mod_so/5121: Loading PyApache-4.19 with apxs causes a segfault shortly after load.

[John Kassebaum <ja...@kassebaum.net>]

>Number:         5121
>Category:       mod_so
>Synopsis:       Loading PyApache-4.19 with apxs causes a segfault shortly after load.
>Confidential:   no
>Severity:       critical
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Mon Oct 11 00:20:03 PDT 1999
>Last-Modified:
>Originator:     jak@kassebaum.net
>Organization:
apache
>Release:        1.3.9
>Environment:
Redhat 6.0, egcs-2.91.66, 2.2.12 kernel, SMP w/2 Pentium Pro's
>Description:
This clearly happens only when mod_pyapache is being loaded.
The author states that this occurs, and clains the bug is in mod_so, and
that an unload after a child exits is to blame.  I'm not sure where that is
in the code, but the backtrace should tell all!

----------------------------
gdb /usr/sbin/httpd 
GNU gdb 4.17.0.11 with Linux support
Copyright 1998 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "i386-redhat-linux"...(no debugging symbols found)...
(gdb) run -d /usr -X
Starting program: /usr/sbin/httpd -d /usr -X
Cannot access memory at address 0x2b21e0d0.
(gdb) where
#0  0x2aab5411 in _dl_debug_state () at dl-debug.c:56
#1  0x2ac24dfc in _dl_close (map=0x80c3e68) at dl-close.c:192
#2  0x2ab490c0 in dlclose_doit (handle=0x80c3e68) at dlclose.c:26
#3  0x2aab512b in _dl_catch_error (errstring=0x2ab4ad00, operate=0x2ab490a8 <dlclose_doit>, args=0x80c3e68) at dl-error.c:141
#4  0x2ab49608 in _dlerror_run (operate=0x2ab490a8 <dlclose_doit>, args=0x80c3e68) at dlerror.c:122
#5  0x2ab4908e in dlclose (handle=0x80c3e68) at dlclose.c:32
#6  0x806787c in ap_os_dso_unload ()
#7  0x8050120 in ap_get_server_built ()
#8  0x8051a78 in ap_run_cleanup ()
#9  0x8050761 in ap_clear_pool ()
#10 0x805c616 in ap_child_terminate ()
#11 0x805ccfb in main ()
#12 0x2ab63cb3 in __libc_start_main (main=0x805ca80 <main>, argc=6, argv=0x7ffffd64, init=0x804f754 <_init>, fini=0x807cc1c <_fini>, 
    rtld_fini=0x2aab5350 <_dl_fini>, stack_end=0x7ffffd5c) at ../sysdeps/generic/libc-start.c:78
(gdb) quit
-------------------------------
>How-To-Repeat:
Get PyApache-4.19 from ftp://www.bel-epa.com/pub/misc/.
See more info at http://www.msg.com.mx/pyapache/.
unpack PyApache
cd PyApache
apxs -c -L/usr/lib/python1.5/config -lpython1.5 -lieee -lm -ldl -lpthread mod_pyapache.c
apxs -i -a mod_pyapache.so
restart httpd
wait a few short seconds for the segfault.
>Fix:
Nope, but the author of PyApache claims to.
The Author is "Lele Gaifax" <le...@seldati.it>.
>Audit-Trail:
>Unformatted:
[In order for any reply to be added to the PR database, you need]
[to include <ap...@Apache.Org> in the Cc line and make sure the]
[subject line starts with the report component and number, with ]
[or without any 'Re:' prefixes (such as "general/1098:" or      ]
["Re: general/1098:").  If the subject doesn't match this       ]
[pattern, your message will be misfiled and ignored.  The       ]
["apbugs" address is not added to the Cc line of messages from  ]
[the database automatically because of the potential for mail   ]
[loops.  If you do not include this Cc, your reply may be ig-   ]
[nored unless you are responding to an explicit request from a  ]
[developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]