Bug 1366282
| Summary: | Double free or corruption when use net-snmp snmp_sess_open() with several threads | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | glad08 | ||||
| Component: | net-snmp | Assignee: | Josef Ridky <jridky> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> | ||||
| Severity: | unspecified | Docs Contact: | |||||
| Priority: | unspecified | ||||||
| Version: | 23 | CC: | glad08, jsafrane, thozza | ||||
| Target Milestone: | --- | ||||||
| Target Release: | --- | ||||||
| Hardware: | Unspecified | ||||||
| OS: | Unspecified | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | net-snmp-5.7.3-13.fc24 net-snmp-5.7.3-13.fc25 net-snmp-5.7.3-13.fc23 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2016-08-18 21:19:00 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Attachments: |
|
||||||
Created attachment 1190062 [details]
patch
It seems it has already been fixed upstream in these two patches: https://sourceforge.net/p/net-snmp/code/ci/315a9dfeddbad9c611833c9625d6c1c6d7c38324/ https://sourceforge.net/p/net-snmp/code/ci/d27ccfba26840ef8446152c007557ca4daa45a8f/ Do you have an application that's failing? All Net-SNMP users in Fedora so far were single-threaded and nobody really cared about this error. Yes, there is such application written by company where I work. net-snmp-5.7.3-13.fc24 has been submitted as an update to Fedora 24. https://bodhi.fedoraproject.org/updates/FEDORA-2016-eefcc589e9 net-snmp-5.7.3-13.fc25 has been submitted as an update to Fedora 25. https://bodhi.fedoraproject.org/updates/FEDORA-2016-3cdb928af6 net-snmp-5.7.3-13.fc23 has been submitted as an update to Fedora 23. https://bodhi.fedoraproject.org/updates/FEDORA-2016-9b778487e2 net-snmp-5.7.3-13.fc25 has been pushed to the Fedora 25 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-3cdb928af6 net-snmp-5.7.3-13.fc24 has been pushed to the Fedora 24 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-eefcc589e9 net-snmp-5.7.3-13.fc23 has been pushed to the Fedora 23 testing repository. If problems still persist, please make note of it in this bug report. See https://fedoraproject.org/wiki/QA:Updates_Testing for instructions on how to install test updates. You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2016-9b778487e2 net-snmp-5.7.3-13.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report. net-snmp-5.7.3-13.fc25 has been pushed to the Fedora 25 stable repository. If problems still persist, please make note of it in this bug report. And what about fedora 23 stable repository? Fedora 23 version just stuck in Bodhi. Will be available in stable in few hours. net-snmp-5.7.3-13.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. |
Description of problem: There is some chance to get free() error while calling snmp_sess_open() from several threads. Version-Release number of selected component (if applicable): net-snmp-5.7.3 How reproducible: Steps to Reproduce: 1. 2. 3. Actual results: Core was generated by `./snmpv3poller'. Program terminated with signal SIGABRT, Aborted. #0 0x00007febf36faa28 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 55 return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig); [Current thread is 1 (Thread 0x7fea4cf39700 (LWP 19055))] (gdb) bt #0 0x00007febf36faa28 in __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:55 #1 0x00007febf36fc62a in __GI_abort () at abort.c:89 #2 0x00007febf373dd7a in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7febf3850300 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/posix/libc_fatal.c:175 #3 0x00007febf37461ca in malloc_printerr (ar_ptr=<optimized out>, ptr=<optimized out>, str=0x7febf3850378 "free(): invalid next size (fast)", action=3) at malloc.c:5004 #4 _int_free (av=<optimized out>, p=<optimized out>, have_lock=<optimized out>) at malloc.c:3865 #5 0x00007febf374972c in __GI___libc_free (mem=mem@entry=0x7fea000019f0) at malloc.c:2966 #6 0x00007febf4e92b80 in netsnmp_tdomain_transport_full (application=application@entry=0x7febf4ec2ea6 "snmp", str=0x7fea00001380 "192.168.2.251:161", local=0, default_domain=default_domain@entry=0x7febf4ebeaba "udp,udp6", default_target=0x0) at snmp_transport.c:671 #7 0x00007febf4e5bbc3 in _sess_open (in_session=0x7fea4cf38870) at snmp_api.c:1562 #8 snmp_sess_open (pss=pss@entry=0x7fea4cf38870) at snmp_api.c:1784 Expected results: Additional info: