[openssl-dev] OPENSSL_cleanup now error is "invalid pointer"

[Roumen Petrov]

Hi

With current master "corrupted double-linked list" disappear but error 
still exist, see below


Roumen Petrov wrote:
> [SNIP]
>
> Stack trace
> *** Error in '<BUILDDIR>/apps/openssl': corrupted double-linked list: 
> 0x00000000006de730 ***
> ^C
> Program received signal SIGINT, Interrupt.
> 0x00007ffff6fb338b in __lll_lock_wait_private () from /lib64/libc.so.6
> (gdb) bt
> #0  0x00007ffff6fb338b in __lll_lock_wait_private () from 
> /lib64/libc.so.6
> #1  0x00007ffff6f3024a in _L_lock_12669 () from /lib64/libc.so.6
> #2  0x00007ffff6f2d975 in malloc () from /lib64/libc.so.6
> #3  0x00007ffff7de1b26 in _dl_map_object () from 
> /lib64/ld-linux-x86-64.so.2
> #4  0x00007ffff7ded387 in dl_open_worker () from 
> /lib64/ld-linux-x86-64.so.2
> #5  0x00007ffff7de8924 in _dl_catch_error () from 
> /lib64/ld-linux-x86-64.so.2
> #6  0x00007ffff7decc7b in _dl_open () from /lib64/ld-linux-x86-64.so.2
> #7  0x00007ffff6fe0752 in do_dlopen () from /lib64/libc.so.6
> #8  0x00007ffff7de8924 in _dl_catch_error () from 
> /lib64/ld-linux-x86-64.so.2
> #9  0x00007ffff6fe0812 in __libc_dlopen_mode () from /lib64/libc.so.6
> #10 0x00007ffff6fb9825 in init () from /lib64/libc.so.6
> #11 0x00007ffff7282120 in pthread_once () from /lib64/libpthread.so.0
> #12 0x00007ffff6fb993c in backtrace () from /lib64/libc.so.6
> #13 0x00007ffff6f232a4 in __libc_message () from /lib64/libc.so.6
> #14 0x00007ffff6f293d7 in malloc_printerr () from /lib64/libc.so.6
> #15 0x00007ffff6f2ab0c in _int_free () from /lib64/libc.so.6
> #16 0x00007ffff781b962 in CRYPTO_free (str=0x6de850, 
> file=0x7ffff78eb3e6 "crypto/threads_pthread.c", line=99) at 
> crypto/mem.c:226
> #17 0x00007ffff787e7f5 in CRYPTO_THREAD_lock_free (lock=0x6de850) at 
> crypto/threads_pthread.c:99
> #18 0x00007ffff780eda5 in EVP_PKEY_free_it (x=0x6e9310) at 
> crypto/evp/p_lib.c:447
> #19 0x00007ffff780ecf4 in EVP_PKEY_free (x=0x6e9310) at 
> crypto/evp/p_lib.c:431
> #20 0x00007ffff7811307 in EVP_PKEY_CTX_free (ctx=0x6de3a0) at 
> crypto/evp/pmeth_lib.c:331
> #21 0x00007ffff77f7cd3 in EVP_MD_CTX_reset (ctx=0x6be5d0) at 
> crypto/evp/digest.c:138
> #22 0x00007ffff77f7d34 in EVP_MD_CTX_free (ctx=0x6be5d0) at 
> crypto/evp/digest.c:154
> #23 0x00007ffff77f59a3 in md_free (a=0x6be510) at crypto/evp/bio_md.c:116
> #24 0x00007ffff77359b8 in BIO_free (a=0x6be510) at 
> crypto/bio/bio_lib.c:138
> #25 0x000000000042d54a in dgst_main (argc=1, argv=0x7fffffffd950) at 
> apps/dgst.c:444
> #26 0x0000000000438844 in do_cmd (prog=0x6b5f20, argc=11, 
> argv=0x7fffffffd900) at apps/openssl.c:570
> #27 0x0000000000437ff3 in main (argc=11, argv=0x7fffffffd900) at 
> apps/openssl.c:274
> (gdb)
>
> I use "0004-avoid-corrupted-double-linked-list-in-EVP_PKEY.patch" as 
> work-around.

Local repository is updated up to:
commit acde647fb0347f64af8f8678b73ce41f2f499c02
Author: Kazuki Yamaguchi <k at rhe.jp>
Date:   Thu Apr 21 17:35:53 2016 +0900

     Fix EC_KEY_set_private_key() to call key->group->meth->set_private()
....

Now error is:
*** Error in `<BUILDDIR>/util/../apps/openssl': munmap_chunk(): invalid 
pointer: 0x0000000000fbe590 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x7e3d7)[0x7f95457ec3d7]
<BUILDDIR>/util/../libcrypto.so.1.1(CRYPTO_free+0x57)[0x7f954635e0e2]
<BUILDDIR>/util/../libcrypto.so.1.1(CRYPTO_THREAD_lock_free+0x39)[0x7f95463c19f1]
<BUILDDIR>/util/../libcrypto.so.1.1(+0x17951d)[0x7f954635151d]
<BUILDDIR>/util/../libcrypto.so.1.1(EVP_PKEY_free+0x70)[0x7f954635146c]
<BUILDDIR>/util/../libcrypto.so.1.1(EVP_PKEY_CTX_free+0x55)[0x7f9546353a7f]
<BUILDDIR>/util/../libcrypto.so.1.1(EVP_MD_CTX_reset+0xd7)[0x7f954633a487]
<BUILDDIR>/util/../libcrypto.so.1.1(EVP_MD_CTX_free+0x18)[0x7f954633a4e8]
<BUILDDIR>/util/../libcrypto.so.1.1(+0x1600b9)[0x7f95463380b9]
<BUILDDIR>/util/../libcrypto.so.1.1(BIO_free+0x11d)[0x7f954627abcc]
<BUILDDIR>/util/../apps/openssl[0x42d879]
<BUILDDIR>/util/../apps/openssl[0x438cf8]
<BUILDDIR>/util/../apps/openssl[0x4384b5]
/lib64/libc.so.6(__libc_start_main+0xf5)[0x7f954578fd05]
<BUILDDIR>/util/../apps/openssl[0x41ba99]
======= Memory map: ========

Work-around "avoid-corrupted-double-linked-list-in-EVP_PKEY" from my 
previous post resolve issue:

Roumen

P.S. diff for protocol
diff --git a/crypto/evp/p_lib.c b/crypto/evp/p_lib.c
index a8fa301..0dfb93b 100644
--- a/crypto/evp/p_lib.c
+++ b/crypto/evp/p_lib.c
@@ -436,6 +436,7 @@ static void EVP_PKEY_free_it(EVP_PKEY *x)
      x->engine = NULL;
  #endif
      CRYPTO_THREAD_lock_free(x->lock);
+    x->lock = NULL;
  }

  static int unsup_alg(BIO *out, const EVP_PKEY *pkey, int indent,