Mailing List Archive: Broken: apache/httpd#1862 (2.4.x

Broken: apache/httpd#1862 (2.4.x - b15b9a5)

Sep 3, 2021, 2:17 AM

Post #1 of 3 (211 views)

Build Update for apache/httpd
-------------------------------------

Build: #1862
Status: Broken

Duration: 26 mins and 38 secs
Commit: b15b9a5 (2.4.x)
Author: Nilgun Belma Buguner
Message: update transformations.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1892842 13f79535-47bb-0310-9956-ffa450edef68

View the changeset: https://github.com/apache/httpd/compare/65fcb0194c86...b15b9a590288

View the full build log and details: https://app.travis-ci.com/github/apache/httpd/builds/236874643?utm_medium=notification&utm_source=email

--

You can unsubscribe from build emails from the apache/httpd repository going to https://app.travis-ci.com/account/preferences/unsubscribe?repository=16806660&utm_medium=notification&utm_source=email.
Or unsubscribe from *all* email updating your settings at https://app.travis-ci.com/account/preferences/unsubscribe?utm_medium=notification&utm_source=email.
Or configure specific recipients for build notifications in your .travis.yml file. See https://docs.travis-ci.com/user/notifications.

Re: Broken: apache/httpd#1862 (2.4.x - b15b9a5) [ In reply to ]

rpluem at apache

Sep 3, 2021, 2:57 AM

Post #2 of 3 (211 views)

Permalink

On 9/3/21 11:17 AM, Travis CI wrote:
> apache
>
> /
>
> httpd
>
> <https://app.travis-ci.com/github/apache/httpd?utm_medium=notification&utm_source=email>
>
> branch icon2.4.x <https://github.com/apache/httpd/tree/2.4.x>
>
> build has failed
> Build #1862 was broken <https://app.travis-ci.com/github/apache/httpd/builds/236874643?utm_medium=notification&utm_source=email>
> arrow to build time
> clock icon26 mins and 38 secs
>

It is a read after free in mod_http2. Do we miss a backport?

==64184==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500dcca9a0 at pc 0x7fe9704ad024 bp 0x7fe952100d30 sp
0x7fe952100d20

READ of size 4 at 0x62500dcca9a0 thread T54

#0 0x7fe9704ad023 in mst_check_data_for /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:618

#1 0x7fe9704b1807 in s_task_done /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:811

#2 0x7fe9704b1807 in h2_mplx_s_task_done /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:842

#3 0x7fe9704f0cd7 in slot_run /home/travis/build/apache/httpd/modules/http2/h2_workers.c:245

#4 0x7fe974fba47a in dummy_worker threadproc/unix/thread.c:147

#5 0x7fe974f2d608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)

#6 0x7fe974e54292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)

0x62500dcca9a0 is located 160 bytes inside of 8192-byte region [0x62500dcca900,0x62500dccc900)

freed by thread T59 here:

#0 0x7fe9751ed7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)

#1 0x7fe974f97926 in allocator_free memory/unix/apr_pools.c:492

#2 0x7fe974f97926 in apr_pool_destroy memory/unix/apr_pools.c:1026

#3 0x7fe9704ab589 in m_stream_destroy_iter /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:316

#4 0x7fe974f7a025 in apr_hash_do tables/apr_hash.c:542

#5 0x7fe9704ea299 in h2_ihash_iter /home/travis/build/apache/httpd/modules/http2/h2_util.c:283

#6 0x7fe9704b415f in m_purge_streams /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:324

#7 0x7fe9704b415f in m_purge_streams /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:320

#8 0x7fe9704b415f in h2_mplx_m_dispatch_master_events /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:1098

#9 0x7fe9704cd643 in dispatch_master /home/travis/build/apache/httpd/modules/http2/h2_session.c:2078

#10 0x7fe9704cd643 in h2_session_process /home/travis/build/apache/httpd/modules/http2/h2_session.c:2278

#11 0x7fe97049336c in h2_conn_run /home/travis/build/apache/httpd/modules/http2/h2_conn.c:214

#12 0x7fe9704a7ace in h2_h2_process_conn /home/travis/build/apache/httpd/modules/http2/h2_h2.c:631

#13 0x7fe9704a7ace in h2_h2_process_conn /home/travis/build/apache/httpd/modules/http2/h2_h2.c:549

#14 0x56201065b6be in ap_run_process_connection /home/travis/build/apache/httpd/server/connection.c:42

#15 0x56201069b6ef in process_socket /home/travis/build/apache/httpd/server/mpm/event/event.c:1053

#16 0x56201069d367 in worker_thread /home/travis/build/apache/httpd/server/mpm/event/event.c:2142

#17 0x7fe974fba47a in dummy_worker threadproc/unix/thread.c:147

#18 0x7fe974f2d608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)

Regards

Rüdiger

Re: Broken: apache/httpd#1862 (2.4.x - b15b9a5) [ In reply to ]

stefan at eissing

Sep 3, 2021, 3:33 AM

Post #3 of 3 (211 views)

Permalink

> Am 03.09.2021 um 11:57 schrieb Ruediger Pluem <rpluem@apache.org>:
>
>
>
> On 9/3/21 11:17 AM, Travis CI wrote:
>> apache
>>
>> /
>>
>> httpd
>>
>> <https://app.travis-ci.com/github/apache/httpd?utm_medium=notification&utm_source=email>
>>
>> branch icon2.4.x <https://github.com/apache/httpd/tree/2.4.x>
>>
>> build has failed
>> Build #1862 was broken <https://app.travis-ci.com/github/apache/httpd/builds/236874643?utm_medium=notification&utm_source=email>
>> arrow to build time
>> clock icon26 mins and 38 secs
>>
>
> It is a read after free in mod_http2. Do we miss a backport?

Yes. It was a "wait and see what travis says" and then never picked up.

> ==64184==ERROR: AddressSanitizer: heap-use-after-free on address 0x62500dcca9a0 at pc 0x7fe9704ad024 bp 0x7fe952100d30 sp
> 0x7fe952100d20
>
> READ of size 4 at 0x62500dcca9a0 thread T54
>
> #0 0x7fe9704ad023 in mst_check_data_for /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:618
>
> #1 0x7fe9704b1807 in s_task_done /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:811
>
> #2 0x7fe9704b1807 in h2_mplx_s_task_done /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:842
>
> #3 0x7fe9704f0cd7 in slot_run /home/travis/build/apache/httpd/modules/http2/h2_workers.c:245
>
> #4 0x7fe974fba47a in dummy_worker threadproc/unix/thread.c:147
>
> #5 0x7fe974f2d608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
>
> #6 0x7fe974e54292 in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x122292)
>
> 0x62500dcca9a0 is located 160 bytes inside of 8192-byte region [0x62500dcca900,0x62500dccc900)
>
> freed by thread T59 here:
>
> #0 0x7fe9751ed7cf in __interceptor_free (/lib/x86_64-linux-gnu/libasan.so.5+0x10d7cf)
>
> #1 0x7fe974f97926 in allocator_free memory/unix/apr_pools.c:492
>
> #2 0x7fe974f97926 in apr_pool_destroy memory/unix/apr_pools.c:1026
>
> #3 0x7fe9704ab589 in m_stream_destroy_iter /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:316
>
> #4 0x7fe974f7a025 in apr_hash_do tables/apr_hash.c:542
>
> #5 0x7fe9704ea299 in h2_ihash_iter /home/travis/build/apache/httpd/modules/http2/h2_util.c:283
>
> #6 0x7fe9704b415f in m_purge_streams /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:324
>
> #7 0x7fe9704b415f in m_purge_streams /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:320
>
> #8 0x7fe9704b415f in h2_mplx_m_dispatch_master_events /home/travis/build/apache/httpd/modules/http2/h2_mplx.c:1098
>
> #9 0x7fe9704cd643 in dispatch_master /home/travis/build/apache/httpd/modules/http2/h2_session.c:2078
>
> #10 0x7fe9704cd643 in h2_session_process /home/travis/build/apache/httpd/modules/http2/h2_session.c:2278
>
> #11 0x7fe97049336c in h2_conn_run /home/travis/build/apache/httpd/modules/http2/h2_conn.c:214
>
> #12 0x7fe9704a7ace in h2_h2_process_conn /home/travis/build/apache/httpd/modules/http2/h2_h2.c:631
>
> #13 0x7fe9704a7ace in h2_h2_process_conn /home/travis/build/apache/httpd/modules/http2/h2_h2.c:549
>
> #14 0x56201065b6be in ap_run_process_connection /home/travis/build/apache/httpd/server/connection.c:42
>
> #15 0x56201069b6ef in process_socket /home/travis/build/apache/httpd/server/mpm/event/event.c:1053
>
> #16 0x56201069d367 in worker_thread /home/travis/build/apache/httpd/server/mpm/event/event.c:2142
>
> #17 0x7fe974fba47a in dummy_worker threadproc/unix/thread.c:147
>
> #18 0x7fe974f2d608 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x9608)
>
>
>
> Regards
>
> Rüdiger