[Pkg-net-snmp-devel] Bug#403614: snmpd segfaults on amd64 when a XEN domU is being restarted

[Ingo Juergensmann]

Package: snmpd
Version: 5.2.3-4
Severity: important


snmpd segfaults when a Xen VM (domU) is being restarted, started or stopped,
or in short: when something changed in the networking interfaces:

Dec 18 12:59:01 s15222724 kernel: xenbr0: topology change detected, propagating
Dec 18 12:59:01 s15222724 kernel: xenbr0: port 2(vif20.0) entering forwarding state
Dec 18 12:59:02 s15222724 kernel: xenbr1: topology change detected, propagating
Dec 18 12:59:02 s15222724 kernel: xenbr1: port 1(vif20.1) entering forwarding state
Dec 18 12:59:14 s15222724 dhclient: DHCPREQUEST on xenbr0 to 87.106.14.xx port 67
Dec 18 12:59:23 s15222724 dhclient: DHCPREQUEST on xenbr0 to 87.106.14.xx port 67
Dec 18 12:59:32 s15222724 kernel: snmpd[25314]: segfault at 0000000000000038 rip 00002af761008127 rsp 00007
fff49c4dce0 error 4


Strace gives some more information:

13456 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 13
13456 ioctl(13, SIOCGIFCONF, {120, {{"lo", {AF_INET,
inet_addr("127.0.0.1")}}, {"xenbr0", {AF_INET, inet_addr("87.106.23.xx")}},
{"xenbr1", {AF_INET, inet_addr("192.168.102.1")}}}}) = 0
13456 ioctl(13, SIOCGIFCONF, {120, {{"lo", {AF_INET,
inet_addr("127.0.0.1")}}, {"xenbr0", {AF_INET, inet_addr("87.106.23.xx")}},
{"xenbr1", {AF_INET, inet_addr("192.168.102.1")}}}}) = 0
13456 ioctl(13, SIOCGIFINDEX, {ifr_name="lo", ifr_index=1}) = 0
13456 ioctl(13, SIOCGIFFLAGS, {ifr_name="lo",
ifr_flags=IFF_UP|IFF_LOOPBACK|IFF_RUNNING}) = 0
13456 ioctl(13, SIOCGIFINDEX, {ifr_name="xenbr0", ifr_index=3}) = 0
13456 ioctl(13, SIOCGIFFLAGS, {ifr_name="xenbr0",
ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0
13456 ioctl(13, SIOCGIFINDEX, {ifr_name="xenbr1", ifr_index=4}) = 0
13456 ioctl(13, SIOCGIFFLAGS, {ifr_name="xenbr1",
ifr_flags=IFF_UP|IFF_BROADCAST|IFF_RUNNING|IFF_MULTICAST}) = 0
13456 close(13)                         = 0
13456 open("/proc/net/if_inet6", O_RDONLY) = 13
13456 fstat(13, {st_mode=S_IFREG|0444, st_size=0, ...}) = 0
13456 mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1,
0) = 0x2b742904a000
13456 read(13, "00000000000000000000000000000001"..., 1024) = 432
13456 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 14
13456 ioctl(14, SIOCGIFINDEX, {ifr_name="lo", ifr_index=1}) = 0
13456 close(14)                         = 0
13456 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 14
13456 ioctl(14, SIOCGIFINDEX, {ifr_name="vif19.1", ifr_index=55}) = 0
13456 close(14)                         = 0
13456 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 14
13456 ioctl(14, SIOCGIFINDEX, {ifr_name="vif19.0", ifr_index=54}) = 0
13456 close(14)                         = 0
13456 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 14
13456 ioctl(14, SIOCGIFINDEX, {ifr_name="vif11.1", ifr_index=35}) = 0
13456 close(14)                         = 0
13456 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 14
13456 ioctl(14, SIOCGIFINDEX, {ifr_name="vif11.0", ifr_index=34}) = 0
13456 close(14)                         = 0
13456 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 14
13456 ioctl(14, SIOCGIFINDEX, {ifr_name="xenbr1", ifr_index=4}) = 0
13456 close(14)                         = 0
13456 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 14
13456 ioctl(14, SIOCGIFINDEX, {ifr_name="xenbr0", ifr_index=3}) = 0
13456 close(14)                         = 0
13456 socket(PF_INET, SOCK_DGRAM, IPPROTO_IP) = 14
13456 ioctl(14, SIOCGIFINDEX, {ifr_name="eth0", ifr_index=2}) = 0
13456 close(14)                         = 0
13456 read(13, "", 1024)                = 0
13456 close(13)                         = 0
13456 munmap(0x2b742904a000, 4096)      = 0
13456 gettimeofday({1166445715, 103523}, NULL) = 0
13456 --- SIGSEGV (Segmentation fault) @ 0 (0) ---


This causes for example nagios as a monitoring software for our servers and
VMs sort of useless, because it causes false alerts (to some degree). 
I don't know whether this is caused by Xen or not... 

Addition: a short test on another Xen box (i386) shows the same behaviour,
so this doesn't seem to be restricted to amd64.

Regards, 
Ingo

-- System Information:
Debian Release: 4.0
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.18-2-xen-amd64
Locale: LANG=C, LC_CTYPE=C (charmap=ANSI_X3.4-1968)

Versions of packages snmpd depends on:
ii  adduser                      3.100       Add and remove users and groups
ii  debconf                      1.5.8       Debian configuration management sy
ii  libc6                        2.3.6.ds1-8 GNU C Library: Shared libraries
ii  libsensors3                  1:2.10.1-2  library to read temperature/voltag
ii  libsnmp9                     5.2.3-4     NET SNMP (Simple Network Managemen
ii  libwrap0                     7.6.dbs-11  Wietse Venema's TCP wrappers libra

snmpd recommends no packages.

-- debconf information:
  snmpd/upgradefrom36:
  snmpd/upgradefrom521: