Re: Core dump with net-snmp-5.8

Hi,

thanks for your patch. Unfortunately, even when I have applied it, it still ends with core dump due of 'double free or corruption (fasttop)'

When I run snmpd with -Dsnmp_agent,agentx/master it ends with:

agentx/master: sending pdu (req=0x1d4,trans=0x1d3,sess=0x5)
snmp_agent: delegate session == 0x56207e165240
snmp_agent: end of handle_snmp_packet, asp = 0x56207e165240
agentx/master: callback resend
agentx/master: callback resend
agentx/master: timeout on session 0x56207dfd5400 req=0x1c9
agentx/master: close 0x56207dfd5400, -1
snmp_agent: removed 40 delegated request(s) for session 0x56207dfce490
snmp_agent: processing delegated request, asp = 0x56207e165240
snmp_agent: canceling next walk for asp 0x56207e165240
snmp_agent: REMOVE session == 0x56207e165240
snmp_agent: agent_session 0x56207e165240 released
snmp_agent: processing delegated request, asp = 0x56207e1041a0
snmp_agent: canceling next walk for asp 0x56207e1041a0
snmp_agent: REMOVE session == 0x56207e1041a0
snmp_agent: agent_session 0x56207e1041a0 released
snmp_agent: processing delegated request, asp = 0x56207e1656c0
snmp_agent: canceling next walk for asp 0x56207e1656c0
snmp_agent: REMOVE session == 0x56207e1656c0
snmp_agent: agent_session 0x56207e1656c0 released
snmp_agent: processing delegated request, asp = 0x56207e11af40
snmp_agent: canceling next walk for asp 0x56207e11af40
snmp_agent: REMOVE session == 0x56207e11af40
snmp_agent: agent_session 0x56207e11af40 released
snmp_agent: processing delegated request, asp = 0x56207e118f00
snmp_agent: canceling next walk for asp 0x56207e118f00
snmp_agent: REMOVE session == 0x56207e118f00
snmp_agent: agent_session 0x56207e118f00 released
snmp_agent: processing delegated request, asp = 0x56207e11b540
snmp_agent: canceling next walk for asp 0x56207e11b540
snmp_agent: REMOVE session == 0x56207e11b540
snmp_agent: agent_session 0x56207e11b540 released
snmp_agent: processing delegated request, asp = 0x56207e11bd00
snmp_agent: canceling next walk for asp 0x56207e11bd00
snmp_agent: REMOVE session == 0x56207e11bd00
snmp_agent: agent_session 0x56207e11bd00 released
agentx/master: Continue removing delegated subsession reqests
agentx/master: close transport
snmp_agent: REMOVE session == 0x56207dfd5400
agentx/master: response too late on session 0x56207dfd5400
agentx/master: response too late on session 0x56207dfd5400
double free or corruption (fasttop)
Aborted (core dumped)


What's interesting, when I run it with -DALL it pass (at least for several rounds).
It looks like some strange race condition.

Regards

Josef Ridky
Software Engineer
Core Services Team
Red Hat Czech, s.r.o.

----- Original Message -----
| From: "Anders Wallin" <[email protected]>
| To: "Josef Ridky" <[email protected]>
| Cc: "net-snmp-coders" <[email protected]>
| Sent: Tuesday, April 2, 2019 1:46:40 PM
| Subject: Re: Core dump with net-snmp-5.8
| 
| Hi Josef,
| 
| I think it's the same issue as https://sourceforge.net/p/net-snmp/bugs/2914/
| (where I also posted the solution)
| Regards
| Anders Wallin
| 
| 
| On Tue, Apr 2, 2019 at 12:43 PM Josef Ridky <[email protected]> wrote:
| 
| > Hi,
| >
| > recently, I have hit to an issue in net-snmp-5.8, that is connected to the
| > bug report [1].
| >
| > When I tried to run agentofdeath test from [1], snmpd daemon will crash
| > with malloc(): smallbin double linked list corrupted or double free() issue
| > and dumps core (see bellow).
| > From log file, I can identified one issue with "Unknown operation".
| >
| > This issue is in the agentx_got_response function
| > (agent/mibgroup/agentx/master.c). There isn't implemented action for
| > NETSNMP_CALLBACK_OP_RESEND (defined in
| > include/net-snmp/library/snmp_api.h).
| > As result "Unknown operation 6 in agentx_got_response" is shown in log
| > file.
| >
| > /var/log/messages
| > -------------------------------
| > Mar 28 06:52:42 localhost snmpd[12073]: Unknown operation 6 in
| > agentx_got_response
| > Mar 28 06:52:43 localhost snmpd[12073]: Unknown operation 6 in
| > agentx_got_response
| > Mar 28 06:52:43 localhost snmpd[12073]: malloc(): smallbin double linked
| > list corrupted
| > Mar 28 06:52:43 localhost systemd[1]: Started Process Core Dump (PID
| > 13652/UID 0).
| > Mar 28 06:52:48 localhost systemd[1]: snmpd.service: Main process exited,
| > code=dumped, status=6/ABRT
| > Mar 28 06:52:48 localhost systemd[1]: snmpd.service: Failed with result
| > 'core-dump'.
| > -------------------------------
| >
| > The "Unknown operation" callback is caused by newly added piece of code in
| > snmplib/snmp_api.c:
| >
| >  static int
| >  snmp_resend_request(struct session_list *slp, netsnmp_request_list *rp,
| >  int incr_retries)
| >  {
| >
| > ...
| >
| >          tv.tv_sec += tv.tv_usec / 1000000L;
| >          tv.tv_usec %= 1000000L;
| >          rp->expireM = tv;
| > +        if (rp->callback)
| > +            rp->callback(NETSNMP_CALLBACK_OP_RESEND, sp,
| > +                         rp->pdu->reqid, rp->pdu, rp->cb_data);
| >      }
| >      return 0;
| >  }
| >
| >
| > When I tried to remove it, it just stop complaining about operation 6, but
| > the core dump is still present.
| >
| > May I ask you for help with this issue? Do you have any idea, what causing
| > this issue in 5.8 and how to fix it?
| > I know, that Jan Safranek has fixed this for 5.7 by commit [2], but it
| > looks like something other has changed and this issue is current again.
| >
| > [1] https://sourceforge.net/p/net-snmp/bugs/2411/
| > [2]
| > https://github.com/net-snmp/net-snmp/commit/793d596838ff7cb48a73b675d62897c56c9e62df
| >
| > Regards
| >
| > Josef Ridky
| > Software Engineer
| > Core Services Team
| > Red Hat Czech, s.r.o.
| >
| >
| >
| > _______________________________________________
| > Net-snmp-coders mailing list
| > [email protected]
| > https://lists.sourceforge.net/lists/listinfo/net-snmp-coders
| >
|