Bug#803043: mod_perl2 / Apache segfaults after upgrading from Wheezy to Jessie

Mon Oct 26 10:21:12 UTC 2015

Package: libapache2-mod-perl2
Version: 2.0.9~1624218-2
Severity: grave

Hello,

after upgrading our otrs2 server from wheezy/amd64 to jessie I noticed 
dozens of apache segfaults per day on this machine. In dmesg it looks 
like this:
[596698.770628] /usr/share/otrs[6733]: segfault at 8 ip 00007f0d3da86933 
sp 00007f0d36396740 error 4 in libperl.so.5.20.2[7f0d3d9a3000+1b5000]
[660795.241194] /usr/share/otrs[451]: segfault at 1 ip 0000000000000001 
sp 00007f0d28ff0988 error 14
[660891.928530] /usr/sbin/apach[1162]: segfault at 10 ip 
00007f0d3da78ec0 sp 00007f0d36b97b80 error 4 in 
libperl.so.5.20.2[7f0d3d9a3000+1b5000]
[668700.556882] /usr/sbin/apach[14545]: segfault at 18 ip 
00007f0d3da79307 sp 00007f0d267eb8f0 error 4 in 
libperl.so.5.20.2[7f0d3d9a3000+1b5000]
[751331.096289] traps: /usr/sbin/apach[29092] general protection 
ip:7f0d3da78baf sp:7f0d2d7f97f0 error:0 in 
libperl.so.5.20.2[7f0d3d9a3000+1b5000]

In the apache error log:
[Mon Oct 26 11:12:14.001586 2015] [core:notice] [pid 23277:tid 
140548357687168] AH00051: child pid 23283 exit signal Segmentation fault 
(11), possible coredump in /tmp/apache

Now the more curious thing. I have updated another server from Wheezy to 
Jessie, which is just serving gitolite and subversion repositories 
(about mod_svn). After the upgrade full svn checkouts were impossible, 
also because of segfaults from Apache itself. Later I found, that 
mod_perl2 was installed and activated on this system, but it was not 
used at all. So uninstalling libapache2-mod-perl2 solved the issue on 
the server, where it was not required.

 From the otrs Server I have got the following core dump:

root at ticket:/tmp/apache# gdb /usr/sbin/apache2 -c core
GNU gdb (Debian 7.7.1+dfsg-5) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later 
<http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/sbin/apache2...Reading symbols from 
/usr/lib/debug//usr/sbin/apache2...done.
done.

warning: core file may not match specified executable file.
[New LWP 23304]
[New LWP 23305]
[New LWP 23307]
[New LWP 23296]
[New LWP 23308]
[New LWP 23293]
[New LWP 23309]
[New LWP 23291]
[New LWP 23286]
[New LWP 23289]
[New LWP 23288]
[New LWP 23287]
[New LWP 23290]
[New LWP 23285]
[New LWP 23292]
[New LWP 23294]
[New LWP 23310]
[New LWP 23295]
[New LWP 23283]
[New LWP 23297]
[New LWP 23298]
[New LWP 23301]
[New LWP 23300]
[New LWP 23299]
[New LWP 23302]
[New LWP 23306]
[New LWP 23303]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/sbin/apache2 -k start'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00007fd3f096bac2 in modperl_interp_unselect () from 
/usr/lib/apache2/modules/mod_perl.so
(gdb) bt
#0  0x00007fd3f096bac2 in modperl_interp_unselect () from 
/usr/lib/apache2/modules/mod_perl.so
#1  0x00007fd3f63959be in apr_pool_destroy () from 
/usr/lib/x86_64-linux-gnu/libapr-1.so.0
#2  0x00007fd3ef858c24 in ssl_io_filter_output (f=0x7fd3f6d15868, 
bb=0x7fd3f6be2b58) at ssl_engine_io.c:1659
#3  0x00007fd3ef85577a in ssl_io_filter_coalesce (f=0x0, 
bb=0x7fd3f6be2b58) at ssl_engine_io.c:1558
#4  0x00007fd3f6cd5b3d in ap_process_request_after_handler 
(r=0x7fd3f6bda0a0) at http_request.c:256
#5  0x00007fd3f6cd6820 in ap_process_request (r=0x7fd3f6bda0a0) at 
http_request.c:363
#6  0x00007fd3f6cd3122 in ap_process_http_sync_connection 
(c=0x7fd3f6d152c8) at http_core.c:190
#7  ap_process_http_connection (c=0x7fd3f6d152c8) at http_core.c:231
#8  0x00007fd3f6cc9b10 in ap_run_process_connection (c=0x7fd3f6d152c8) 
at connection.c:41
#9  0x00007fd3f0da651b in process_socket (bucket_alloc=<optimized out>, 
my_thread_num=<optimized out>, my_child_num=<optimized out>,
     sock=<optimized out>, p=<optimized out>, thd=<optimized out>) at 
worker.c:619
#10 worker_thread (thd=0x0, dummy=0x0) at worker.c:978
#11 0x00007fd3f61640a4 in start_thread () from 
/lib/x86_64-linux-gnu/libpthread.so.0
#12 0x00007fd3f5e9904d in clone () from /lib/x86_64-linux-gnu/libc.so.6
(gdb) bt full
#0  0x00007fd3f096bac2 in modperl_interp_unselect () from 
/usr/lib/apache2/modules/mod_perl.so
No symbol table info available.
#1  0x00007fd3f63959be in apr_pool_destroy () from 
/usr/lib/x86_64-linux-gnu/libapr-1.so.0
No symbol table info available.
#2  0x00007fd3ef858c24 in ssl_io_filter_output (f=0x7fd3f6d15868, 
bb=0x7fd3f6be2b58) at ssl_engine_io.c:1659
         data = 0x0
         len = 0
         bucket = 0x7fd3f6be31a8
         filter_ctx = 0x7fd3f6d15810
         inctx = 0x0
         rblock = APR_BLOCK_READ
#3  0x00007fd3ef85577a in ssl_io_filter_coalesce (f=0x0, 
bb=0x7fd3f6be2b58) at ssl_engine_io.c:1558
         ctx = 0x7fd3f6be2350
         count = 0
#4  0x00007fd3f6cd5b3d in ap_process_request_after_handler 
(r=0x7fd3f6bda0a0) at http_request.c:256
         bb = 0x7fd3f6be2b58
         b = <optimized out>
         c = 0x7fd3f6d152c8
#5  0x00007fd3f6cd6820 in ap_process_request (r=0x7fd3f6bda0a0) at 
http_request.c:363
         bb = 0x0
         c = 0x7fd3f6d152c8
         rv = 0
#6  0x00007fd3f6cd3122 in ap_process_http_sync_connection 
(c=0x7fd3f6d152c8) at http_core.c:190
         r = 0x7fd3f6bda0a0
         cs = 0x0
         csd = 0x0
         mpm_state = 0
#7  ap_process_http_connection (c=0x7fd3f6d152c8) at http_core.c:231
No locals.
#8  0x00007fd3f6cc9b10 in ap_run_process_connection (c=0x7fd3f6d152c8) 
at connection.c:41
         pHook = <optimized out>
         n = 2
         rv = -1
#9  0x00007fd3f0da651b in process_socket (bucket_alloc=<optimized out>, 
my_thread_num=<optimized out>, my_child_num=<optimized out>,
     sock=<optimized out>, p=<optimized out>, thd=<optimized out>) at 
worker.c:619
         current_conn = 0x7fd3f6d152c8
         conn_id = 140548355740360
         sbh = 0x7fd3f6d152c0
#10 worker_thread (thd=0x0, dummy=0x0) at worker.c:978
         process_slot = 0
         thread_slot = 19
         csd = 0x7fd3f6d150b0
         bucket_alloc = 0x0
         last_ptrans = 0x7fd3f6d150b0
         ptrans = 0x7fd3f6d15028
         is_idle = -154053944
#11 0x00007fd3f61640a4 in start_thread () from 
/lib/x86_64-linux-gnu/libpthread.so.0
No symbol table info available.
#12 0x00007fd3f5e9904d in clone () from /lib/x86_64-linux-gnu/libc.so.6
---Type <return> to continue, or q <return> to quit---
No symbol table info available.
(gdb)

-- 
/*
Mit freundlichem Gruß / With kind regards,
  Patrick Matthäi
  GNU/Linux Debian Developer

   Blog: http://www.linux-dev.org/
E-Mail: pmatthaei at debian.org
         patrick at linux-dev.org
*/