Bug 1180721

Summary:	ntp: mreadvar command crash in ntpq
Product:	Red Hat Enterprise Linux 7	Reporter:	Florian Weimer <fweimer>
Component:	ntp	Assignee:	Miroslav Lichvar <mlichvar>
Status:	CLOSED ERRATA	QA Contact:	Jakub Prokes <jprokes>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	ambopua, fweimer, jprokes, jscotka, mlichvar, ovasik, psklenar, qe-baseos-daemons
Target Milestone:	rc
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	ntp-4.2.6p5-20.el7	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1165141	Environment:
Last Closed:	2015-11-19 08:37:42 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Florian Weimer 2015-01-09 19:39:39 UTC

+++ This bug was initially created as a clone of Bug #1165141 +++

Description of problem:

ntpq crashes on CentOS 6.5. I believe this would happen also on RHEL 6.5 because RHEL is the upstream provider for CentOS.

Version-Release number of selected component (if applicable):

$ rpm -q -i ntp

Name        : ntp                          Relocations: (not relocatable)
Version     : 4.2.6p5                           Vendor: CentOS
Release     : 1.el6.centos                  Build Date: Sat 23 Nov 2013 11:51:55 PM IST
Install Date: Tue 18 Nov 2014 02:04:53 PM IST      Build Host: c6b9.bsys.dev.centos.org
Group       : System Environment/Daemons    Source RPM: ntp-4.2.6p5-1.el6.centos.src.rpm
Size        : 1706943                          License: (MIT and BSD and BSD with advertising) and GPLv2
Signature   : RSA/SHA1, Mon 25 Nov 2013 01:02:50 AM IST, Key ID 0946fca2c105b9de
Packager    : CentOS BuildSystem <http://bugs.centos.org>
URL         : http://www.ntp.org
Summary     : The NTP daemon and utilities

-- snipped --

How reproducible:

Always.

Steps to Reproduce:

1. Install ntp.

$ sudo yum install ntp

2. Start the ntp service.

$ sudo service ntpd start

3. Run the following command-line:

$ ntpq -n -c raw -c associations -c  "mreadvar &1 &65535" 127.0.0.1


Actual results:

See, "ntpq-backtrace.txt" for the output and the backtrace.

Expected results:

ntpq should exit without crashing.


Additional info:

--- Additional comment from pradeep roy on 2014-11-18 13:43:42 CET ---

I downloaded ntp's SRPM from here:

http://vault.centos.org/6.5/os/Source/SPackages/ntp-4.2.6p5-1.el6.centos.src.rpm

The ntpq binary was built after enabling debugging symbols. Using gdb, it was found that free() was being called on a stack variable in the mreadvar(), function in ntpq-subs.c. The solution is to initialize the variable so that free() no longer returned error. Attached is the fix.

Comment 4 Jakub Prokes 2015-09-23 21:06:59 UTC

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Setup
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Checking for the presence of ntp rpm 
:: [   LOG    ] :: Package versions:
:: [   LOG    ] ::   ntp-4.2.6p5-19.el7_1.1.x86_64
:: [   LOG    ] :: rlServiceStart: Service ntpd already running, stopping first.
:: [   LOG    ] :: rlServiceStart: Service ntpd started successfully
:: [   PASS   ] :: Command 'rlServiceStart "ntpd"' (Expected 0, got 0)
:: [   LOG    ] :: Duration: 0s
:: [   LOG    ] :: Assertions: 2 good, 0 bad
:: [   PASS   ] :: RESULT: Setup

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   FAIL   ] :: mreadvar command (Expected 0, got 134)
:: [   LOG    ] :: Duration: 1s
:: [   LOG    ] :: Assertions: 0 good, 1 bad
:: [   FAIL   ] :: RESULT: Test


::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Setup
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: Checking for the presence of ntp rpm 
:: [   LOG    ] :: Package versions:
:: [   LOG    ] ::   ntp-4.2.6p5-20.el7.x86_64
:: [   LOG    ] :: rlServiceStart: Service ntpd already running, stopping first.
:: [   LOG    ] :: rlServiceStart: Service ntpd started successfully
:: [   PASS   ] :: Command 'rlServiceStart "ntpd"' (Expected 0, got 0)
:: [   LOG    ] :: Duration: 1s
:: [   LOG    ] :: Assertions: 2 good, 0 bad
:: [   PASS   ] :: RESULT: Setup

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::
:: [   LOG    ] :: Test
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:: [   PASS   ] :: mreadvar command (Expected 0, got 0)
:: [   LOG    ] :: Duration: 2s
:: [   LOG    ] :: Assertions: 1 good, 0 bad
:: [   PASS   ] :: RESULT: Test

Comment 6 errata-xmlrpc 2015-11-19 08:37:42 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHSA-2015-2231.html