cockroachdb / cockroachdb/cockroach
server: TLS-related crash on Apple M1 when invoking executable with `.//../dir/cockroach`
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
This was found from a customer support case investigation.
When running cockroach on Apple M1 with `.//../d/cockroach` (path must include `//..`), the server crashes before it completes initialization.
- Upstream Go issue: https://github.com/golang/go/issues/61000
- Might be duplicate of https://github.com/golang/go/issues/54590
- Filed upstream as Apple macOS bug FB11643282 [ref](https://github.com/golang/go/issues/54590#issuecomment-1266057084)
**Workaround**: avoid including `//..` in the execution path or run on a different platform than apple M1.
With the 22.2 and 23.1 build, the symptom is a stack trace like the following:
```
SIGILL: illegal instruction
PC=0x7ff80e31d52f m=0 sigcode=1
instruction bytes: 0xf 0xb 0x48 0x8d 0x5 0xe1 0xe6 0x18 0x0 0x48 0x89 0x5 0x19 0xb7 0x74 0x41
goroutine 0 [idle]:
crypto/x509/internal/macos.syscall(0xc003276750?, 0x0?, 0x10037f820?, 0xc004e17260?, 0x10000d98b?, 0x10492f8c0?, 0xc003276750?)
GOROOT/src/runtime/sys_darwin.go:100 +0x95 fp=0xc004e17210 sp=0xc004e17170 pc=0x10006d935
crypto/x509/internal/macos.CFRelease(0xc004e172b8?)
GOROOT/src/crypto/x509/internal/macos/corefoundation.go:156 +0x34 fp=0xc004e17258 sp=0xc004e17210 pc=0x10037ea14
crypto/x509/internal/macos.ReleaseCFArray(0xc004e172d0?)
GOROOT/src/crypto/x509/internal/macos/corefoundation.go:218 +0x2c fp=0xc004e17288 sp=0xc004e17258 pc=0x10037ecec
crypto/x509.(*Certificate).systemVerify.func2()
GOROOT/src/crypto/x509/root_darwin.go:36 +0x26 fp=0xc004e172a0 sp=0xc004e17288 pc=0x10038f706
runtime.deferreturn()
GOROOT/src/runtime/panic.go:476 +0x33 fp=0xc004e172e0 sp=0xc004e172a0 pc=0x10003a813
crypto/x509.(*Certificate).systemVerify(0xc0007ae000, 0xc004e176c0)
GOROOT/src/crypto/x509/root_darwin.go:42 +0x7b8 fp=0xc004e17580 sp=0xc004e172e0 pc=0x10038eff8
crypto/x509.(*Certificate).Verify(0xc0007ae000, {{0xc002c64180, 0x18}, 0xc000e883c0, 0x0, {0xc11cf1e0dfaf0db0, 0x7cdd0503, 0x10944b400}, {0x0, 0x0, ...}, ...})
GOROOT/src/crypto/x509/verify.go:768 +0x4e7 fp=0xc004e176c0 sp=0xc004e17580 pc=0x100393e47
crypto/tls.(*Conn).verifyServerCertificate(0xc002dd1880, {0xc0006b1c80, 0x3, 0x4})
GOROOT/src/crypto/tls/handshake_client.go:885 +0x679 fp=0xc004e17948 sp=0xc004e176c0 pc=0x1003c5f39
```
With go 1.20 the symptom might be the following error message:
```
tls: failed to verify certificate: SecPolicyCreateSSL error: 0
```
Jira issue: CRDB-29095
Contributor guide
Assessment
This issue has not been assessed yet.