libnss-db makes processes trying to access protocols db getting killed

[Michael Banck]

Hi,

quite a few people have reported that e.g. ping gets 'Killed'
immediately when they execute it.  We were now able to track that down
to the presence of the libnss-db package:

root@beethoven:~# LD_PRELOAD=/home/mbanck/libnss_db.so.2 ping
Killed
root@beethoven:~# ping
Usage: ping [OPTION]... [ADDRESS]...

Running rpctrace on it suggests it tries to find /var/db/protocols.db
twice and then gets killed for whatever reason:

  83->io_read_request (-1 8192) = 0 ""
task17741-> 3206 (pn{ 23}) = 0
  69->dir_lookup ("var/db/protocols.db" 3 0) = 0x40000002 (No such file
or directory)
  69->dir_lookup ("var/db/protocols.db" 1 0) = 0x40000002 (No such file
or directory)
task17741-> 3208 (pn{  5} 1 -1) = 0
task17741-> 3208 (pn{ 23} 1 -1) = 0
task17741-> 2008 () = 0
Child 17741 Killed

(I can make the whole rpctrace available if needed)

If I remove the 'db' for protocols: in /etc/nsswitch.conf, ping works
fine as well.

Running /bin/ping through gdb, breaking on db_open and stepping through
the code suggests it tries to open the database, fails, sets errno:

57        err = db_open (file, DB_BTREE, DB_RDONLY, 0, NULL, NULL, &db);
(gdb) n
58        if (err != 0)
(gdb) n
60            if (err > 0)
(gdb) n
78          __set_errno (err);
(gdb) n
79        return NSS_STATUS_UNAVAIL;

and then eventually ends here:

0x01023a7f in _nss_db_getprotobyname_r (name=0x804c9ee "icmp",
    result=0xffffffff, buffer=0xffffffff <Address 0xffffffff out of
bounds>,
    buflen=4294967295, errnop=0xffffffff) at files-proto.c:39
39      DB_LOOKUP (protobyname, 1 + strlen (name), (".%s", name),

DB_LOOKUP got called twice already by that time. If I press 'n' here, I
get:

(gdb) n

Program terminated with signal SIGKILL, Killed.
The program no longer exists.


If I instead step further, I reach this:

39      DB_LOOKUP (protobyname, 1 + strlen (name), (".%s", name),
(gdb) s
_hurd_intr_rpc_mach_msg (msg=0x0, option=16884752, send_size=40,
    rcv_size=4294967295, rcv_name=4294967295, timeout=16884864,
notify=40)
    at intr-msg.c:40
40      {
(gdb) bt full
#0  _hurd_intr_rpc_mach_msg (msg=0x1019ba8, option=3, send_size=40,
    rcv_size=40, rcv_name=31, timeout=0, notify=40) at intr-msg.c:43
        err = 148
        user_option = 0
        user_timeout = 0
        m = (union msg * const) 0x3
        msgh_bits = 0
        remote_port = 0
        msgid = 0
        save_data = {type = {msgt_name = 0, msgt_size = 0, msgt_number = 0,
    msgt_inline = 0, msgt_longform = 0, msgt_deallocate = 0,
    msgt_unused = 0}, err = 0}
#1  0x0001268a in io_write () from /lib/ld.so
#2  0x0000ece6 in __writev () from /lib/ld.so
#3  0x0000c905 in _dl_debug_vdprintf () from /lib/ld.so
#4  0x0000cc65 in _dl_dprintf () from /lib/ld.so
#5  0x0000be31 in _dl_signal_error_internal () from /lib/ld.so
#6  0x0000bf45 in _dl_signal_cerror () from /lib/ld.so
#7  0x000086a5 in _dl_lookup_symbol_internal () from /lib/ld.so
#8  0x0000ba53 in fixup () from /lib/ld.so
#9  0x0000bc80 in _dl_runtime_resolve () from /lib/ld.so
#10 0x01023a89 in _nss_db_getprotobyname_r (
    name=0xffffffff <Address 0xffffffff out of bounds>, result=0x28,
    buffer=0x28 <Address 0x28 out of bounds>, buflen=40, errnop=0x28)
    at files-proto.c:39
        key = {data = 0x101acd8, size = 5, ulen = 1882, dlen = 17253534,
                  doff = 17226740, flags = 0}
        status = NSS_STATUS_UNAVAIL
        size = 0
[...]

and then:

44        const mach_msg_timeout_t user_timeout = timeout;
(gdb) s
40      {
(gdb) s

at which point gdb hangs and I need to kill -9 the ping process.

Any idea what is wrong or how to debug this further?


thanks,

Michael