cf-agent 3.0.0b7 : double free
Joseph VanAndel <[email protected]> Wed, 17 Dec 2008 16:46:31 -0700
| Newsgroups | gmane.comp.sysutils.cfengine.bugs |
|---|---|
| Message-ID | <[email protected]> |
On CentOS 5.2.2, cf-agent 3.0.0b7 can crash with a double free or
corruption:
Here's a stack backtrace:
#0 0x00b1e402 in __kernel_vsyscall ()
#1 0x00549d10 in raise () from /lib/libc.so.6
#2 0x0054b621 in abort () from /lib/libc.so.6
#3 0x00581e5b in __libc_message () from /lib/libc.so.6
#4 0x00589d06 in _int_free () from /lib/libc.so.6
#5 0x0058d1e0 in free () from /lib/libc.so.6
#6 0x08076948 in DeletePromise (pp=0x65fff4) at promises.c:510
#7 0x08073049 in ExpandPromiseAndDo (agent=cf_agent,
scopeid=0x8e90c00 "main", pp=0x8e96dd0, scalarvars=0x0,
listvars=0x8e96158,
fnptr=0x804b050 <KeepAgentPromise>) at expand.c:612
#8 0x0807440c in ExpandPromise (agent=cf_agent, scopeid=0x8e90c00
"main", pp=0x8e903b8, fnptr=0x804b050) at expand.c:117
#9 0x0804b48d in ScheduleAgentOperations (bp=0x8e90be8) at agent.c:609
#10 0x0804b631 in KeepPromiseBundles () at agent.c:573
#11 0x0804bde5 in KeepPromises () at agent.c:254
#12 0x0804c174 in main (argc=Cannot access memory at address 0x26b6
) at agent.c:126
valgrind also shows the issue, and indicates where the block was
originally freed.
==10058== Invalid free() / delete / delete[]
==10058== at 0x4004FDA: free (vg_replace_malloc.c:233)
==10058== by 0x8076947: DeletePromise (promises.c:510)
==10058== by 0x8073048: ExpandPromiseAndDo (expand.c:612)
==10058== by 0x807440B: ExpandPromise (expand.c:117)
==10058== by 0x804B48C: ScheduleAgentOperations (agent.c:609)
==10058== by 0x804B630: KeepPromiseBundles (agent.c:573)
==10058== by 0x804BDE4: KeepPromises (agent.c:254)
==10058== by 0x804C173: main (agent.c:126)
==10058== Address 0x420C080 is 0 bytes inside a block of size 12 free'd
==10058== at 0x4004FDA: free (vg_replace_malloc.c:233)
==10058== by 0x805B401: CopyFileSources (files_copy.c:76)
==10058== by 0x8059E79: ScheduleCopyOperation (files_operators.c:170)
==10058== by 0x804C715: VerifyFilePromise (verify_files.c:323)
==10058== by 0x804C91B: LocateFilePromiserGroup (verify_files.c:84)
==10058== by 0x804CE08: FindFilePromiserObjects (verify_files.c:62)
==10058== by 0x804CE49: FindAndVerifyFilesPromises (verify_files.c:
37)
==10058== by 0x804B22F: KeepAgentPromise (agent.c:750)
==10058== by 0x80730D4: ExpandPromiseAndDo (expand.c:599)
==10058== by 0x807440B: ExpandPromise (expand.c:117)
==10058== by 0x804B48C: ScheduleAgentOperations (agent.c:609)
==10058== by 0x804B630: KeepPromiseBundles (agent.c:573)
I've attached the verbose output of cf-agent
_______________________________________________
Bug-cfengine mailing list
[email protected]
https://cfengine.org/mailman/listinfo/bug-cfengine
cf.log
(application/octet-stream, 12.1 KB)
Work directory is /var/cfengine
Making sure that locks are private...
Checking integrity of the state database
Checking integrity of the module directory
Checking integrity of the input data for RPC
Checking integrity of the output data for RPC
Checking integrity of the PKI directory
Looking for a source of entropy in /var/cfengine/state/cf_observations.db
: Could not read sufficient randomness from /var/cfengine/state/cf_observations.db
Loaded /var/cfengine/ppkeys/localhost.priv
Loaded /var/cfengine/ppkeys/localhost.pub
Setting cfengine default port to 5308 = 5308
Reference time set to Wed Dec 17 16:30:15 2008
cf3 Cfengine - 3.0.0b7
cf3 cfengine 3 is (C) Cfengine AS 2008, and offered under the terms of the enclosed free software licence
cf3 ------------------------------------------------------------------------
cf3 Host name is: eng.gate.rtf
cf3 Operating System Type is linux
cf3 Operating System Release is 2.6.18-92.1.18.el5PAE
cf3 Architecture = i686
cf3 Using internal soft-class linux for host eng.gate.rtf
cf3 The time is now Wed Dec 17 16:30:15 2008
cf3 ------------------------------------------------------------------------
cf3 Additional hard class defined as: 32_bit
cf3 Additional hard class defined as: linux_2_6_18_92_1_18_el5PAE
cf3 Additional hard class defined as: linux_i686
cf3 Additional hard class defined as: linux_i686_2_6_18_92_1_18_el5PAE
cf3 GNU autoconf class from compile time: compiled_on_linux_gnu
cf3 Address given by nameserver: 127.0.0.1
cf3 Interface 1: lo
cf3 Interface 2: eth0
cf3 Trying to locate my IPv6 address
cf3 Found IPv6 address fe80::21a:a0ff:fe31:f418
cf3 Looking for environment from cfenvd...
cf3 Unable to detect environment from cfMonitord
This appears to be a redhat system.
Looking for redhat linux info in "CentOS release 5.2 (Final)
"
This appears to be a LSB compliant system.
---------------------------------------------------------------------
Loading persistent classes
---------------------------------------------------------------------
cf3 Persistent class checksum_alerts for 8 more minutes
cf3 Adding persistent class checksum_alerts to heap
---------------------------------------------------------------------
Loaded persistent memory
---------------------------------------------------------------------
cf3 > Parsing file /var/cfengine/inputs/spol.cf
cf3 > Parsing file update.cf
cf3 > Parsing file library.cf
---------------------------------------------------------------------
Agent's basic classified context
---------------------------------------------------------------------
Defined Classes = ( any Wednesday Hr16 Min30 Min30_35 Q3 Hr16_Q3 Day17 December Yr2008 linux eng_gate_rtf gate_rtf rtf eng 32_bit linux_2_6_18_92_1_18_el5PAE i686 linux_i686 linux_i686_2_6_18_92_1_18_el5PAE linux_i686_2_6_18_92_1_18_el5PAE__1_SMP_Wed_Nov_12_10_02_30_EST_2008 compiled_on_linux_gnu localhost_localdomain localhost net_iface_lo net_iface_eth0 ipv4_192_168_4_24 ipv4_192_168_4 ipv4_192_168 ipv4_192 fe80__21a_a0ff_fe31_f418 cfengine_2_2_8 cfengine_2_2 cfengine_2 redhat centos centos_5 centos_5_2 lsb_compliant centos_final checksum_alerts )
Negated Classes = ( )
Installable classes = ( )
cfengine> Wrote expansion summary to promise_output_agent.txt
cfengine>
cfengine> *****************************************************************
cfengine> BUNDLE update( {'192.168.4.251'} )
cfengine> *****************************************************************
cfengine>
cfengine>
cfengine> =========================================================
cfengine> classes in bundle update
cfengine> =========================================================
cfengine>
cfengine>
cfengine> + Private classes augmented:
cfengine>
cfengine> - Private classes diminished:
cfengine>
cfengine>
cfengine>
cfengine> =========================================================
cfengine> files in bundle update
cfengine> =========================================================
cfengine>
cfengine>
cfengine> .........................................................
cfengine> /var/cfengine/inputs
cfengine> .........................................................
cfengine>
cfengine> -> Using file literal base path /var/cfengine/inputs
cfengine> -> File permissions on /var/cfengine/inputs/spol.cf as promised
cfengine> -> File permissions on /var/cfengine/inputs/promise_output_common.txt as promised
cfengine> -> File permissions on /var/cfengine/inputs/library.cf as promised
cfengine> -> File permissions on /var/cfengine/inputs/promise_output_agent.txt as promised
cfengine> -> File permissions on /var/cfengine/inputs/failsafe.cf.txt as promised
cfengine> -> File permissions on /var/cfengine/inputs/failsafe.cf.html as promised
cfengine> -> File permissions on /var/cfengine/inputs/failsafe.cf as promised
cfengine> -> File permissions on /var/cfengine/inputs/update.cf as promised
cfengine> -> Copy file /var/cfengine/inputs from /var/cfengine/inputs check
cfengine> Set cfengine port number to 5308 = 5308
cfengine> Connect to 192.168.4.251 = 192.168.4.251 on port 5308
Loaded /var/cfengine/ppkeys/root-192.168.4.251.pub
cfengine>
...h.a.i.l.......................................................
cfengine> Strong authentication of server=192.168.4.251 connection confirmed
cfengine> Promise belongs to bundle 'update' in file 'update.cf' near line 15
cfengine> -> /var/cfengine/inputs/passwd wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/passwd
cfengine> -> File permissions on /var/cfengine/inputs/passwd as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/passwd
cfengine> -> /var/cfengine/inputs/resolv.conf wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/resolv.conf
cfengine> -> File permissions on /var/cfengine/inputs/resolv.conf as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/resolv.conf
cfengine> -> /var/cfengine/inputs/CentOS-Base.repo wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/CentOS-Base.repo
cfengine> -> File permissions on /var/cfengine/inputs/CentOS-Base.repo as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/CentOS-Base.repo
cfengine> -> /var/cfengine/inputs/group wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/group
cfengine> -> File permissions on /var/cfengine/inputs/group as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/group
cfengine> -> /var/cfengine/inputs/ntp.conf wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/ntp.conf
cfengine> -> File permissions on /var/cfengine/inputs/ntp.conf as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/ntp.conf
cfengine> -> /var/cfengine/inputs/hosts wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/hosts
cfengine> -> File permissions on /var/cfengine/inputs/hosts as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/hosts
cfengine> -> /var/cfengine/inputs/auto.master wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/auto.master
cfengine> -> File permissions on /var/cfengine/inputs/auto.master as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/auto.master
cfengine> -> /var/cfengine/inputs/net.map wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/net.map
cfengine> -> File permissions on /var/cfengine/inputs/net.map as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/net.map
cfengine> -> /var/cfengine/inputs/yum-updatesd.conf wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/yum-updatesd.conf
cfengine> -> File permissions on /var/cfengine/inputs/yum-updatesd.conf as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/yum-updatesd.conf
cfengine> -> /var/cfengine/inputs/scr.map wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/scr.map
cfengine> -> File permissions on /var/cfengine/inputs/scr.map as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/scr.map
cfengine> -> /var/cfengine/inputs/h.map wasn't at destination (copying)
cfengine> -> Copying from 192.168.4.251:/var/cfengine/masterfiles/h.map
cfengine> -> File permissions on /var/cfengine/inputs/h.map as promised
cfengine> -> Updated file from 192.168.4.251:/var/cfengine/masterfiles/h.map
cfengine> Performance(Copy(192.168.4.251:/var/cfengine/masterfiles/ > /var/cfengine/inputs)): time=0.7372 secs, av=0.7372 +/- 0.0316
cfengine>
cfengine> =========================================================
cfengine> classes in bundle update
cfengine> =========================================================
cfengine>
cfengine>
cfengine> + Private classes augmented:
cfengine>
cfengine> - Private classes diminished:
cfengine>
cfengine>
cfengine>
cfengine> =========================================================
cfengine> files in bundle update
cfengine> =========================================================
cfengine>
cfengine>
cfengine> *****************************************************************
cfengine> BUNDLE main
cfengine> *****************************************************************
cfengine>
cfengine>
cfengine> =========================================================
cfengine> vars in bundle main
cfengine> =========================================================
cfengine>
cfengine>
cfengine> + Private classes augmented:
cfengine>
cfengine> - Private classes diminished:
cfengine>
cfengine>
cfengine>
cfengine> =========================================================
cfengine> files in bundle main
cfengine> =========================================================
cfengine>
cfengine>
cfengine> .........................................................
cfengine> /etc/passwd
cfengine> .........................................................
cfengine>
cfengine> -> Using file literal base path /etc/passwd
cfengine> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
cfengine> SECURITY ALERT: Hash (md5) for /etc/passwd changed!
cfengine> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
cfengine> Persisent state checksum_alerts is already in a preserved state -- 8 minutes to go
cfengine> -> File permissions on /etc/passwd as promised
cfengine>
cfengine> .........................................................
cfengine> /etc/services
cfengine> .........................................................
cfengine>
cfengine> -> Using file literal base path /etc/services
cfengine> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
cfengine> SECURITY ALERT: Hash (md5) for /etc/services changed!
cfengine> !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
cfengine> Persisent state checksum_alerts is already in a preserved state -- 8 minutes to go
cfengine> -> File permissions on /etc/services as promised
cfengine>
cfengine> .........................................................
cfengine> /etc/passwd
cfengine> .........................................................
cfengine>
cfengine> -> Using file literal base path /etc/passwd
cfengine> -> File permissions on /etc/passwd as promised
cfengine> -> Copy file /etc/passwd from /etc/passwd check
cfengine> Set cfengine port number to 5308 = 5308
cfengine> Connect to 192.168.4.251 = 192.168.4.251 on port 5308
Loaded /var/cfengine/ppkeys/root-192.168.4.251.pub
cfengine>
...h.a.i.l.......................................................
cfengine> Strong authentication of server=192.168.4.251 connection confirmed
cfengine> Promise belongs to bundle 'main' in file '/var/cfengine/inputs/spol.cf' near line 86
cfengine>: Cannot make /etc/passwd - /etc/passwd is not a directory! (use forcedirs=true)
cfengine> Can't make directories for /etc/passwd/. in files.copyfrom promise