Bug#1121758: dpkg-deb crashing on liblzma5

Control: tag -1 moreinfo unreproducible

Hi!

On Mon, 2025-12-01 at 23:33:10 +0100, Eduard Bloch wrote:
> Package: liblzma5
> Version: 5.8.1-2
> Severity: serious

> see below for the stacktrace. This nonsense started a few days ago. The
> system is perfectly stable otherwise, so I don't think this is a
> hardware issue.
> 
> So I was trying to compile an upstream Linux kernel. Command, which has
> been working for years, is:
> 
> $ nice -n20 make bindeb-pkg -j14 KCFLAGS='-march=x86-64-v3 -mtune=znver3'
> 
> And now it keeps segfaulting, like:
> 
>   STRIP   debian/linux-image-6.18.0/lib/modules/6.18.0/kernel/virt/lib/irqbypass.ko
>   DEPMOD  debian/linux-image-6.18.0/lib/modules/6.18.0
> dpkg-deb: Paket »linux-image-6.18.0« wird in »../linux-image-6.18.0_6.18.0-84_amd64.deb« gebaut.
> dh_builddeb: error: dpkg-deb --root-owner-group --build debian/linux-image-6.18.0 .. died with signal 13
> dh_builddeb: error: Aborting due to earlier error
> make[3]: *** [debian/rules:66: binary-image] Fehler 2
> 
> And why? The stacktrace from coredumpctl reveals:
> 
> #0  0x00007f4343d7b058 in bt_skip_func (len_limit=64, pos=8388609, cur=cur@entry=0x7f4308379010 "\200\005", cur_match=253073, depth=47, son=0x7f42fefbd010, cyclic_pos=0, cyclic_size=8388609)
>     at ../../../../src/liblzma/lz/lz_encoder_mf.c:546
> warning: 546	../../../../src/liblzma/lz/lz_encoder_mf.c: Datei oder Verzeichnis nicht gefunden
> [Current thread is 1 (Thread 0x7f4314e6f6c0 (LWP 3883979))]
> (gdb) bt
> #0  0x00007f4343d7b058 in bt_skip_func (len_limit=64, pos=8388609, cur=cur@entry=0x7f4308379010 "\200\005", cur_match=253073, depth=47, son=0x7f42fefbd010, cyclic_pos=0, cyclic_size=8388609)
>     at ../../../../src/liblzma/lz/lz_encoder_mf.c:546
> #1  0x00007f4343d7bebe in lzma_mf_bt4_skip (mf=0x7f4304000c88, amount=1) at ../../../../src/liblzma/lz/lz_encoder_mf.c:740
> #2  0x00007f4343d7cdef in mf_skip (mf=0x7f4304000c88, amount=1) at ../../../../src/liblzma/lz/lz_encoder.h:294
> #3  encode_init (coder=0x7f433c4f9010, mf=0x7f4304000c88) at ../../../../src/liblzma/lzma/lzma_encoder.c:282
> #4  lzma_lzma_encode (coder=0x7f433c4f9010, mf=mf@entry=0x7f4304000c88, out=out@entry=0x7f4304000e06 "", out_pos=out_pos@entry=0x7f4304000df0, out_size=out_size@entry=65536, limit=2096879)
>     at ../../../../src/liblzma/lzma/lzma_encoder.c:318
> #5  0x00007f4343d845cd in lzma2_encode (coder_ptr=0x7f4304000d60, mf=0x7f4304000c88, out=0x7f430a7fe050 "", out_pos=0x7f4314e6ee88, out_size=25167072) at ../../../../src/liblzma/lzma/lzma2_encoder.c:188
> #6  0x00007f4343d7a5c3 in lz_encode (coder_ptr=0x7f4304000c60, allocator=0x0, in=0x7f4308ffd010 "\200\005", in_pos=0x7f4314e6ee90, in_size=16384, out=0x7f430a7fe050 "", out_pos=0x7f4314e6ee88, out_size=25167072, action=LZMA_RUN)
>     at ../../../../src/liblzma/lz/lz_encoder.c:176
> #7  0x00007f4343d6e27c in block_encode (coder_ptr=0x7f4304000b70, allocator=<optimized out>, in=0x7f4308ffd010 "\200\005", in_pos=0x7f4314e6ee90, in_size=<optimized out>, out=0x7f430a7fe050 "", out_pos=0x7f4314e6ee88, out_size=25167072, 
>     action=LZMA_RUN) at ../../../../src/liblzma/common/block_encoder.c:63
> #8  0x00007f4343d71907 in worker_encode (thr=0x55af3efeb580, out_pos=0x7f4314e6ee88, state=<optimized out>) at ../../../../src/liblzma/common/stream_encoder_mt.c:294
> #9  worker_start (thr_ptr=0x55af3efeb580) at ../../../../src/liblzma/common/stream_encoder_mt.c:393
> #10 0x00007f4343b12b7b in start_thread (arg=<optimized out>) at ./nptl/pthread_create.c:448
> #11 0x00007f4343b907b8 in __GI___clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78
> 
> But why?
> 
> Okay, then I wanted to install one of my existing kernel-image DEBs. And then initramfs build also started crashing.
> 
> But why? The common factor here was, again, liblzma5!
> 
> So I have changed the compression type of initramfs to zstd and now it works... somehow. Still not explaining what is happening with liblzma5 here.

I cannot reproduce this problem within liblzma5 (which would seem
independent from dpkg, that has seen no upload since the release of
Debian stable).

On Tue, 2025-12-02 at 21:28:43 +0100, Eduard Bloch wrote:
> I checked the symptoms again. I can call the command shown in the
> stacktrace with the same arguments and it does not crash. With or
> without fakeroot.
> 
> Then I tried injecting the same env. vars (extracted from the coredump)
> into the shell prior to calling. Still no crash.
> 
> Then I tried the run in gdb directly. Result:
> 
> (gdb) run --root-owner-group --build debian/linux-image-6.18.0 ..
> Starting program: /usr/bin/dpkg-deb --root-owner-group --build debian/linux-image-6.18.0 ..
> [Thread debugging using libthread_db enabled]
> Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
> dpkg-deb: Paket »linux-image-6.18.0« wird in »../linux-image-6.18.0_6.18.0-85_amd64.deb« gebaut.
> [Detaching after fork from child process 1135101]
> [Detaching after fork from child process 1135102]
> [Detaching after fork from child process 1135104]
> [Detaching after fork from child process 1135105]
> 
> Program received signal SIGPIPE, Broken pipe.
> Download failed: Das Argument ist ungültig.  Continuing without source file ./nptl/./nptl/cancellation.c.
> __internal_syscall_cancel (a1=a1@entry=6, a2=a2@entry=93824993085744, a3=a3@entry=77, a4=a4@entry=0, a5=a5@entry=0, a6=a6@entry=0, nr=1) at ./nptl/cancellation.c:44
> warning: 44	./nptl/cancellation.c: Datei oder Verzeichnis nicht gefunden
> (gdb) bt
> #0  __internal_syscall_cancel (a1=a1@entry=6, a2=a2@entry=93824993085744, a3=a3@entry=77, a4=a4@entry=0, a5=a5@entry=0, a6=a6@entry=0, nr=1) at ./nptl/cancellation.c:44
> #1  0x00007ffff7cde6ad in __syscall_cancel (a1=a1@entry=6, a2=a2@entry=93824993085744, a3=a3@entry=77, a4=a4@entry=0, a5=a5@entry=0, a6=a6@entry=0, nr=1) at ./nptl/cancellation.c:75
> #2  0x00007ffff7d53936 in __GI___libc_write (fd=fd@entry=6, buf=buf@entry=0x555555624930, nbytes=nbytes@entry=77) at ../sysdeps/unix/sysv/linux/write.c:26
> #3  0x0000555555563389 in fd_write (fd=fd@entry=6, buf=buf@entry=0x555555624930, len=77) at ../../../lib/dpkg/fdio.c:72
> #4  0x000055555555a0a7 in file_treewalk_feed (dir=<optimized out>, fd_out=6) at ../../src/deb/build.c:180
> #5  0x0000555555559e87 in tarball_pack (dir=dir@entry=0x7fffffffe093 "debian/linux-image-6.18.0", tar_filenames_feeder=tar_filenames_feeder@entry=0x55555555a040 <file_treewalk_feed>, options=options@entry=0x7fffffffd650, 
>     tar_compress_params=0x555555580010 <compress_params>, fd_out=fd_out@entry=4) at ../../src/deb/build.c:555
> #6  0x000055555555a5c0 in do_build (argv=<optimized out>) at ../../src/deb/build.c:730
> #7  0x0000555555559adc in main (argc=<optimized out>, argv=<optimized out>) at ../../src/deb/main.c:321

And this looks like something else completely. Which I cannot
reproduce either.

> NOTE:
> 
> I am also unable to use dpkg-source (as called from dpkg-build). Getting
> a similar (same?) failure as with dpkg-deb in the debugger, i.e. not
> SIGSEGV but SIGPIPE.

If dpkg-source is also failing with SIGPIPE, then I'd say there's something
going on in your environment.

As it is I cannot reproduce neither of these issues, so there's not
much that I can do here.

(Also are you sure your system is good, f.ex. «dpkg -V»?)

Thanks,
Guillem