Bug#787473: systemd: Segfault while adding a new job

[Tino]

It took quite a long this time. The system was running over a week. I
got a log of the crash and all other services were running normal
(except for sshd and systemd of course) for another ~30h until i
rebootet it. I looks like sshd crashed first and systemd followed while
adding a restart job. debsums reported no errors of sshd. No idea why it
segfaulted.

-------------- next part --------------
Jun 21 19:38:44 Storage-Blue systemd[1]: Received SIGCHLD from PID 942 (sshd).
Jun 21 19:38:44 Storage-Blue systemd[1]: Child 942 (sshd) died (code=killed, status=11/SEGV)
Jun 21 19:38:44 Storage-Blue systemd[1]: Child 942 belongs to ssh.service
Jun 21 19:38:44 Storage-Blue systemd[1]: ssh.service: main process exited, code=killed, status=11/SEGV
Jun 21 19:38:44 Storage-Blue systemd[1]: ssh.service changed running -> failed
Jun 21 19:38:44 Storage-Blue systemd[1]: Unit ssh.service entered failed state.
Jun 21 19:38:44 Storage-Blue systemd[1]: ssh.service changed failed -> auto-restart
Jun 21 19:38:44 Storage-Blue systemd[1]: ssh.service: cgroup is empty
Jun 21 19:38:44 Storage-Blue systemd[1]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/systemd1/unit/ssh_2eservice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=4205 reply_cookie=0 error=n/a
Jun 21 19:38:44 Storage-Blue systemd[1]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/systemd1/unit/ssh_2eservice interface=org.freedesktop.DBus.Properties member=PropertiesChanged cookie=4206 reply_cookie=0 error=n/a
Jun 21 19:38:44 Storage-Blue systemd[1]: Accepted new private connection.
Jun 21 19:38:44 Storage-Blue systemd[1]: Got message type=signal sender=n/a destination=n/a object=/org/freedesktop/systemd1/agent interface=org.freedesktop.systemd1.Agent member=Released cookie=1 reply_cookie=0 error=n/a
Jun 21 19:38:44 Storage-Blue systemd[1]: Sent message type=signal sender=n/a destination=n/a object=/org/freedesktop/systemd1/agent interface=org.freedesktop.systemd1.Agent member=Released cookie=1 reply_cookie=0 error=n/a
Jun 21 19:38:44 Storage-Blue systemd[1]: Got disconnect on private connection.
Jun 21 19:38:45 Storage-Blue systemd[1]: ssh.service holdoff time over, scheduling restart.
Jun 21 19:38:45 Storage-Blue systemd[1]: Trying to enqueue job ssh.service/restart/fail
Jun 21 19:38:45 Storage-Blue systemd[1]: Caught <SEGV>, dumped core as pid 7185.
Jun 21 19:38:45 Storage-Blue systemd[1]: Freezing execution.
Jun 21 20:14:26 Storage-Blue dhclient: DHCPREQUEST on eth0 to 192.168.100.1 port 67
Jun 21 20:14:26 Storage-Blue dhclient: DHCPACK from 192.168.100.1
Jun 21 20:14:52 Storage-Blue dbus[951]: [system] Failed to activate service 'org.freedesktop.systemd1': timed out
Jun 21 20:14:52 Storage-Blue dhclient: bound to 192.168.100.2 -- renewal in 32545 seconds.


$ ls -la /core
-rw------- 1 root root 1847296 Jun 21 19:38 /core


$ sudo gdb /lib/systemd/systemd /core
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
[...]
Core was generated by `/lib/systemd/systemd --system --deserialize 16'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0xb6dd7198 in raise (sig=11) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:37
37      ../nptl/sysdeps/unix/sysv/linux/pt-raise.c: No such file or directory.
(gdb) bt
#0  0xb6dd7198 in raise (sig=11) at ../nptl/sysdeps/unix/sysv/linux/pt-raise.c:37
#1  0xb6e368f0 in crash.lto_priv.245 (sig=11) at ../src/core/main.c:158
#2  <signal handler called>
#3  hashmap_iterate (h=0xb6b0c944, i=i at entry=0xbef391ec, key=key at entry=0x0) at ../src/shared/hashmap.c:704
#4  0xb6e954b4 in set_iterate (s=<optimized out>, i=i at entry=0xbef391ec) at ../src/shared/set.c:91
#5  0xb6ed6c74 in transaction_add_job_and_dependencies (tr=tr at entry=0xb7f07cf0, type=type at entry=JOB_START, unit=unit at entry=0xb7ef7d78,
    by=by at entry=0xb7e73c08, matters=matters at entry=false, override=override at entry=false, conflicts=conflicts at entry=false,
    ignore_requirements=ignore_requirements at entry=false, ignore_order=ignore_order at entry=false, e=e at entry=0xbef394b8)
    at ../src/core/transaction.c:982
#6  0xb6ed6d04 in transaction_add_job_and_dependencies (tr=tr at entry=0xb7f07cf0, type=type at entry=JOB_START, unit=unit at entry=0xb7ed5358,
    by=by at entry=0xb7e73ba8, matters=matters at entry=false, override=override at entry=false, conflicts=conflicts at entry=false,
    ignore_requirements=ignore_requirements at entry=false, ignore_order=ignore_order at entry=false, e=e at entry=0xbef394b8)
    at ../src/core/transaction.c:983
#7  0xb6ed6d04 in transaction_add_job_and_dependencies (tr=tr at entry=0xb7f07cf0, type=type at entry=JOB_START, unit=<optimized out>,
    by=by at entry=0xb7ebf2b0, matters=matters at entry=true, override=override at entry=false, conflicts=conflicts at entry=false,
    ignore_requirements=ignore_requirements at entry=false, ignore_order=ignore_order at entry=false, e=e at entry=0xbef394b8)
    at ../src/core/transaction.c:983
#8  0xb6ed68e8 in transaction_add_job_and_dependencies (tr=tr at entry=0xb7f07cf0, type=type at entry=JOB_START, unit=<optimized out>,
    by=by at entry=0xb7ebf250, matters=matters at entry=true, override=override at entry=false, conflicts=conflicts at entry=false,
    ignore_requirements=ignore_requirements at entry=false, ignore_order=ignore_order at entry=false, e=e at entry=0xbef394b8)
    at ../src/core/transaction.c:949
#9  0xb6ed68e8 in transaction_add_job_and_dependencies (tr=tr at entry=0xb7f07cf0, type=JOB_START, unit=unit at entry=0x1, by=by at entry=0x0,
    matters=matters at entry=true, override=false, override at entry=224, conflicts=conflicts at entry=false,
    ignore_requirements=ignore_requirements at entry=false, ignore_order=ignore_order at entry=false, e=e at entry=0xbef394b8)
    at ../src/core/transaction.c:949
#10 0xb6eedd34 in manager_add_job (m=0xb7e6d770, type=-1208995624, type at entry=JOB_RESTART, unit=0x1, unit at entry=0xb7f03880,
    mode=mode at entry=JOB_FAIL, override=override at entry=false, e=e at entry=0xbef394b8, _ret=_ret at entry=0x0) at ../src/core/manager.c:1209
#11 0xb6ebb348 in service_enter_restart (s=0xb7f03880) at ../src/core/service.c:1448
#12 service_dispatch_timer.lto_priv.908 (source=<optimized out>, usec=<optimized out>, userdata=0xb7f03880) at ../src/core/service.c:2541
#13 0xb6e44d38 in source_dispatch (s=0xb7f0fd88) at ../src/libsystemd/sd-event/sd-event.c:2024
#14 0xb6e4a400 in sd_event_run (e=0xb7e6da58, timeout=<optimized out>) at ../src/libsystemd/sd-event/sd-event.c:2314
#15 0xb6e33394 in manager_loop (m=0xb7e6d770) at ../src/core/manager.c:2009
#16 main (argc=4, argv=0xbef39e54) at ../src/core/main.c:1743
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://alioth-lists.debian.net/pipermail/pkg-systemd-maintainers/attachments/20150622/aee3f335/attachment-0002.sig>