Bug#918854: segfault updating crates.io index

[Josh Triplett]

Package: cargo
Version: 0.31.1-1
Severity: grave

Any time I try to update the crates.io index with the currently packaged
version of cargo, I get a segfault:

$ cargo update
Updating crates.io index
Segmentation fault

I can reproduce this in a brand new project (`cargo new foo`) by adding
any dependency to `Cargo.toml` (e.g. `strsim = "*"`) and then running
`cargo update`.

libgit2 was just updated recently; that might potentially be related.

-- System Information:
Debian Release: buster/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.19.0-1-amd64 (SMP w/4 CPU cores)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE=C.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages cargo depends on:
ii binutils 2.31.1-11
ii gcc 4:8.2.0-2
ii gcc-7 [c-compiler] 7.4.0-2
ii gcc-8 [c-compiler] 8.2.0-14
ii libc6 2.28-4
ii libcurl3-gnutls 7.62.0-1
ii libgcc1 1:8.2.0-14
ii libgit2-27 0.27.7+dfsg.1-0.1
ii libssh2-1 1.8.0-2
ii libssl1.1 1.1.1a-1
ii rustc 1.31.0+dfsg1-2
ii zlib1g 1:1.2.11.dfsg-1

cargo recommends no packages.

Versions of packages cargo suggests:
pn cargo-doc <none>
ii python3 3.7.1-3

-- no debconf information

[Ximin Luo]

Control: severity -1 important
Control: tag -1 + moreinfo unreproducible

I can't reproduce this, can you install cargo-dbgsym rustc-dbgsym rust-gdb libstd-rust-1.31-dbgsym libllvm7-dbgsym libc6-dbg and provide a backtrace?

X

Josh Triplett:

> _______________________________________________
> Pkg-rust-maintainers mailing list
> Pkg-rust-m...@alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-rust-maintainers
>


--
GPG: ed25519/56034877E1F87C35
GPG: rsa4096/1318EFAC5FBBDBCE
https://github.com/infinity0/pubkeys.git

[Горбешко Богдан]

Confirming this in 1.32.0.

[Josh Triplett]

On Sun, Jan 20, 2019 at 07:19:00AM +0000, Ximin Luo wrote:
> I can't reproduce this, can you install cargo-dbgsym rustc-dbgsym rust-gdb libstd-rust-1.31-dbgsym libllvm7-dbgsym libc6-dbg and provide a backtrace?

I can reliably reproduce this, and I think I've figured out the
distinguishing factor. I can reproduce this every time when updating via
a proxy.

Here's a backtrace (I also installed libgit2-27-dbgsym):

#0 __strlen_avx2 () at ../sysdeps/x86_64/multiarch/strlen-avx2.S:65
#1 0x0000555555be142a in std::ffi::c_str::CStr::from_ptr ()
#2 0x0000555555ae8013 in git2::transport::subtransport_action::{{closure}} () at /usr/share/cargo/registry/cargo-0.33.0/vendor/git2/src/transport.rs:223
#3 git2::panic::wrap (f=...) at /usr/share/cargo/registry/cargo-0.33.0/vendor/git2/src/panic.rs:41
#4 0x0000555555aeb0b9 in git2::transport::subtransport_action (stream=<optimized out>, raw_transport=0x5555563579e0, url=0x0, action=0) at /usr/share/cargo/registry/cargo-0.33.0/vendor/git2/src/transport.rs:222
#5 0x00007ffff7f62794 in git_smart__negotiation_step (transport=transport@entry=0x55555604b810, data=0x55555898e610, len=1124) at ./src/transports/smart.c:333
#6 0x00007ffff7f645e0 in git_smart__negotiate_fetch (transport=0x55555604b810, repo=<optimized out>, wants=0x555555fa9450, count=1) at ./src/transports/smart_protocol.c:392
#7 0x00007ffff7efd79e in git_fetch_negotiate (remote=remote@entry=0x555555fab360, opts=opts@entry=0x7fffffff5b90) at ./src/fetch.c:128
#8 0x00007ffff7f439ef in git_remote_download (remote=remote@entry=0x555555fab360, refspecs=refspecs@entry=0x7fffffff5aa0, opts=opts@entry=0x7fffffff5b90) at ./src/remote.c:929
#9 0x00007ffff7f4474e in git_remote_fetch (remote=0x555555fab360, refspecs=0x7fffffff5aa0, opts=0x7fffffff5b90, reflog_message=0x0) at ./src/remote.c:969
#10 0x0000555555aec767 in git2::remote::Remote::fetch (self=0x7fffffff5d30, refspecs=..., opts=<unknown type in /usr/lib/debug/.build-id/5a/dafb6a88215af9c0c802f3a7817d434ee4c89e.debug, CU 0x1b4d574, DIE 0x1b4fb9b>, reflog_msg=<optimized out>) at /usr/share/cargo/registry/cargo-0.33.0/vendor/git2/src/remote.rs:224
#11 0x00005555556a8e92 in cargo::sources::git::utils::fetch::{{closure}} (opts=...) at src/cargo/sources/git/utils.rs:723
#12 0x00005555556a6bd7 in cargo::sources::git::utils::with_fetch_options::{{closure}}::{{closure}} (f=...) at src/cargo/sources/git/utils.rs:653
#13 0x00005555556a59b8 in cargo::sources::git::utils::with_authentication (url=..., cfg=<optimized out>, f=...) at src/cargo/sources/git/utils.rs:450
#14 cargo::sources::git::utils::with_fetch_options::{{closure}} () at src/cargo/sources/git/utils.rs:638
#15 core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &mut F>::call_once (self=<optimized out>, args=<optimized out>) at /usr/src/rustc-1.32.0/src/libcore/ops/function.rs:286
#16 cargo::util::network::Retry::try (f=<optimized out>, self=<optimized out>) at src/cargo/util/network.rs:25
#17 cargo::util::network::with_retry (config=<optimized out>, callback=...) at src/cargo/util/network.rs:87
#18 cargo::sources::git::utils::with_fetch_options (git_config=0x7fffffff6370, url=0x555555ef1fd0, config=0x7fffffffd990, cb=...) at src/cargo/sources/git/utils.rs:637
#19 0x00005555556a8319 in cargo::sources::git::utils::fetch (repo=<optimized out>, url=0x5555563579e0, refspec=..., config=<optimized out>) at src/cargo/sources/git/utils.rs:709
#20 0x0000555555723f0e in <cargo::sources::registry::remote::RemoteRegistry<'cfg> as cargo::sources::registry::RegistryData>::update_index (self=<optimized out>) at src/cargo/sources/registry/remote.rs:211
#21 0x000055555564e9ea in cargo::sources::registry::RegistrySource::do_update (self=0x555555f08ce0) at src/cargo/sources/registry/mod.rs:471
#22 0x0000555555651202 in <cargo::sources::registry::RegistrySource<'cfg> as cargo::core::source::Source>::update (self=0x0) at src/cargo/sources/registry/mod.rs:562
#23 0x000055555590310b in cargo::core::registry::PackageRegistry::load::{{closure}} () at src/cargo/core/registry.rs:308
#24 cargo::core::registry::PackageRegistry::load (self=<optimized out>, source_id=..., kind=cargo::core::registry::Kind::Normal) at src/cargo/core/registry.rs:296
#25 cargo::core::registry::PackageRegistry::ensure_loaded (self=<optimized out>, namespace=..., kind=cargo::core::registry::Kind::Normal) at src/cargo/core/registry.rs:137
#26 0x0000555555904e07 in <cargo::core::registry::PackageRegistry<'cfg> as cargo::core::registry::Registry>::query (self=<optimized out>, dep=<optimized out>, f=..., fuzzy=false) at src/cargo/core/registry.rs:457
#27 0x00005555556fe8a5 in cargo::core::resolver::types::RegistryQueryer::query (self=<optimized out>, dep=<optimized out>) at src/cargo/core/resolver/types.rs:115
#28 cargo::core::resolver::context::Context::build_deps::{{closure}} () at src/cargo/core/resolver/context.rs:113
#29 core::ops::function::impls::<impl core::ops::function::FnOnce<A> for &mut F>::call_once (self=0x7fffffff7160, args=...) at /usr/src/rustc-1.32.0/src/libcore/ops/function.rs:286
#30 <core::option::Option<T>>::map (f=0x7fffffff7160, self=<optimized out>) at /usr/src/rustc-1.32.0/src/libcore/option.rs:424
#31 <core::iter::Map<I, F> as core::iter::iterator::Iterator>::next (self=<optimized out>) at /usr/src/rustc-1.32.0/src/libcore/iter/mod.rs:1328
#32 <<core::result::Result<V, E> as core::iter::traits::FromIterator<core::result::Result<A, E>>>::from_iter::Adapter<Iter, E> as core::iter::iterator::Iterator>::next (self=<optimized out>) at /usr/src/rustc-1.32.0/src/libcore/result.rs:1232
#33 <&mut I as core::iter::iterator::Iterator>::next (self=<optimized out>) at /usr/src/rustc-1.32.0/src/libcore/iter/iterator.rs:2624
#34 0x000055555593cbf8 in <alloc::vec::Vec<T> as alloc::vec::SpecExtend<T, I>>::from_iter (iterator=<optimized out>) at /usr/src/rustc-1.32.0/src/liballoc/vec.rs:1788
#35 0x0000555555715a59 in <alloc::vec::Vec<T> as core::iter::traits::FromIterator<T>>::from_iter (iter=0x555555f18ad0) at /usr/src/rustc-1.32.0/src/liballoc/vec.rs:1700
#36 <core::result::Result<V, E> as core::iter::traits::FromIterator<core::result::Result<A, E>>>::from_iter (iter=...) at /usr/src/rustc-1.32.0/src/libcore/result.rs:1249
#37 core::iter::iterator::Iterator::collect (self=...) at /usr/src/rustc-1.32.0/src/libcore/iter/iterator.rs:1477
#38 cargo::core::resolver::context::Context::build_deps (self=<optimized out>, registry=<optimized out>, parent=<optimized out>, candidate=0x7fffffff7760, method=<optimized out>) at src/cargo/core/resolver/context.rs:110
#39 0x00005555557a2e84 in cargo::core::resolver::activate (cx=<optimized out>, registry=0x7fffffff99d0, parent=<optimized out>, candidate=..., method=0x555555e5bc18) at src/cargo/core/resolver/mod.rs:622
#40 0x000055555579f411 in cargo::core::resolver::activate_deps_loop (cx=..., registry=<optimized out>, summaries=..., config=<optimized out>) at src/cargo/core/resolver/mod.rs:188
#41 0x000055555579e028 in cargo::core::resolver::resolve (summaries=..., replacements=..., registry=..., try_to_use=0x7fffffff9c10, config=<unknown type in /usr/lib/debug/.build-id/5a/dafb6a88215af9c0c802f3a7817d434ee4c89e.debug, CU 0x77609a, DIE 0x881362>, print_warnings=<optimized out>) at src/cargo/core/resolver/mod.rs:125
#42 0x00005555559c4428 in cargo::ops::resolve::resolve_with_previous (registry=<optimized out>, ws=<optimized out>, method=<optimized out>, previous=<optimized out>, to_avoid=<optimized out>, specs=..., register_patches=<optimized out>, warn=<optimized out>) at src/cargo/ops/resolve.rs:326
#43 0x00005555558a3112 in cargo::ops::cargo_generate_lockfile::update_lockfile (ws=<optimized out>, opts=<optimized out>) at src/cargo/ops/cargo_generate_lockfile.rs:85
#44 0x00005555555d8737 in cargo::commands::update::exec (config=0x7fffffffd990, args=0x555555e92328) at src/bin/cargo/commands/update.rs:49
#45 0x00005555555b5832 in cargo::cli::execute_subcommand (config=<optimized out>, args=<optimized out>) at src/bin/cargo/cli.rs:163
#46 cargo::cli::main (config=0x7fffffffd990) at src/bin/cargo/cli.rs:79
#47 0x00005555555d8a4d in cargo::main () at src/bin/cargo/main.rs:53

[Горбешко Богдан]

I get almost the same, with no proxies:

#0  __strlen_sse2 () at ../sysdeps/x86_64/multiarch/../strlen.S:120

#1  0x0000555555be142a in std::ffi::c_str::CStr::from_ptr ()
#2  0x0000555555ae8013 in
git2::transport::subtransport_action::{{closure}} ()
    at
/usr/share/cargo/registry/cargo-0.33.0/vendor/git2/src/transport.rs:223
#3  git2::panic::wrap (f=...) at
/usr/share/cargo/registry/cargo-0.33.0/vendor/git2/src/panic.rs:41
#4  0x0000555555aeb0b9 in git2::transport::subtransport_action

(stream=<optimized out>, raw_transport=0x5555563419f0,

    url=0x0, action=0) at
/usr/share/cargo/registry/cargo-0.33.0/vendor/git2/src/transport.rs:222

#5  0x00007ffff7f2b794 in git_smart__negotiation_step
(transport=transport@entry=0x5555561b2ad0, data=0x555558761120,
    len=1124) at ./src/transports/smart.c:333
#6  0x00007ffff7f2d5e0 in git_smart__negotiate_fetch
(transport=0x5555561b2ad0, repo=<optimized out>,
    wants=0x5555560fa210, count=1) at ./src/transports/smart_protocol.c:392
#7  0x00007ffff7ec679e in git_fetch_negotiate
(remote=remote@entry=0x555556163530, opts=opts@entry=0x7fffffff2b80)
    at ./src/fetch.c:128
#8  0x00007ffff7f0c9ef in git_remote_download
(remote=remote@entry=0x555556163530,
    refspecs=refspecs@entry=0x7fffffff2a90,
opts=opts@entry=0x7fffffff2b80) at ./src/remote.c:929
#9  0x00007ffff7f0d74e in git_remote_fetch (remote=0x555556163530,
refspecs=0x7fffffff2a90, opts=0x7fffffff2b80,

    reflog_message=0x0) at ./src/remote.c:969
#10 0x0000555555aec767 in git2::remote::Remote::fetch

(self=0x7fffffff2d20, refspecs=...,

(git_config=0x7fffffff3360, url=0x555555e5e6e0,
    config=0x7fffffffdbc0, cb=...) at src/cargo/sources/git/utils.rs:637

#19 0x00005555556a8319 in cargo::sources::git::utils::fetch

(repo=<optimized out>, url=0x5555563419f0, refspec=...,

    config=<optimized out>) at src/cargo/sources/git/utils.rs:709
#20 0x0000555555723f0e in
<cargo::sources::registry::remote::RemoteRegistry<'cfg> as
cargo::sources::registry::RegistryDa
ta>::update_index (self=<optimized out>) at
src/cargo/sources/registry/remote.rs:211
#21 0x000055555564e9ea in

cargo::sources::registry::RegistrySource::do_update (self=0x555555f14f20)

&mut F>::call_once (self=0x7fffffff4150,
    args=...) at /usr/src/rustc-1.32.0/src/libcore/ops/function.rs:286
#30 <core::option::Option<T>>::map (f=0x7fffffff4150, self=<optimized out>)

    at /usr/src/rustc-1.32.0/src/libcore/option.rs:424
#31 <core::iter::Map<I, F> as core::iter::iterator::Iterator>::next
(self=<optimized out>)
    at /usr/src/rustc-1.32.0/src/libcore/iter/mod.rs:1328
#32 <<core::result::Result<V, E> as
core::iter::traits::FromIterator<core::result::Result<A,
E>>>::from_iter::Adapter<Iter, E> as
core::iter::iterator::Iterator>::next (self=<optimized out>)
    at /usr/src/rustc-1.32.0/src/libcore/result.rs:1232
#33 <&mut I as core::iter::iterator::Iterator>::next (self=<optimized out>)
    at /usr/src/rustc-1.32.0/src/libcore/iter/iterator.rs:2624
#34 0x000055555593cbf8 in <alloc::vec::Vec<T> as
alloc::vec::SpecExtend<T, I>>::from_iter (iterator=<optimized out>)
    at /usr/src/rustc-1.32.0/src/liballoc/vec.rs:1788
#35 0x0000555555715a59 in <alloc::vec::Vec<T> as

core::iter::traits::FromIterator<T>>::from_iter (iter=0x555555e5bb80)

    at /usr/src/rustc-1.32.0/src/liballoc/vec.rs:1700
#36 <core::result::Result<V, E> as
core::iter::traits::FromIterator<core::result::Result<A, E>>>::from_iter
(iter=...)
    at /usr/src/rustc-1.32.0/src/libcore/result.rs:1249
#37 core::iter::iterator::Iterator::collect (self=...) at
/usr/src/rustc-1.32.0/src/libcore/iter/iterator.rs:1477
#38 cargo::core::resolver::context::Context::build_deps (self=<optimized
out>, registry=<optimized out>,

    parent=<optimized out>, candidate=0x7fffffff4750, method=<optimized

out>) at src/cargo/core/resolver/context.rs:110
#39 0x00005555557a2e84 in cargo::core::resolver::activate (cx=<optimized

out>, registry=0x7fffffff69c0,
    parent=<optimized out>, candidate=..., method=0x555555f0de98) at

src/cargo/core/resolver/mod.rs:622
#40 0x000055555579f411 in cargo::core::resolver::activate_deps_loop
(cx=..., registry=<optimized out>, summaries=...,
    config=<optimized out>) at src/cargo/core/resolver/mod.rs:188
#41 0x000055555579e028 in cargo::core::resolver::resolve (summaries=...,
replacements=..., registry=...,

    try_to_use=0x7fffffff6c00,

    config=<unknown type in
/usr/lib/debug/.build-id/5a/dafb6a88215af9c0c802f3a7817d434ee4c89e.debug,
CU 0x77609a, DIE 0x881362>, print_warnings=<optimized out>) at
src/cargo/core/resolver/mod.rs:125
#42 0x00005555559c4428 in cargo::ops::resolve::resolve_with_previous
(registry=<optimized out>, ws=<optimized out>,
    method=<optimized out>, previous=<optimized out>,
to_avoid=<optimized out>, specs=...,
    register_patches=<optimized out>, warn=<optimized out>) at
src/cargo/ops/resolve.rs:326

#43 0x00005555559c269b in cargo::ops::resolve::resolve_with_registry
(ws=0x7fffffffd2a0, registry=0x7fffffffa160,
    warn=<optimized out>) at src/cargo/ops/resolve.rs:110
#44 0x00005555559c1be9 in cargo::ops::resolve::resolve_ws_with_method
(ws=0x7fffffffd2a0,
    source=<unknown type in
/usr/lib/debug/.build-id/5a/dafb6a88215af9c0c802f3a7817d434ee4c89e.debug,
CU 0x10675f1, DIE 0x109f84c>,
    method=<unknown type in
/usr/lib/debug/.build-id/5a/dafb6a88215af9c0c802f3a7817d434ee4c89e.debug,
CU 0x10675f1, DIE 0x109f85b>, specs=...) at src/cargo/ops/resolve.rs:62
#45 0x00005555556858c4 in cargo::ops::cargo_compile::compile_ws
(ws=<optimized out>,
    source=<unknown type in
/usr/lib/debug/.build-id/5a/dafb6a88215af9c0c802f3a7817d434ee4c89e.debug,
CU 0x3f11ea, DIE 0x4ba018>, options=<optimized out>, exec=<optimized
out>) at src/cargo/ops/cargo_compile.rs:247
#46 0x00005555556855f2 in cargo::ops::cargo_compile::compile_with_exec
(ws=0x7fffffffd2a0, options=0x7fffffffd108,
    exec=<optimized out>) at src/cargo/ops/cargo_compile.rs:210
#47 cargo::ops::cargo_compile::compile (ws=0x7fffffffd2a0,
options=0x7fffffffd108) at src/cargo/ops/cargo_compile.rs:199
#48 0x0000555555990b69 in cargo::ops::cargo_run::run (ws=0x7fffffffd2a0,
options=0x0, args=...)
    at src/cargo/ops/cargo_run.rs:78
#49 0x0000555555604338 in cargo::commands::run::exec
(config=0x7fffffffdbc0, args=0x555555e944e8)
    at src/bin/cargo/commands/run.rs:73
#50 0x00005555555b5832 in cargo::cli::execute_subcommand

(config=<optimized out>, args=<optimized out>)
    at src/bin/cargo/cli.rs:163

#51 cargo::cli::main (config=0x7fffffffdbc0) at src/bin/cargo/cli.rs:79
#52 0x00005555555d8a4d in cargo::main () at src/bin/cargo/main.rs:53

Cargo 0.33.0-1, libgit2 0.27.7+dfsg.1-0.1.

[Ximin Luo]

Горбешко Богдан:

> I get almost the same, with no proxies:
>

Sorry for late reply, I missed your messages back in March.

I still can't reproduce this on my end, so I won't be able to fix the problem. Can you try to collect more information?

- does the failure still occur with a fresh .cargo? (move it out of the way, rather than delete it, so you can still reproduce it case it goes away)

- does it occur with upstream cargo? presumably not I guess...

- Josh, what proxy are you using?

- are all your other packages up-to-date? what does apt-cache policy libssl-dev libssh-dev say?

- try running with RUST_LOG=debug and what's the last few messages before it segfaults?

X

[Горбешко Богдан]

On 27.04.2019 20:33, Ximin Luo wrote:
> Горбешко Богдан:
>> I get almost the same, with no proxies:
>>
> Sorry for late reply, I missed your messages back in March.
>
> I still can't reproduce this on my end, so I won't be able to fix the problem. Can you try to collect more information?
>
> - does the failure still occur with a fresh .cargo? (move it out of the way, rather than delete it, so you can still reproduce it case it goes away)

Yes.

> - does it occur with upstream cargo? presumably not I guess...

No.

> - Josh, what proxy are you using?
>
> - are all your other packages up-to-date? what does apt-cache policy libssl-dev libssh-dev say?

libssl-dev:
  Installed: 1.1.1b-2
  Candidate: 1.1.1b-2
  Version table:
 *** 1.1.1b-2 500
        500 http://http.debian.net/debian buster/main amd64 Packages
        100 /var/lib/dpkg/status
     1.1.1b-1+ubuntu18.10.1+deb.sury.org+1 500
        500 http://ppa.launchpad.net/ondrej/php/ubuntu cosmic/main
amd64 Packages
     1.0.1t-1+deb7u4 500
        500 http://mirrors.linode.com/debian-security
wheezy/updates/main amd64 Packages
     1.0.1e-2+deb7u20 500
        500 http://mirrors.linode.com/debian wheezy/main amd64 Packages
libssh-dev:
  Installed: (none)
  Candidate: 0.8.6-3+b1
  Version table:
     0.8.6-3+b1 500
        500 http://http.debian.net/debian buster/main amd64 Packages
     0.5.4-1+deb7u3 500
        500 http://mirrors.linode.com/debian wheezy/main amd64 Packages
        500 http://mirrors.linode.com/debian-security
wheezy/updates/main amd64 Packages

> - try running with RUST_LOG=debug and what's the last few messages before it segfaults?

    Updating crates.io index
[2019-04-28T02:25:48Z DEBUG cargo::sources::git::utils] attempting
GitHub fast path for https://github.com/rust-lang/crates.io-index
[2019-04-28T02:25:50Z DEBUG cargo::sources::git::utils] fast path
failed, falling back to a git fetch
[2019-04-28T02:25:50Z DEBUG cargo::sources::git::utils] skipping gc as
there's only 6 pack files
[2019-04-28T02:25:50Z DEBUG cargo::sources::git::utils] doing a fetch
for https://github.com/rust-lang/crates.io-index
[2019-04-28T02:25:50Z DEBUG cargo::sources::git::utils] initiating fetch
of refs/heads/master:refs/remotes/origin/master from
https://github.com/rust-lang/crates.io-index
[2019-04-28T02:25:50Z INFO  git2_curl] action upload-pack
/info/refs?service=git-upload-pack
[2019-04-28T02:25:50Z DEBUG git2_curl] request to
https://github.com/rust-lang/crates.io-index/info/refs?service=git-upload-pack

> X
>

[Antoine Beaupre]

Package: cargo
Version: 0.33.0-1
Followup-For: Bug #918854

I'm seeing the same thing in buster right now. It's intermittent, and
the build eventually finishes if retried.

It's especially annoying when building Docker containers, which do not
afford the luxury of retries. A reliable way to trigger it is to set
the `http_proxy` environment (even if to the empty string).

The following Dockerfile (when ran inside
https://gitlab.com/sequoia-pgp/sequoia) reproduces this reliably for
me:

# we do not use the rust image because it's based on Debian stretch
# where nettle and rustc are too old
FROM debian:buster AS build

COPY . /home/builder/sequoia

# create a sandbox user for the build (in ~builder) and install (in /opt)
# give it permissions to the build dir and home
# upgrade everything
# add dependencies, as specified by the Sequoia README.md file
RUN groupadd -r builder && \
useradd --no-log-init -r -g builder builder && \
chown -R builder:builder /home/builder /opt && \
apt update && apt upgrade -yy && \
apt install -y --no-install-recommends \
ca-certificates \
capnproto \
cargo \
clang \
git \
libsqlite3-dev \
libssl-dev \
make \
nettle-dev \
pkg-config \
python3-dev \
python3-setuptools \
python3-cffi \
python3-pytest \
rustc

# switch to the sandbox user
USER builder

RUN make -C /home/builder/sequoia

I since then changed the dockerfile to build the project three times
in an attempt to work around the issue, which more or less works
reliably. Here are two segfaults that were triggered in the last
build:

mai 16 18:12:28 curie kernel: cargo[25318] segfault at 50000562b ip 000000050000562b sp 00007fff0d0e8678 error 14 in cargo[562b40957000+5c000]
mai 16 18:12:28 curie kernel: Code: Bad RIP value.
mai 16 18:12:33 curie kernel: cargo[25346] segfault at 60228 ip 00007f87ec5ba407 sp 00007ffdc3227c90 error 4 in libcurl-gnutls.so.4.5.0[7f87ec572000+61000]
mai 16 18:12:33 curie kernel: Code: 48 39 c2 75 10 48 8b 87 d8 16 00 00 48 39 87 c0 0f 00 00 74 26 48 8d 6c 24 0c 48 89 ee e8 31 ff ff ff 31 f6 48 89 e9 48 89 df <41> 8b 94 24 28 02 00 00 e8 8c 81 fb ff 85 c0 75 08 48 89 df e8 e0

This command is a reliable reproducer:

env http_proxy= cargo build

mai 16 18:16:12 curie kernel: cargo[499] segfault at 0 ip 00007f9d47cb8181 sp 00007ffe8d0dbd58 error 4 in libc-2.28.so[7f9d47b7e000+148000]
mai 16 18:16:12 curie kernel: Code: 84 00 00 00 00 00 0f 1f 00 31 c0 c5 f8 77 c3 66 2e 0f 1f 84 00 00 00 00 00 89 f9 48 89 fa c5 f9 ef c0 83 e1 3f 83 f9 20 77 1f <c5> fd 74 0f c5 fd d7 c1 85 c0 0f 85 df 00 00 00 48 83 c7 20 83 e1

... but could be unrelated.

-- System Information:
Debian Release: buster/sid

APT prefers testing
APT policy: (500, 'testing'), (1, 'experimental'), (1, 'unstable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.19.0-4-amd64 (SMP w/4 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=fr_CA.UTF-8, LC_CTYPE=fr_CA.UTF-8 (charmap=UTF-8), LANGUAGE=fr_CA.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages cargo depends on:

ii binutils 2.31.1-16
ii clang 1:7.0-47
ii clang-7 [c-compiler] 1:7.0.1-8
ii gcc 4:8.3.0-1
ii gcc-8 [c-compiler] 8.3.0-6
ii libc6 2.28-10
ii libcurl3-gnutls 7.64.0-2
ii libgcc1 1:8.3.0-6
ii libgit2-27 0.27.7+dfsg.1-0.1
ii libssh2-1 1.8.0-2.1
ii libssl1.1 1.1.1b-2
ii rustc 1.32.0+dfsg1-3

ii zlib1g 1:1.2.11.dfsg-1

cargo recommends no packages.

Versions of packages cargo suggests:
pn cargo-doc <none>

ii python3 3.7.2-1

-- debconf-show failed

[Ximin Luo]

Control: reassign -1 libgit2 0.27.7+dfsg.1-0.1

I figured out the problem and have a bug fix on the way. The problem is in libgit2 not cargo.

Actually libgit2 has a shit ton of holes. The fix for this particular bug is cherry-picked from here:

https://github.com/libgit2/libgit2/commits/master/src/transports/smart.c

but just looking at that log, there are lots of other potential segfaults that are in version 0.27.

Happy exploit-finding.

X

Antoine Beaupre:

> _______________________________________________
> Pkg-rust-maintainers mailing list
> Pkg-rust-m...@alioth-lists.debian.net
> https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-rust-maintainers
>

[Ximin Luo]

Control: tags -1 - moreinfo unreproducible
Control: affects -1 + cargo

[Jelmer Vernooij]

For those also affected by this and possibly unable to upgrade to the
new package (I'm on kali Linux):

You can set CARGO_NET_GIT_FETCH_WITH_CLI=true in the environment to
disable use of libgit2.

Jelmer

--
Jelmer Vernooij <jel...@jelmer.uk>
PGP Key: https://www.jelmer.uk/D729A457.asc

[Robins Tharakan]

Hi,

Thanks Jelmer!

Others - This is just to confirm that I can reproduce the issue on a Pi4 (with no pending updates) and that I was able to move forward with jelmer's workaround.

pi@raspberrypi:~/proj/pgx-extns/test2 $ uname -a
Linux raspberrypi 5.10.63-v7l+ #1496 SMP Wed Dec 1 15:58:56 GMT 2021 armv7l GNU/Linux

pi@raspberrypi:~/proj/pgx-extns/test2 $ ldconfig -v 2>/dev/null | grep libgit2

libgit2.so.27 -> libgit2.so.0.27.7

-
robins