[ net-snmp-Bugs-3577862 ] Crash on SIGHUP while parce exec config line

SourceForge Headquarters 225 Broadway Suite 1600 San Diego, CA 92101 +1 (858) 454-5900

Bugs item #3577862, was opened at 2012-10-17 09:37
Message generated for change (Comment added) made by st-da
You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112694&aid=3577862&group_id=12694

Please note that this message will contain a full copy of the comment thread,
including the initial issue submission, for this request,
not just the latest update.
Category: agent
Group: freeBSD
Status: Open
Resolution: Accepted
Priority: 5
Private: No
Submitted By: Alexey (st-da)
Assigned to: Nobody/Anonymous (nobody)
Summary: Crash on SIGHUP while parce exec config line

Initial Comment:
FreeBSD 9.0 amd64. net-snmp port from fresh ports tree.

I have just updated one server to net-snmp 5.7.2 version. And now snmp service crashed eatch time logrotete sent SIGHUP for reopen the logs. After some research I found it crashed only if I have one or more exec lines in the snmpd.conf

bellow you can see bt output from gdb I got after crash. Looks like some structure forget to decrease couter after it flushed. I do not see same error here in the tracker...

$ sudo gdb /usr/local/sbin/snmpd /var/service/snmpd/snmpd.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...(no debugging symbols found)...
Core was generated by `snmpd'.
Program terminated with signal 11, Segmentation fault.
Reading symbols from /usr/local/lib/libnetsnmpagent.so.30...done.
Loaded symbols for /usr/local/lib/libnetsnmpagent.so.30
Reading symbols from /usr/local/lib/libnetsnmpmibs.so.30...done.
Loaded symbols for /usr/local/lib/libnetsnmpmibs.so.30
Reading symbols from /usr/lib/libwrap.so.6...done.
Loaded symbols for /usr/lib/libwrap.so.6
Reading symbols from /usr/local/lib/libnetsnmp.so.30...done.
Loaded symbols for /usr/local/lib/libnetsnmp.so.30
Reading symbols from /lib/libm.so.5...done.
Loaded symbols for /lib/libm.so.5
Reading symbols from /lib/libkvm.so.5...done.
Loaded symbols for /lib/libkvm.so.5
Reading symbols from /lib/libdevstat.so.7...done.
Loaded symbols for /lib/libdevstat.so.7
Reading symbols from /usr/local/lib/libcrypto.so.8...done.
Loaded symbols for /usr/local/lib/libcrypto.so.8
Reading symbols from /usr/lib/libelf.so.1...done.
Loaded symbols for /usr/lib/libelf.so.1
Reading symbols from /lib/libc.so.7...done.
Loaded symbols for /lib/libc.so.7
Reading symbols from /lib/libthr.so.3...done.
Loaded symbols for /lib/libthr.so.3
Reading symbols from /libexec/ld-elf.so.1...done.
Loaded symbols for /libexec/ld-elf.so.1
#0  _new_extension (exec_name=0x7fffffffc8d0 "mailstat", exec_flags=9, ereg=0x0) at agent/extend.c:448
448         netsnmp_table_data *dinfo = ereg->dinfo;
[New Thread 802807400 (LWP 114129/snmpd)]
(gdb) bt
#0  _new_extension (exec_name=0x7fffffffc8d0 "mailstat", exec_flags=9, ereg=0x0) at agent/extend.c:448
#1  0x0000000800ae6bda in extend_parse_config (token=Variable "token" is not available.
) at agent/extend.c:553
#2  0x000000080108bc30 in run_config_handler (lptr=0x802904700, token=0x7fffffffd1c0 "exec", 
    cptr=0x8028a7e05 "mailstat /bin/cat /var/tmp/mailstat", when=Variable "when" is not available.
) at read_config.c:558
#3  0x000000080108c98d in read_config (filename=0x7fffffffd640 "/usr/local/etc/snmp/snmpd.conf", line_handler=0x802849040, 
    when=0) at read_config.c:977
#4  0x000000080108d5f8 in read_config_files_in_path (path=Variable "path" is not available.
) at read_config.c:1322
#5  0x000000080108d8fd in read_config_files_of_type (when=0, ctmp=0x8028190a0) at read_config.c:1405
#6  0x000000080108d97a in read_config_files (when=0) at read_config.c:1446
#7  0x000000080108df22 in read_configs () at read_config.c:1058
#8  0x0000000000404b08 in SnmpdReconfig ()
#9  0x0000000000402efe in ?? ()
#10 0x0000000800621000 in ?? ()
#11 0x0000000000000000 in ?? ()
#12 0x0000000000000000 in ?? ()
#13 0x0000000000000006 in ?? ()
#14 0x00007fffffffde08 in ?? ()
#15 0x00007fffffffde1e in ?? ()
#16 0x00007fffffffde21 in ?? ()
#17 0x00007fffffffde34 in ?? ()
#18 0x00007fffffffde37 in ?? ()
#19 0x00007fffffffde3a in ?? ()
#20 0x0000000000000000 in ?? ()
#21 0x00007fffffffde3d in ?? ()
#22 0x00007fffffffde6b in ?? ()
#23 0x00007fffffffde78 in ?? ()
#24 0x00007fffffffde89 in ?? ()
#25 0x00007fffffffde9d in ?? ()
#26 0x00007fffffffdebf in ?? ()
#27 0x00007fffffffded2 in ?? ()
#28 0x00007fffffffdee0 in ?? ()
#29 0x00007fffffffdef7 in ?? ()
#30 0x00007fffffffdf03 in ?? ()
#31 0x00007fffffffdf0d in ?? ()
#32 0x00007fffffffdf18 in ?? ()
#33 0x00007fffffffdf32 in ?? ()
#34 0x00007fffffffdf43 in ?? ()
#35 0x00007fffffffdf51 in ?? ()
#36 0x00007fffffffdf5f in ?? ()
#37 0x0000000000000000 in ?? ()
#38 0x0000000000000003 in ?? ()
#39 0x0000000000400040 in ?? ()
#40 0x0000000000000004 in ?? ()
#41 0x0000000000000038 in ?? ()
#42 0x0000000000000005 in ?? ()
#43 0x0000000000000008 in ?? ()
#44 0x0000000000000006 in ?? ()
#45 0x0000000000001000 in ?? ()
---Type <return> to continue, or q <return> to quit---
#46 0x0000000000000008 in ?? ()
#47 0x0000000000000000 in ?? ()
#48 0x0000000000000009 in ?? ()
#49 0x0000000000402e70 in ?? ()
#50 0x0000000000000007 in ?? ()
#51 0x0000000800606000 in ?? ()
#52 0x000000000000000f in ?? ()
#53 <signal handler called>
#54 0x0000000000000000 in ?? ()
Previous frame inner to this frame (corrupt stack?)

----------------------------------------------------------------------

>Comment By: Alexey (st-da)
Date: 2012-10-23 23:57

Message:
Thank you for the patch! Looks like it works as expected now. I'll check it
a litle bit longer.

also about "tested with 5.7.1" in comment from cg75. We widely use "exec"
on our servers on FreeBSD and Redhat both 64 and 32 bit. I do NOT confirm
problem at 5.7.1 with exec and SIGHUP.. There was a problem with disk
command and SIGHUP, I reported the problem before it was fixed in git for
5.7.1 and disk command have NOT this problem in 5.7.2

----------------------------------------------------------------------

Comment By: Niels Baggesen (nba)
Date: 2012-10-23 21:34

Message:
Yes, it is a problem that affects all platform :-(
Could you try the attached patch, that hopefully fixes the problem?

----------------------------------------------------------------------

Comment By: cg75 (cg75)
Date: 2012-10-23 11:03

Message:
I can reproduce the same problem on several servers. Without exec items in
snmpd.conf the agent works fine, but with one or more exec items the agent
crashed with a segfault when the agent received a SIGHUP.
(tested with 5.7.1 and 5.7.2 on x86_64 with SLES 10/11)

----------------------------------------------------------------------

You can respond by visiting: 
https://sourceforge.net/tracker/?func=detail&atid=112694&aid=3577862&group_id=12694