os/user: Current() crashes on arm64 with sigabrt signal arrived during cgo execution

[zhaoya881010]

Go version

go version 1.23.1 arm64

Output of go env in your module/workspace:

go version 1.23.1 arm64

What did you do?

linux centos7,arm64 use not root user,user.Current() crash

What did you see happen?

unmap_chunk(): invalid pointer
SIGABRT: abort
PC=0xfffd563a6560 m=3 sigcode=18446744073709551610
signal arrived during cgo execution

goroutine 70 gp=0x4000104a80 m=3 mp=0x40000b8e08 [syscall]:
runtime.cgocall(0x1c28d80, 0x4001022908)
/root/go1.23.1/src/runtime/cgocall.go:167 +0x44 fp=0x40010228d0 sp=0x4001022890 pc=0x474134
os/user._Cfunc_mygetpwuid_r(0x3ed, 0x4000ca2400, 0x400, 0x4000efe230, 0x4000efe234)
_cgo_gotypes.go:163 +0x3c fp=0x4001022900 sp=0x40010228d0 pc=0xbb2cec
os/user._C_getpwuid_r(0x3ed, 0x4000ca2400, 0x400)
/root/go1.23.1/src/os/user/cgo_lookup_cgo.go:91 +0x7c fp=0x40010229b0 sp=0x4001022900 pc=0xbb2e5c
os/user.lookupUnixUid.func1({0x4000ca2400?, 0x474ea8?, 0xc?})
/root/go1.23.1/src/os/user/cgo_lookup_unix.go:57 +0x4c fp=0x4001022a60 sp=0x40010229b0 pc=0xbb273c
os/user.retryWithBuffer(0x10?, 0x4001022b58)
/root/go1.23.1/src/os/user/cgo_lookup_unix.go:171 +0x6c fp=0x4001022ac0 sp=0x4001022a60 pc=0xbb2aac
os/user.lookupUnixUid(0x3ed)
/root/go1.23.1/src/os/user/cgo_lookup_unix.go:55 +0x64 fp=0x4001022b80 sp=0x4001022ac0 pc=0xbb25e4
os/user.current()
/root/go1.23.1/src/os/user/cgo_lookup_unix.go:19 +0x34 fp=0x4001022bc0 sp=0x4001022b80 pc=0xbb2564
os/user.Current.func1()
/root/go1.23.1/src/os/user/lookup.go:22 +0x1c fp=0x4001022bd0 sp=0x4001022bc0 pc=0xbb2efc
sync.(*Once).doSlow(0x0?, 0x0?)
/root/go1.23.1/src/sync/once.go:76 +0xf8 fp=0x4001022c30 sp=0x4001022bd0 pc=0x49ce18
sync.(*Once).Do(...)
/root/go1.23.1/src/sync/once.go:67
os/user.Current()

What did you expect to see?

i think this is bug,x86 is ok

[ianlancetaylor]

Does this happen consistently? Is it possible for you to run the program under gdb to get a backtrace of the C function that is crashing?

[zhaoya881010]

munmap_chunk(): invalid pointer

Thread 1 "grafana-server" received signal SIGABRT, Aborted.
0x0000ffff9ed76560 in raise () from /lib64/libc.so.6
Missing separate debuginfos, use: dnf debuginfo-install glibc-2.28-36.1.p03.ky10.aarch64 sssd-2.2.2-5.p01.ky10.aarch64
(gdb) bt
#0 0x0000ffff9ed76560 in raise () from /lib64/libc.so.6
#1 0x0000ffff9ed7790c in abort () from /lib64/libc.so.6
#2 0x0000ffff9edb1c48 in ?? () from /lib64/libc.so.6
#3 0x0000ffff9edb8534 in ?? () from /lib64/libc.so.6
#4 0x0000ffff9edb8b1c in ?? () from /lib64/libc.so.6
#5 0x0000ffff9eed57d4 in ?? () from /lib64/libnss_sss.so.2
#6 0x0000ffff9eed5fb0 in ?? () from /lib64/libnss_sss.so.2
#7 0x0000ffff9eed3278 in nss_sss_getpwuid_r () from /lib64/libnss_sss.so.2
#8 0x0000000001c689b8 in getpwuid_r ()
#9 0x0000000001c28dd4 in mygetpwuid_r (perr=0x4001049b48, found=0x4001049b44, buflen=, buf=, uid=)
at //GOROOT/src/os/user/cgo_lookup_cgo.go:27
#10 _cgo_6f668e16310a_Cfunc_mygetpwuid_r (v=0x40013ee908) at cgo-gcc-prolog:126
#11 0x00000000004838ac in runtime.asmcgocall.abi0 ()
Backtrace stopped: not enough registers or memory available to unwind further
@ianlancetaylor use gdb

[ianlancetaylor]

Thanks. Is it possible for you to install the missing debuginfo files and try that again so that we can see where it is crashing in the C library? See the helpful command that gdb printed out. Thanks.

[ianlancetaylor]

That said, this looks like it might be memory corruption in the C heap. Does your program use cgo or unsafe? Try running your program with MALLOC_CHECK_=7 set in the environment (note that trailing underscore in the environment variable name).

[zhaoya881010]

@ianlancetaylor
0x0000ffffa8566560 in raise () from /lib64/libc.so.6
Missing separate debuginfos, use: dnf debuginfo-install glibc-2.28-36.1.p03.ky10.aarch64
(gdb) bt
#0 0x0000ffffa8566560 in raise () from /lib64/libc.so.6
#1 0x0000ffffa856790c in abort () from /lib64/libc.so.6
#2 0x0000ffffa85a1c48 in ?? () from /lib64/libc.so.6
#3 0x0000ffffa85a8534 in ?? () from /lib64/libc.so.6
#4 0x0000ffffa85a8b1c in ?? () from /lib64/libc.so.6
#5 0x0000ffffa86c57d4 in sss_nss_mc_get_record (ctx=ctx@entry=0xffffa86e0010 <pw_mc_ctx>, slot=slot@entry=39, _rec=_rec@entry=0xffffaa7ce590) at src/sss_client/nss_mc_common.c:321
#6 0x0000ffffa86c5fb0 in sss_nss_mc_getpwuid (uid=uid@entry=1005, result=0x400, result@entry=0xffffaa7ce750, buffer=buffer@entry=0x4000772000 "", buflen=buflen@entry=1024)
at src/sss_client/nss_mc_passwd.c:211
#7 0x0000ffffa86c3278 in nss_sss_getpwuid_r (uid=1005, result=0xffffaa7ce750, buffer=0x4000772000 "", buflen=1024, errnop=0xffffaa7cf7b8) at src/sss_client/nss_passwd.c:259
#8 0x0000000001c689b8 in getpwuid_r ()
#9 0x0000000001c28dd4 in mygetpwuid_r (perr=0x40015c1c58, found=0x40015c1c54, buflen=, buf=, uid=)
at //GOROOT/src/os/user/cgo_lookup_cgo.go:27
#10 _cgo_6f668e16310a_Cfunc_mygetpwuid_r (v=0x4000c0a908) at cgo-gcc-prolog:126
#11 0x00000000004838ac in runtime.asmcgocall.abi0 ()
Backtrace stopped: not enough registers or memory available to unwind further

[zhaoya881010]

Thread 9 "grafana-server" received signal SIGABRT, Aborted.
[Switching to LWP 823798]
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x0000ffff9ed7790c in __GI_abort () at abort.c:79
#2 0x0000ffff9edb1c48 in __libc_message (action=do_abort, fmt=) at ../sysdeps/posix/libc_fatal.c:181
#3 0x0000ffff9edb8534 in malloc_printerr (str=str@entry=0xffff9ee74678 "munmap_chunk(): invalid pointer") at malloc.c:5389
#4 0x0000ffff9edb8b1c in munmap_chunk (p=) at malloc.c:2844
#5 0x0000ffff9eed57d4 in sss_nss_mc_get_record (ctx=ctx@entry=0xffff9eef0010 <pw_mc_ctx>, slot=slot@entry=39, _rec=_rec@entry=0xffffad0ee590) at src/sss_client/nss_mc_common.c:321
#6 0x0000ffff9eed5fb0 in sss_nss_mc_getpwuid (uid=uid@entry=1005, result=0x400, result@entry=0xffffad0ee750, buffer=buffer@entry=0x4000fc6400 "", buflen=buflen@entry=1024)
at src/sss_client/nss_mc_passwd.c:211
#7 0x0000ffff9eed3278 in nss_sss_getpwuid_r (uid=1005, result=0xffffad0ee750, buffer=0x4000fc6400 "", buflen=1024, errnop=0xffffad0ef7b8) at src/sss_client/nss_passwd.c:259
#8 0x0000000001c689b8 in getpwuid_r ()
#9 0x0000000001c28dd4 in mygetpwuid_r (perr=0x40010dc8c8, found=0x40010dc8c4, buflen=, buf=, uid=)
at //GOROOT/src/os/user/cgo_lookup_cgo.go:27
#10 _cgo_6f668e16310a_Cfunc_mygetpwuid_r (v=0x400140a908) at cgo-gcc-prolog:126
#11 0x00000000004838ac in runtime.asmcgocall.abi0 ()
Backtrace stopped: not enough registers or memory available to unwind further

@ianlancetaylor detail stack
sssd 2.2.2-5, I have two projects: one is used in Grafana, and the other utilizes the third-party package pq, which contains the code snippet user, _ := user.Current(). I'm currently uncertain whether this snippet employs cgo.
func sslClientCertificates(tlsConf *tls.Config, o values) error {
...
// user.Current() might fail when cross-compiling. We have to ignore the
// error and continue without home directory defaults, since we wouldn't
// know from where to load them.
user, _ := user.Current()
....
Another project, with cgo enabled and using user.Current(), runs without issues on the same machine. The difference is that this project's Go version is 1.16.

[ianlancetaylor]

Thanks for the details. It looks like you have "sss" listed in your "passwd" entry in /etc/nsswitch.conf. This problem seems like it is a bug in SSSD, or it is a bug elsewhere in your program that is corrupting the C heap. Did you try running with MALLOC_CHECK_ as suggested above?

[zhaoya881010]

@ianlancetaylor #13470 i use export LDFLAGS="-static"

[gopherbot]

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)