RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 2106194 - radiusd on RHEL8 crashes with GFP after recording "Received conflicting packet"
Summary: radiusd on RHEL8 crashes with GFP after recording "Received conflicting packet"
Keywords:
Status: CLOSED INSUFFICIENT_DATA
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: freeradius
Version: 8.6
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: rc
: ---
Assignee: Antonio Torres
QA Contact: Michal Polovka
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2022-07-12 02:54 UTC by kyoneyama
Modified: 2023-09-06 13:47 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2023-09-06 13:47:25 UTC
Type: Bug
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Issue Tracker FREEIPA-8497 0 None None None 2022-07-12 02:58:53 UTC
Red Hat Issue Tracker RHELPLAN-127440 0 None None None 2022-07-12 02:59:00 UTC

Description kyoneyama 2022-07-12 02:54:32 UTC 
Description of problem:

radiusd on RHEL8 crashes with GFP(General Fault Protection).

  -- messages --
  Jul  6 08:21:34 radm1 kernel: traps: radiusd[2475681] general protection fault ip:55b8bd254b3b sp: 7f9d3f7fde50 error:0 in radiusd[55b8bd21c000+6e000]

  -- var/log/radius/radius.log#1 --
  Jul  6 08:21:33 radm1 radiusd[1626]: (14783804)   Login OK: [s222044] (from client wlc1.xxx.xxx.xxx port 0 via TLS tunnel)
  Jul  6 08:21:33 radm1 radiusd[1626]: Received conflicting packet from client ap-c0205.xxx.xxx.xxx port 32785 - ID: 12 due to unfinished request in module <queue>.  Giving up on old request.
  Jul  6 08:21:33 radm1 radiusd[1626]: (14783808) Login incorrect (eap: EAP requires the State attribute to work, but no State exists in the Access-Request packet.): [L214038] (from client ap-c0205.xxx.xxx.xxx port 26 cli b21fa7bef692)
  Jul  6 08:21:33 radm1 radiusd[1626]: (14783813) Login OK: [s222044] (from client wlc1.xxx.xxx.xxx port 13 cli aa-78-d7-da-8c-60)
  Jul  6 08:21:34 radm1 radiusd[1626]: (14783861)   Login OK: [l214009] (from client wlc1.xxx.xxx.xxx port 0 via TLS tunnel)
  Jul  6 08:21:34 radm1 radiusd[1626]: (14783867) Login OK: [l214009] (from client wlc1.xxx.xxx.xxx port 13 cli 32-32-a0-9e-db-f5)
  Jul  6 09:01:04 radm1 radiusd[2675212]: Core dumps are enabled

  -- var/log/radius/radius.log#2 --
  Jul  7 10:11:05 radm1 radiusd[2675218]: Received conflicting packet from client ap-c0308.xxx.xxx.xxx port 32774 - ID: 17 due to unfinished request in module <queue>.  Giving up on old request.
  Jul  7 10:11:05 radm1 radiusd[2675218]: (2410605)   Login OK: [70233820] (from client wlc1.xxx.xxx.xxx port 0 via TLS tunnel)
  Jul  7 10:11:05 radm1 radiusd[2675218]: (2410604) Login incorrect (eap: EAP requires the State attribute to work, but no State exists in the Access-Request packet.): [s221072] (from client ap-c0308.xxx.xxx.xxx port 58 cli e674fbbd4e09)
  Jul  7 10:11:05 radm1 radiusd[2675218]: (2410609) Login OK: [70233820] (from client wlc1.xxx.xxx.xxx port 13 cli f6-1d-b7-a2-89-5a)
  Jul  7 11:01:03 radm1 radiusd[3080214]: Core dumps are enabled


Debugging shows that the GFP occurs at request_done().
I didn't find any similar cases, so it seems to be a new bug.

  bash-4.4# gdb -q -c core.1626
  :
  Core was generated by `/usr/sbin/radiusd -d /etc/raddb'.
  Program terminated with signal SIGSEGV, Segmentation fault.
  #0  0x000055b8bd254b3b in request_done (request=0x55b8be571c90, action=1) at src/main/process.c:652
  652		if (request->listener &&
  [Current thread is 1 (Thread 0x7f9d3f7fe700 (LWP 2475681))]
  
  (gdb) bt
  #0  0x000055b8bd254b3b in request_done (request=0x55b8be571c90, action=1) at src/main/process.c:652
  #1  0x000055b8bd251482 in request_handler_thread (arg=0x55b8be373c90) at src/main/threads.c:826
  #2  0x00007f9d6e0d31cf in start_thread (arg=<optimized out>) at pthread_create.c:479
  #3  0x00007f9d6d8c7d83 in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95

  (gdb) f 0
  #0  0x000055b8bd254b3b in request_done (request=0x55b8be571c90, action=1) at src/main/process.c:652
  652		if (request->listener &&
  (gdb) p request->listener
  $1 = (rad_listen_t *) 0x9f0df8a550167431
  (gdb) p *request->listener
  Cannot access memory at address 0x9f0df8a550167431



Version-Release number of selected component (if applicable):

- Red Hat Enterprise Linux 8.6
- kernel-4.18.0-372.9.1.el8.x86_64
- freeradius-3.0.20-12.module+el8.6.0+13617+542eca26.x86_64
- glibc-2.28-189.1.el8.x86_64


How reproducible:

- It has occurred twice. 
- I don't know about reproducible.
  In common, "Received conflicting packet" is recorded in radius.log before the occurrence.

  Jul  6 08:21:33 radm1 radiusd[1626]: Received conflicting packet from client ap-c0205.xxx.xxx.xxx port 32785 - ID: 12 due to unfinished request in module <queue>.  Giving up on old request.
  -
  Jul  7 10:11:05 radm1 radiusd[2675218]: Received conflicting packet from client ap-c0308.xxx.xxx.xxx port 32774 - ID: 17 due to unfinished request in module <queue>.  Giving up on old request.


Additional info:

- The customer use anti-virus software(f-secure linux security64) on this system to perform real-time and timed scans.
- They have disabled the security check for radiusd.
Note You need to log in before you can comment on or make changes to this bug.