증상
Oct 22 17:40:47 hostname kernel: curl[113468] trap invalid opcode ip:7f85759a4d60 sp:7fffcbfd5818 error:0 in libfreeblpriv3.so[7f8575952000+72000]
Oct 22 17:40:57 hostname kernel: curl[113477] trap invalid opcode ip:7f7ce3d26d60 sp:7ffc410a0938 error:0 in libfreeblpriv3.so[7f7ce3cd4000+72000]
Oct 22 17:40:59 hostname kernel: curl[113525] trap invalid opcode ip:7f174e10dd60 sp:7fffa6e115c8 error:0 in libfreeblpriv3.so[7f174e0bb000+72000]
Oct 22 17:41:18 hostname kernel: curl[113534] trap invalid opcode ip:7fb2fb2c6d60 sp:7ffc0143f068 error:0 in libfreeblpriv3.so[7fb2fb274000+72000]
Oct 22 17:41:33 hostname kernel: git-remote-http[113550] trap invalid opcode ip:7fb686277d60 sp:7ffed86199c8 error:0 in libfreeblpriv3.so[7fb686225000+72000]
Oct 22 17:42:05 hostname kernel: git-remote-http[113601] trap invalid opcode ip:7f899816bd60 sp:7ffd4ffb46b8 error:0 in libfreeblpriv3.so[7f8998119000+72000]
Oct 22 17:42:25 hostname kernel: curl[113604] trap invalid opcode ip:7f2fe5eabd60 sp:7ffffe3755a8 error:0 in libfreeblpriv3.so[7f2fe5e59000+72000]
Oct 22 17:43:14 hostname kernel: curl[113663] trap invalid opcode ip:7f72bda8fd60 sp:7ffc3f3c9eb8 error:0 in libfreeblpriv3.so[7f72bda3d000+72000]
Oct 22 17:43:35 hostname kernel: git-remote-http[113669] trap invalid opcode ip:7f2715825d60 sp:7ffddad037f8 error:0 in libfreeblpriv3.so[7f27157d3000+72000]
원인
- XEN Hypervisor 하위 Guest OS 중, CentOS 6에서 nss package 업그레이드에 따른 이슈
Root Cause
Although RHEL 6.8 does not fully support AVX extensions some packages are still aware of the availability of AVX extensions. The nss-softoken package attempts to use AVX extensions to accelerate AES encryption operations, and this accelerated encryption operation fails.
Note: This issue has been reported on RHEL 6 guests running on a XEN hypervisor with processors that have AVX extensions.
Segfaults in libfreeblpriv3.so after upgrading to RHEL 6.8. This is affecting some components that utilize nss libraries. Currently these include:
-
Apache child processes are crashing when they are using SSL
-
Calls to curl libraries that access web sites secured via https are segfaulting
(출처 : redhat)
해결 방안
nss package downgrade 이후 service restart
cd /
mkdir nssdowngrade
wget http://vault.centos.org/6.7/updates/x86_64/Packages/nss-3.21.0-0.3.el6_7.x86_64.rpm
wget http://vault.centos.org/6.7/updates/x86_64/Packages/nss-sysinit-3.21.0-0.3.el6_7.x86_64.rpm
wget http://vault.centos.org/6.7/updates/x86_64/Packages/nss-tools-3.21.0-0.3.el6_7.x86_64.rpm
wget http://vault.centos.org/6.7/updates/x86_64/Packages/nss-util-3.21.0-0.3.el6_7.x86_64.rpm
yum downgrade ./*.rpm
workaround
#export NSS_DISABLE_HW_AES=1