net-snmp

Tracker: Bugs

6 5.4+ ipAddressTable crash with double free - ID: 1733344

Last Update: Settings changed ( tanders )

Details:

Fedora Core 4
Trying to compile from :

net-snmp-5.4.1.pre2.tar.gz
net-snmp-5.4.1.pre1.tar.gz
net-snmp-svn-V5-4-patches_20070530_0308.tar.gz
net-snmp-svn-main_20070530_0311.tar.gz

Trying compiled binaries on FC 6 - works fine.

uname -a
Linux localhost.localdomain 2.6.18.0002 #6 Thu Jun 7 22:32:46 NOVST 2007
i686 i686 i386 GNU/Linux

Use selfcompiled listed kernels:
2.6.16.8
2.6.18.6
2.6.21.4

all in attach.

Submitted:

Nobody/Anonymous ( nobody ) - 2007-06-08 10:22

Priority:

Status:

Closed

Resolution:

Fixed

Assigned:

Robert Story

Category:

agent

Group:

None

Visibility:

Public

Comments ( 15 )

Date: 2008-07-22 19:11 Sender: nobody Logged In: NO Yep, looks like its fixed. I got net-snmp-svn-main_20080722_0310.tar.gz and installed it and it runs fine. Sorry it took so long to notice. -Andy
Date: 2008-04-22 21:23 Sender: tanders The problem should be fixed in SVN Revision 16804 on 2008-02-14. Can you please try a recent SVN snapshot, either build from source (http://www.net-snmp.org/nightly/tarballs) or a binary SVN snapshot package (http://www.net-snmp.org/wiki/index.php/Third-Party_Packages) and report back?
Date: 2007-10-04 21:34 Sender: nobody Logged In: NO Nope, sorry. no stack trace this time, just a seg fault: root@marajade:/pub/apps/net-snmp-5.4.1# /usr/local/sbin/snmpd -A -p /var/run/snmpd -a -c /etc/snmp/snmpd.conf -f Segmentation fault I googled gdb and tried to get a stacktrace... root@marajade:/pub/apps/net-snmp-5.4.1# gdb /usr/local/sbin/snmpd GNU gdb 6.6 Copyright (C) 2006 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i486-slackware-linux"... Using host libthread_db library "/lib/libthread_db.so.1". (gdb) run -A -p /var/run/snmpd -a -c /etc/snmp/snmpd.conf -f Starting program: /usr/local/sbin/snmpd -A -p /var/run/snmpd -a -c /etc/snmp/snmpd.conf -f [Thread debugging using libthread_db enabled] [New Thread -1215875392 (LWP 10550)] Program received signal SIGSEGV, Segmentation fault. [Switching to Thread -1215875392 (LWP 10550)] netsnmp_get_list_data (head=0x28, name=0xb7f3f94d "ioctl_extras") at data_list.c:167 167 if (head->name && strcmp(head->name, name) == 0) (gdb) backtrace #0 netsnmp_get_list_data (head=0x28, name=0xb7f3f94d "ioctl_extras") at data_list.c:167 #1 0xb7f14227 in netsnmp_ioctl_ipaddress_extras_get (entry=0x8126950) at ip-mib/data_access/ipaddress_ioctl.c:38 #2 0xb7f1504c in netsnmp_ioctl_ipaddress_entry_copy (lhs=0x8117978, rhs=0xb7f3f94d) at ip-mib/data_access/ipaddress_ioctl.c:107 #3 0xb7f12030 in netsnmp_arch_ipaddress_entry_copy (lhs=0x8117978, rhs=0x8126950) at ip-mib/data_access/ipaddress_linux.c:81 #4 0xb7f115b2 in netsnmp_access_ipaddress_entry_update (lhs=0x8117978, rhs=0x8126950) at ip-mib/data_access/ipaddress_common.c:267 #5 0xb7ef93ef in _check_entry_for_updates (rowreq_ctx=0x8135b30, magic=0xbf899264) at ip-mib/ipAddressTable/ipAddressTable_data_access.c:228 #6 0xb7c71571 in _ba_for_each (container=0x80cb5c8, f=0xb7ef9390 <_check_entry_for_updates>, context=0xbf899264) at container_binary_array.c:342 #7 0xb7ef9675 in ipAddressTable_container_load (container=0x80cb5c8) at ip-mib/ipAddressTable/ipAddressTable_data_access.c:350 #8 0xb7ef5a74 in _cache_load (cache=0x80cad88, vmagic=0x80cb5c8) at ip-mib/ipAddressTable/ipAddressTable_interface.c:1912 #9 0xb7f7972c in _cache_load (cache=0x80cad88) at cache_handler.c:537 #10 0xb7c59921 in run_alarms () at snmp_alarm.c:252 #11 0x0804ab8e in main (argc=8, argv=0xbf8996d4) at snmpd.c:1210 (gdb) -Andy
Date: 2007-10-04 21:07 Sender: tanders Only 5.4.1 plus the latter patch, then report the results, please.
Date: 2007-10-04 17:01 Sender: nobody Logged In: NO Nope, sorry, still died: * glibc detected * /usr/local/sbin/snmpd: free(): invalid pointer: 0xb7d3a150 *** ======= Backtrace: ========= /lib/libc.so.6[0xb7c62c23] /lib/libc.so.6(cfree+0x90)[0xb7c660f0] /usr/local/lib/libnetsnmpmibs.so.15(ipAddressTable_release_rowreq_ctx+0x75)[0xb7e4bbf5] /usr/local/lib/libnetsnmpmibs.so.15(ipAddressTable_container_load+0xf6)[0xb7e50716] /usr/local/lib/libnetsnmpmibs.so.15[0xb7e4ca74] /usr/local/lib/libnetsnmphelpers.so.15[0xb7ed072c] /usr/local/lib/libnetsnmp.so.15(run_alarms+0xa1)[0xb7bb0921] /usr/local/sbin/snmpd(main+0x93e)[0x804ab8e] /lib/libc.so.6(__libc_start_main+0xd8)[0xb7c10df8] /usr/local/sbin/snmpd[0x8049ee1] I had both patches applied, is that ok? Should I get the original 5.4.1 src and only apply http://pastebin.ca/raw/723152? Is there anything else I can help with? My C is rusty, and I've never used gdb, but willing. Would a remote ssh (non-root) account help? -Andy
Date: 2007-10-03 21:43 Sender: tanders There's a new, alternate patch over here: http://pastebin.ca/raw/723152. Please give it a try and report back.
Date: 2007-10-03 19:34 Sender: nobody Logged In: NO I think I may be hitting on this. 5.4.1 would just segfault and die. With the patch, however, I get this: # more snmpd.conf rocommunity public root@marajade:/etc/snmp# /usr/local/sbin/snmpd -A -p /var/run/snmpd -a -c /etc/snmp/snmpd.conf -f * glibc detected * /usr/local/sbin/snmpd: free(): invalid pointer: 0xb7d0b150 *** ======= Backtrace: ========= /lib/libc.so.6[0xb7c33c23] /lib/libc.so.6(cfree+0x90)[0xb7c370f0] /usr/local/lib/libnetsnmpmibs.so.15(ipAddressTable_release_rowreq_ctx+0x75)[0xb7e1cb95] /usr/local/lib/libnetsnmpmibs.so.15(ipAddressTable_container_load+0xf6)[0xb7e216a6] /usr/local/lib/libnetsnmpmibs.so.15[0xb7e1da14] /usr/local/lib/libnetsnmphelpers.so.15[0xb7ea172c] /usr/local/lib/libnetsnmp.so.15(run_alarms+0xa1)[0xb7b81921] /usr/local/sbin/snmpd(main+0x93e)[0x804ab8e] /lib/libc.so.6(__libc_start_main+0xd8)[0xb7be1df8] /usr/local/sbin/snmpd[0x8049ee1] root@marajade:/etc/snmp# ifconfig -a eth1 Link encap:Ethernet HWaddr 00:16:E6:DD:A6:76 inet addr:192.168.10.12 Bcast:192.168.10.255 Mask:255.255.255.0 inet6 addr: fe80::216:e6ff:fedd:a676/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:32804310 errors:215 dropped:0 overruns:0 frame:183 TX packets:27866684 errors:6281 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1963139942 (1.8 GiB) TX bytes:2664611768 (2.4 GiB) Interrupt:19 Base address:0x8000 eth2 Link encap:Ethernet HWaddr 00:A0:CC:E5:A9:66 inet addr:63.228.164.252 Bcast:63.228.164.255 Mask:255.255.255.248 inet6 addr: fe80::2a0:ccff:fee5:a966/64 Scope:Link UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:17037193 errors:0 dropped:0 overruns:0 frame:0 TX packets:14059800 errors:2 dropped:0 overruns:0 carrier:4 collisions:0 txqueuelen:1000 RX bytes:2159806373 (2.0 GiB) TX bytes:3117496149 (2.9 GiB) Interrupt:20 Base address:0x6000 lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:5021398 errors:0 dropped:0 overruns:0 frame:0 TX packets:5021398 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:2319459678 (2.1 GiB) TX bytes:2319459678 (2.1 GiB) tun0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.8.0.1 P-t-P:10.8.0.2 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1500 Metric:1 RX packets:122485 errors:0 dropped:0 overruns:0 frame:0 TX packets:129701 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:27333424 (26.0 MiB) TX bytes:70407467 (67.1 MiB) I can be reached by email at andy at squeakycode dot net. -Andy
Date: 2007-09-28 13:50 Sender: rstory original patch was against trunk.. 5.4.1 version attached.. File Added: diff.ipaddress-patch-541
Date: 2007-09-25 20:27 Sender: rstory can you try the attached patch? File Added: diff.ipaddress-patch
Date: 2007-08-07 18:19 Sender: rstory If you don't care about the ipAddressTable, simply add '-I -ipAddressTable' to your command line. Additional debug data, from another user on IRC attached... so there are two problems... duplicate IP Addresses, and duplicate ifIndexes... File Added: ipaddr-crash-debug.txt
Date: 2007-07-27 08:43 Sender: cpwp Also, the box I am using is a PPPoE access concentrator - so at any given time, it has >500 PPP interfaces. ifconfig -a - most PPP interfaces snipped for brevity: eth0 Link encap:Ethernet HWaddr 00:15:17:2C:67:42 inet addr:172.16.3.60 Bcast:172.16.3.255 Mask:255.255.255.0 UP BROADCAST RUNNING MTU:1500 Metric:1 RX packets:145808 errors:0 dropped:0 overruns:0 frame:0 TX packets:158968 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:14762746 (14.0 Mb) TX bytes:39913576 (38.0 Mb) Base address:0x2000 Memory:48180000-481a0000 eth1 Link encap:Ethernet HWaddr 00:09:5B:BD:F1:E6 UP BROADCAST RUNNING MTU:1500 Metric:1 RX packets:59029619 errors:0 dropped:0 overruns:0 frame:0 TX packets:69678782 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1401939257 (1336.9 Mb) TX bytes:1342049718 (1279.8 Mb) Interrupt:21 Base address:0x8000 eth2 Link encap:Ethernet HWaddr 00:09:5B:E2:C1:4C inet addr:80.247.16.3 Bcast:80.247.16.15 Mask:255.255.255.240 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:69407171 errors:0 dropped:128 overruns:16 frame:0 TX packets:57028293 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1421540470 (1355.6 Mb) TX bytes:655188396 (624.8 Mb) Interrupt:22 Base address:0xa000 imq0 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 UP RUNNING NOARP MTU:1500 Metric:1 RX packets:49430692 errors:0 dropped:0 overruns:0 frame:0 TX packets:49315848 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:30 RX bytes:2392813482 (2281.9 Mb) TX bytes:2303499821 (2196.7 Mb) imq1 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 UP RUNNING NOARP MTU:1500 Metric:1 RX packets:57985523 errors:0 dropped:0 overruns:0 frame:0 TX packets:57879633 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:30 RX bytes:2497587487 (2381.8 Mb) TX bytes:2367398888 (2257.7 Mb) imq2 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 UP RUNNING NOARP MTU:1500 Metric:1 RX packets:7868008 errors:0 dropped:0 overruns:0 frame:0 TX packets:7616006 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:30 RX bytes:1925907908 (1836.6 Mb) TX bytes:1818283250 (1734.0 Mb) imq3 Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 UP RUNNING NOARP MTU:1500 Metric:1 RX packets:10176066 errors:0 dropped:0 overruns:0 frame:0 TX packets:9958417 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:30 RX bytes:1985571195 (1893.5 Mb) TX bytes:1717718455 (1638.1 Mb) lo Link encap:Local Loopback inet addr:127.0.0.1 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:16436 Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) ppp0 Link encap:Point-to-Point Protocol inet addr:80.247.16.3 P-t-P:80.247.22.179 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1454 Metric:1 RX packets:20281 errors:0 dropped:0 overruns:0 frame:0 TX packets:22885 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:2934918 (2.7 Mb) TX bytes:21058022 (20.0 Mb) ppp1 Link encap:Point-to-Point Protocol inet addr:80.247.16.3 P-t-P:80.247.23.226 Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1 RX packets:302692 errors:0 dropped:0 overruns:0 frame:0 TX packets:401044 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:3 RX bytes:43668643 (41.6 Mb) TX bytes:244732513 (233.3 Mb)
Date: 2007-07-27 08:35 Sender: cpwp I am experiencing the same error with net-snmp-svn-main_20070714_0311 uname -a: Linux pppoe1 2.6.22-gentoo-r1 #1 SMP Mon Jul 16 20:38:17 BST 2007 i686 Intel(R) Core(TM)2 CPU 6600 @ 2.40GHz GenuineIntel GNU/Linux Reading specs from /usr/lib/gcc/i686-pc-linux-gnu/3.4.6/specs Configured with: /var/tmp/portage/sys-devel/gcc-3.4.6-r2/work/gcc-3.4.6/configure --prefix=/usr --bindir=/usr/i686-pc-linux-gnu/gcc-bin/3.4.6 --includedir=/usr/lib/gcc/i686-pc-linux-gnu/3.4.6/include --datadir=/usr/share/gcc-data/i686-pc-linux-gnu/3.4.6 --mandir=/usr/share/gcc-data/i686-pc-linux-gnu/3.4.6/man --infodir=/usr/share/gcc-data/i686-pc-linux-gnu/3.4.6/info --with-gxx-include-dir=/usr/lib/gcc/i686-pc-linux-gnu/3.4.6/include/g++-v3 --host=i686-pc-linux-gnu --build=i686-pc-linux-gnu --disable-altivec --enable-nls --without-included-gettext --with-system-zlib --disable-checking --disable-werror --enable-secureplt --disable-libunwind-exceptions --disable-multilib --disable-libgcj --with-arch=i686 --enable-languages=c,c++,f77 --enable-shared --enable-threads=posix --enable-__cxa_atexit --enable-clocale=gnu Thread model: posix gcc version 3.4.6 (Gentoo 3.4.6-r2 p1.5, ssp-3.4.6-1.0, pie-8.7.10)
Date: 2007-06-26 23:10 Sender: tanders File Added: buildlogs.tar.gz
Date: 2007-06-26 23:09 Sender: tanders File Added: gdb.txt
Date: 2007-06-26 22:20 Sender: tanders OK. it looks like this is related to ipAddressTable. Does it happen on just this box? Have you tried on any other? What's the output of "ifconfig -a" on this box? What's the version of the "compiled binaries on FC 6" you mentioned?

Attached Files ( 6 )

Filename	Description	Download
net-snmp_bug_report.rar	bug info and compile file	Download
gdb.txt	bug info (unpacked)	Download
buildlogs.tar.gz	build logs (repackaged as tar.gz)	Download
ipaddr-crash-debug.txt	debug from irc user	Download
diff.ipaddress-patch		Download
diff.ipaddress-patch-541	patch against 5.4.1	Download

Changes ( 18 )

Field	Old Value	Date	By
close_date	2008-04-22 21:23	2008-07-22 20:43	tanders
status_id	Open	2008-07-22 20:43	tanders
status_id	Pending	2008-07-22 19:11	nobody
close_date	2007-09-25 20:27	2008-04-22 21:23	tanders
resolution_id	None	2008-04-22 21:23	tanders
status_id	Open	2008-04-22 21:23	tanders
status_id	Pending	2007-10-03 19:34	nobody
File Added	247568: diff.ipaddress-patch-541	2007-09-28 13:50	rstory
close_date	-	2007-09-25 20:27	rstory
File Added	247203: diff.ipaddress-patch	2007-09-25 20:27	rstory
status_id	Open	2007-09-25 20:27	rstory
assigned_to	nobody	2007-09-25 20:27	rstory
File Added	240294: ipaddr-crash-debug.txt	2007-08-07 18:19	rstory
File Added	234676: buildlogs.tar.gz	2007-06-26 23:10	tanders
File Added	234675: gdb.txt	2007-06-26 23:09	tanders
summary	crash with double free error	2007-06-26 22:20	tanders
priority	5	2007-06-26 22:20	tanders
File Added	232253: net-snmp_bug_report.rar	2007-06-08 10:22	nobody

net-snmp

Tracker: Bugs

Comments ( 15 )

Attached Files ( 6 )

Changes ( 18 )

About SourceForge

Find Software

Develop Software

Community

Help