Dear Maintainer,

When running "automount -m" to debug the maps used by autofs, I noticed that
this triggers segfaults as can be seen in 'dmesg':

[Wed Jun 14 08:05:38 2023] automount[9026]: segfault at 8 ip 00007f5d6f3d4d19 sp 00007ffd202ac5d8 error 4 in libc.so.6[7f5d6f2a5000+155000] likely on CPU 1 (core 0, socket 1)
[Wed Jun 14 08:05:38 2023] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00 00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8 77 c3 0f 1f
[Wed Jun 14 08:05:38 2023] automount[9028]: segfault at 8 ip 00007f5d6f3d4d19 sp 00007ffd202ac5d8 error 4 in libc.so.6[7f5d6f2a5000+155000] likely on CPU 1 (core 0, socket 1)
[Wed Jun 14 08:05:38 2023] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00 00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8 77 c3 0f 1f
[Wed Jun 14 08:05:38 2023] automount[9030]: segfault at 8 ip 00007f5d6f3d4d19 sp 00007ffd202ac5d8 error 4 in libc.so.6[7f5d6f2a5000+155000] likely on CPU 1 (core 0, socket 1)
[Wed Jun 14 08:05:38 2023] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00 00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8 77 c3 0f 1f
[Wed Jun 14 08:05:38 2023] automount[9032]: segfault at 8 ip 00007f5d6f3d4d19 sp 00007ffd202ac5d8 error 4 in libc.so.6[7f5d6f2a5000+155000] likely on CPU 0 (core 0, socket 0)
[Wed Jun 14 08:05:38 2023] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00 00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8 77 c3 0f 1f
[Wed Jun 14 08:05:38 2023] automount[9034]: segfault at 8 ip 00007f5d6f3d4d19 sp 00007ffd202ac5d8 error 4 in libc.so.6[7f5d6f2a5000+155000] likely on CPU 1 (core 0, socket 1)
[Wed Jun 14 08:05:38 2023] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00 00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f 87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8 77 c3 0f 1f

The application seems to be working fine otherwise.

nsswitch.conf has the following line for automount:

automount: files sss

Regards,
Rik

Control: tags -1 + moreinfo unreproducible

I'm not able to reproduce this. I assume you can reliably do so, are
there other specific conditions to trigger it?

Regards,
Salvatore

Hi,
I tried to save the output to a file so I could compare it with the
output on a different distribution, and I noticed the following messages
are sent to stderr:

root@bookworm:~# automount -m > /dev/null
ffffffff|mount_init: mount(bind): umount failed for /tmp/autogOXASp
ffffffff|mount_init: mount(bind): umount failed for /tmp/autoYSpbyp
ffffffff|mount_init: mount(bind): umount failed for /tmp/auto90e2JQ
ffffffff|mount_init: mount(bind): umount failed for /tmp/autocABspM
ffffffff|mount_init: mount(bind): umount failed for /tmp/autoDdvjME
ffffffff|mount_init: mount(bind): umount failed for /tmp/autoiZc2Lv
ffffffff|mount_init: mount(bind): umount failed for /tmp/auto95jKC6

In attach you can find the stderr output when running "automount -d -m".

Regards,

Rik

Hi,
Yes, we can still reproduce it:

[Fri Sep 13 07:39:22 2024] automount[198064]: segfault at 8 ip
00007fc410325f19 sp 00007ffff2efb018 error 4 in
libc.so.6[7fc4101f6000+155000] likely on CPU 0 (core 0, socket 0)
[Fri Sep 13 07:39:22 2024] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00
00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f
87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8
77 c3 0f 1f
[Fri Sep 13 07:39:22 2024] automount[198066]: segfault at 8 ip
00007fc410325f19 sp 00007ffff2efb018 error 4 in
libc.so.6[7fc4101f6000+155000] likely on CPU 0 (core 0, socket 0)
[Fri Sep 13 07:39:22 2024] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00
00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f
87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8
77 c3 0f 1f
[Fri Sep 13 07:39:22 2024] automount[198068]: segfault at 8 ip
00007fc410325f19 sp 00007ffff2efb018 error 4 in
libc.so.6[7fc4101f6000+155000] likely on CPU 0 (core 0, socket 0)
[Fri Sep 13 07:39:22 2024] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00
00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f
87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8
77 c3 0f 1f
[Fri Sep 13 07:39:22 2024] automount[198070]: segfault at 8 ip
00007fc410325f19 sp 00007ffff2efb018 error 4 in
libc.so.6[7fc4101f6000+155000] likely on CPU 0 (core 0, socket 0)
[Fri Sep 13 07:39:22 2024] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00
00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f
87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8
77 c3 0f 1f
[Fri Sep 13 07:39:22 2024] automount[198072]: segfault at 8 ip
00007fc410325f19 sp 00007ffff2efb018 error 4 in
libc.so.6[7fc4101f6000+155000] likely on CPU 1 (core 0, socket 1)
[Fri Sep 13 07:39:22 2024] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00
00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f
87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8
77 c3 0f 1f
[Fri Sep 13 07:39:22 2024] automount[198074]: segfault at 8 ip
00007fc410325f19 sp 00007ffff2efb018 error 4 in
libc.so.6[7fc4101f6000+155000] likely on CPU 1 (core 0, socket 1)
[Fri Sep 13 07:39:22 2024] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00
00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f
87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8
77 c3 0f 1f
[Fri Sep 13 07:39:22 2024] automount[198076]: segfault at 8 ip
00007fc410325f19 sp 00007ffff2efb018 error 4 in
libc.so.6[7fc4101f6000+155000] likely on CPU 1 (core 0, socket 1)
[Fri Sep 13 07:39:22 2024] Code: fe 7f 5c 17 e1 c5 f8 77 c3 0f 1f 84 00
00 00 00 00 89 f8 48 89 fa c5 f9 ef c0 25 ff 0f 00 00 3d e0 0f 00 00 0f
87 37 01 00 00 <c5> fd 74 0f c5 fd d7 c1 85 c0 74 5b f3 0f bc c0 c5 f8
77 c3 0f 1f
[Fri Sep 13 07:39:22 2024] traps: automount[198078] general protection
fault ip:7fc410325f19 sp:7ffff2efb018 error:0 in
libc.so.6[7fc4101f6000+155000]
[Fri Sep 13 07:39:22 2024] traps: automount[198080] general protection
fault ip:7fc410325f19 sp:7ffff2efb018 error:0 in
libc.so.6[7fc4101f6000+155000]
[Fri Sep 13 07:39:22 2024] traps: automount[198082] general protection
fault ip:7fc410325f19 sp:7ffff2efb018 error:0 in
libc.so.6[7fc4101f6000+155000]

When I run the command using strace, the errors don't appear.

Our /etc/auto.master only has the following two lines:

+dir:/etc/auto.master.d
+auto.master

We have one file in /etc/auto.master.d/software.autofs that contains:

/software auto.software.linux-x86_64

Our main auto.master file is stored in LDAP.

sssd is configured to use LDAP, and all map content is stored there:

[domain/REDACTED]
ldap_schema = rfc2307
min_id = 1000

ldap_autofs_map_object_class   = nisMap
ldap_autofs_entry_object_class = nisObject
ldap_autofs_map_name           = nisMapName
ldap_autofs_entry_key          = cn
ldap_autofs_entry_value        = nisMapEntry

Is there any other way to capture the segfaults?

We're currently using:

ii  autofs         5.1.8-2+deb12u2 amd64        kernel-based automounter
for Linux
ii  libc6:amd64    2.36-9+deb12u8  amd64        GNU C Library: Shared
libraries

Regards,

Rik

We are seeing this also. Same setup, sss and ldap.
  $ grep automount /etc/nsswitch
  automount:  files sss

Package versions:
  autofs                      5.1.8-2+deb12u2
  linux-image-6.1.0-34-amd64  6.1.135-1

We don't see the issue with bullseye machines

  autofs                      5.1.7-1+deb11u2
  linux-image-5.10.0-34-amd64 5.10.234-1

When run under strace on a bookworm host,
we also see no segfault in syslog,
but a segfault and core dump does occur.
I ran strace like so, with automount map containing three entries.

   # strace -tt -f -o test.strace automount -m auto.foo

Not sure if this is any help, but the dump looks like this
(looks the same under strace or not).

   # gdb /usr/sbin/automount core
....
Core was generated by `automount -m sss auto.foo'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007f321dce1119 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) where
#0  0x00007f321dce1119 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#1  0x00007f321dcd55b3 in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#2  0x00007f321dc5bd8e in ?? () from /lib/x86_64-linux-gnu/libc.so.6
#3  0x00007f321dc5bfcb in initgroups () from /lib/x86_64-linux-gnu/libc.so.6
#4  0x000055a14cf52c24 in ?? ()
#5  0x000055a14cf533fd in spawn_mount ()
#6  0x00007f321b8952fb in mount_init () from /usr/lib/x86_64-linux-gnu/autofs/mount_bind.so
#7  0x000055a14cf5464c in open_mount ()
#8  0x00007f321b89b503 in mount_init () from /usr/lib/x86_64-linux-gnu/autofs/mount_nfs.so
#9  0x000055a14cf5464c in open_mount ()
#10 0x00007f321b8a64e3 in parse_init () from /usr/lib/x86_64-linux-gnu/autofs/parse_sun.so
#11 0x000055a14cf54310 in open_parse ()
#12 0x00007f321df4be68 in lookup_init () from /usr/lib/x86_64-linux-gnu/autofs/lookup_sss.so
#13 0x000055a14cf53f38 in open_lookup ()
#14 0x000055a14cf5bae6 in ?? ()
#15 0x000055a14cf5cd0c in lookup_nss_read_map ()
#16 0x000055a14cf577cb in dump_map ()
#17 0x000055a14cf4892a in main ()


The strace shows the core dump is coming from a child process.
After the core dump occurs, the parent continues executing and
prints out the map contents, so the child processes seem to have
largely done their job.

The guts of the failure seems to be:

511695 15:39:51.523447 rt_sigprocmask(SIG_SETMASK, ~[ILL TRAP ABRT BUS FPE KILL SEGV STOP RTMIN RT_1],  <unfinished ...>
511699 15:39:51.523455 set_robust_list(0x7f7dcbdd9a60, 24 <unfinished ...>
511695 15:39:51.523460 <... rt_sigprocmask resumed>NULL, 8) = 0
511699 15:39:51.523467 <... set_robust_list resumed>) = 0
511695 15:39:51.523472 close(4)         = 0
511695 15:39:51.523501 poll([{fd=3, events=POLLIN}], 1, -1 <unfinished ...>
511699 15:39:51.523551 rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], NULL, 8) = 0
511699 15:39:51.523693 rt_sigaction(SIGHUP, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f7dcc235050}, NULL, 8) = 0
511699 15:39:51.523775 rt_sigaction(SIGINT, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f7dcc235050}, NULL, 8) = 0

...<lots more rt_sigaction calls>...

511699 15:39:51.525853 rt_sigaction(SIGRT_30, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f7dcc235050}, NULL, 8) = 0
511699 15:39:51.525871 rt_sigaction(SIGRT_31, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f7dcc235050}, NULL, 8) = 0
511699 15:39:51.525888 rt_sigaction(SIGRT_32, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f7dcc235050}, NULL, 8) = 0
511699 15:39:51.525905 rt_sigaction(SIGUSR1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f7dcc235050}, NULL, 8) = 0
511699 15:39:51.525923 rt_sigaction(SIGUSR2, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=SA_RESTORER|SA_RESTART, sa_restorer=0x7f7dcc235050}, NULL, 8) = 0
511699 15:39:51.525944 rt_sigprocmask(SIG_UNBLOCK, ~[RTMIN RT_1], NULL, 8) = 0
511699 15:39:51.525965 close(3)         = 0
511699 15:39:51.525981 dup2(4, 1)       = 1
511699 15:39:51.525997 dup2(4, 2)       = 2
511699 15:39:51.526013 close(4)         = 0
511699 15:39:51.526030 getpgrp()        = 511692
511699 15:39:51.526046 openat(AT_FDCWD, "/proc/sys/kernel/ngroups_max", O_RDONLY|O_CLOEXEC) = 3
511699 15:39:51.526074 read(3, "65536\n", 31) = 6
511699 15:39:51.526094 close(3)         = 0
511699 15:39:51.526130 --- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x8} ---
511695 15:39:51.527434 <... poll resumed>) = 1 ([{fd=3, revents=POLLHUP}])
511699 15:39:51.527447 +++ killed by SIGSEGV (core dumped) +++
511695 15:39:51.527454 close(3)         = 0
511695 15:39:51.527494 wait4(511699, [{WIFSIGNALED(s) && WTERMSIG(s) == SIGSEGV && WCOREDUMP(s)}], 0, NULL) = 511699


Kind regards
Vince