programm not showing errors?
LibreOffice is the only one.
Thanks,

[julien2412 (serval2412-6)]

*** Bug 115631 has been marked as a duplicate of this bug. ***

[Xiscofauli (xiscofauli)]

*** Bug 115222 has been marked as a duplicate of this bug. ***

[Xiscofauli (xiscofauli)]

*** Bug 118677 has been marked as a duplicate of this bug. ***

[Wladimir Mutel (mwg)]

Is there any chance to have this fixed in Ubuntu 18.04 earlier than 20.04 is released ?

[Wladimir Mutel (mwg)]

What's interesting, is that lowriter does not crash in 32-bit LinuxMint-Mate 19 (based on Ubuntu Bionic 18.04)
with either 4.15.0-20 initial kernel, or -33 updated from Bionic.
with 32-bit Lubuntu 18.04 it still crashes under -33 kernel, so the fix is clearly in some different place.
probably LinuxMint authors know some magic incantations

[Xiscofauli (xiscofauli)]

*** Bug 119078 has been marked as a duplicate of this bug. ***

[Xiscofauli (xiscofauli)]

*** Bug 119487 has been marked as a duplicate of this bug. ***

[Olivier Tilloy (osomon)]

Still crashing in cosmic on i386 with libreoffice 6.0.6 and kernel 4.17.0.9.12, and libreoffice 6.1.0 and kernel 4.18.0.7.8.

[Beluga (beluga)]

*** Bug 119614 has been marked as a duplicate of this bug. ***

[Seth Forshee (sforshee)]

I've tried to reproduce the crash in a vm running up-to-date i386 cosmic, kernel version 4.18.0-7.8. I'm not seeing any crashes opening up the libreoffice apps. Can you give instructions on how to reproduce? Thanks.

[Olivier Tilloy (osomon)]

@Seth: I can reliably reproduce the crash in an up-to-date i386 cosmic VM. You need to install libreoffice-base (which is not installed by default, and pulls in all the java dependencies), then run it with "libreoffice --base", go through the initial wizard to create a new HSQLDB database, and that's when the crash happens.

[Seth Forshee (sforshee)]

I can reproduce using those steps, opened bug #1795956 from the crash report that was produced.

[Xiscofauli (xiscofauli)]

*** Bug 122062 has been marked as a duplicate of this bug. ***

[Djn4823 (djn4823)]

xubuntu 18.04.1 32-bit (4.15.0-42-generic #45-Ubuntu)

My experience was rather different. LibreOffice would always crash at a point about 35% through the splash screen, so I couldn't use the UI to disable the use of Java.

I checked with sysctl -a and also by dumping all strings in the kernel, and "stack_guard_gap" isn't a valid kernel parameter.

If I edited the LibreOffice config file "javasettings_Linux_x86.xml"

to look like this:

<?xml version="1.0" encoding="UTF-8"?>
<!--This is a generated file. Do not alter this file!-->
<java xmlns="http://openoffice.org/2004/java/framework/1.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
<enabled xsi:nil="false"/>
<userClassPath xsi:nil="true"/>
<vmParameters xsi:nil="true"/>
<jreLocations xsi:nil="true"/>
<javaInfo xsi:nil="true"/>
</java>

LibreOffice 6.0.6.2 00m0(Build:2) would find the java virtual machine, update the config file, and then crash as before.

The (partial) solution was to rename /usr/bin/java and /usr/lib/jvm/ AND code the javasettings file as above. With these steps taken I can at least edit documents in --writer and spreadsheets with --calc. Creating a native database requires Java, so that doesn't work, but I was able to attach to a spreadsheet and treat it like a database. Not sure about Access/Jet or SqLite databases yet.

Of course, anything else that requires Java is now broken. Java version is

OpenJDK Runtime Environment (build 10.0.2+13-Ubuntu-1ubuntu0.18.04.4)
OpenJDK Server VM (build 10.0.2+13-Ubuntu-1ubuntu0.18.04.4, mixed mode)

I tried creating a "Hello World" Java program and it worked as expected.

Hmmm... "Mixed Mode?" Also, this version of was intended for Ubuntu 18.04.**4**, whereas I have 18.04.**1**.

[Dimitri John Ledkov (xnox)]

@ Seth Forshee (sforshee)

the "crash" based bug got marked as dupicate of this bug. So surely this bug report should not be "incomplete" status. What's the progress here?

Trivial to reproduce using libreoffice package in bionic i386 VM as seen in autopkgtests all the time.

[Olivier Tilloy (osomon)]

As evidenced by http://autopkgtest.ubuntu.com/packages/libreoffice/cosmic/i386, the problem went away in cosmic at some point in November 2018.

xenial and bionic are still affected.

[Olivier Tilloy (osomon)]

Autopkgtests on cosmic started passing (as far as this bug is concerned − there were other unrelated failures) on 2018-10-10, when openjdk-lts was upgraded from 10.0.2+13-1ubuntu1 to 11~28-3ubuntu1.

[Luke (lukebenes)]

(In reply to Dave Notman from comment #42)
> "stack_guard_gap" isn't a valid kernel parameter.

Yes, the correct parameter "stack_guard_gap=1"

With ubuntu 18.04.2 32-bit, the master branch is building with this parameter.

[Marcus Tomlinson (marcustomlinson)]

openjdk 11 has since been backported to bionic.

[Funnylittleman76 (funnylittleman76)]

Very informative post. Thanks for sharing it. <a href="https://www.rubbishremovalgeelong.com.au/">rubbish removal Geelong</a>