Bug#1010689: Crashes with "malloc(): invalid next size (unsorted)"

[Jonathan McDowell]

Package: libtpm2-pkcs11-1
Version: 1.7.0-1
Severity: important
X-Debbugs-Cc: noo...@earth.li

I've upgraded my system from bullseye to bookworm today and as a result
libtpm2-pkcs11-1 has gone from 1.5.0-4 to 1.7.0-1. I'm now unable to use
the library with SSH:

| noodles@sevai:~$ ssh the.earth.li
| malloc(): invalid next size (unsorted)
| Aborted

Commenting out the:

PKCS11Provider /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1

line in my .ssh/config makes things work fine. I ran ssh under GDB and
got the following backtrace:

debug1: Connection established.
malloc(): invalid next size (unsorted)

Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
49 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:49
#1 0x00007ffff7a3f546 in __GI_abort () at abort.c:79
#2 0x00007ffff7a96eb8 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff7bb4a78 "%s\n")
at ../sysdeps/posix/libc_fatal.c:155
#3 0x00007ffff7a9e91a in malloc_printerr (
str=str@entry=0x7ffff7bb7418 "malloc(): invalid next size (unsorted)") at malloc.c:5628
#4 0x00007ffff7aa1d2c in _int_malloc (av=av@entry=0x7ffff7bebba0 <main_arena>, bytes=bytes@entry=1536)
at malloc.c:3964
#5 0x00007ffff7aa3364 in __GI___libc_malloc (bytes=1536) at malloc.c:3229
#6 0x00007ffff72735ab in yaml_document_initialize () from /lib/x86_64-linux-gnu/libyaml-0.so.2
#7 0x00007ffff75049ab in emit_attributes_to_string () from /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1
#8 0x00007ffff750213f in _db_update_tobject_attrs () from /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1
#9 0x00007ffff75027c1 in ?? () from /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1
#10 0x00007ffff7503a37 in db_new () from /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1
#11 0x00007ffff74fdb70 in backend_init () from /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1
#12 0x00007ffff75065e6 in general_init () from /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1
#13 0x00007ffff74f7438 in C_Initialize () from /usr/lib/x86_64-linux-gnu/libtpm2_pkcs11.so.1
#14 0x00005555555e0bc5 in ?? ()
#15 0x000055555556309f in ?? ()
#16 0x00007ffff7a407fd in __libc_start_main (main=0x55555555f960, argc=3, argv=0x7fffffffe1f8,
init=<optimized out>, fini=<optimized out>, rtld_fini=<optimized out>, stack_end=0x7fffffffe1e8)
at ../csu/libc-start.c:332
#17 0x000055555556487a in ?? ()
(gdb)


-- System Information:
Debian Release: bookworm/sid
APT prefers testing
APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 5.17.0-1-amd64 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=en_GB.UTF-8, LC_CTYPE=en_GB.UTF-8 (charmap=UTF-8), LANGUAGE=en_GB:en
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages libtpm2-pkcs11-1 depends on:
ii libc6 2.33-7
ii libsqlite3-0 3.38.3-1
ii libssl1.1 1.1.1n-1
ii libtss2-esys-3.0.2-0 3.2.0-1
ii libtss2-mu0 3.2.0-1
ii libtss2-rc0 3.2.0-1
ii libtss2-tctildr0 3.2.0-1
ii libyaml-0-2 0.2.2-1

libtpm2-pkcs11-1 recommends no packages.

libtpm2-pkcs11-1 suggests no packages.

-- no debconf information

[Jonathan McDowell]

On Sat, May 07, 2022 at 11:54:07AM +0100, Jonathan McDowell wrote:
> Package: libtpm2-pkcs11-1
> Version: 1.7.0-1
> Severity: important
> X-Debbugs-Cc: noo...@earth.li
>
> I've upgraded my system from bullseye to bookworm today and as a result
> libtpm2-pkcs11-1 has gone from 1.5.0-4 to 1.7.0-1. I'm now unable to use
> the library with SSH:
>
> | noodles@sevai:~$ ssh the.earth.li
> | malloc(): invalid next size (unsorted)
> | Aborted

Downgrading to 1.5.0-4 (no other package changes) makes things work
again, fwiw.

J.

--
Suburbia: where they tear out | .''`. Debian GNU/Linux Developer
the trees & then name streets | : :' : Happy to accept PGP signed
after them. | `. `' or encrypted mail - RSA
| `- key on the keyservers.

[Bastian Germann]

On Sat, 7 May 2022 19:42:42 +0100 Jonathan McDowell <noo...@earth.li> wrote:
> On Sat, May 07, 2022 at 11:54:07AM +0100, Jonathan McDowell wrote:
> > I've upgraded my system from bullseye to bookworm today and as a result
> > libtpm2-pkcs11-1 has gone from 1.5.0-4 to 1.7.0-1. I'm now unable to use
> > the library with SSH:
> >
> > | noodles@sevai:~$ ssh the.earth.li
> > | malloc(): invalid next size (unsorted)
> > | Aborted
>
> Downgrading to 1.5.0-4 (no other package changes) makes things work
> again, fwiw.
>
> J.

Hi Jonathan,

I suspect you did not recreate your database. As far as I can see the package misses a migration.
In 1.7.0 changes there is:
"DB Schema Change from 5 to 7.
Backup your DB before upgrading"

This sounds like you hit that.
Can you please try to recreate the DB?

Thanks,
Bastian