#940230 ircd-hybrid: use after free and crash

Package:
ircd-hybrid
Source:
ircd-hybrid
Description:
high-performance secure IRC server
Submitter:
Julien Cristau
Date:
2021-07-31 07:03:03 UTC
Severity:
important
Tags:
#940230#5
Date:
2019-09-14 09:54:53 UTC
From:
To:
Hi,

I just upgraded to buster and ircd keeps crashing.
One case with a segfault in strcmp, other times with glibc aborts.

Running with valgrind shows:

==4562== Invalid read of size 8
==4562==    at 0x127E10: dlinkDelete (list.c:125)
==4562==    by 0x12C7FB: rem_request (res.c:107)
==4562==    by 0x12C7FB: res_readreply (res.c:627)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Address 0xf82e610 is 16 bytes inside a block of size 472 free'd
==4562==    at 0x48369AB: free (vg_replace_malloc.c:530)
==4562==    by 0x12CBAA: rem_request (res.c:108)
==4562==    by 0x12CBAA: delete_resolver_queries (res.c:230)
==4562==    by 0x124610: fd_close (fdlist.c:127)
==4562==    by 0x113653: auth_error (auth.c:235)
==4562==    by 0x1139AD: auth_connect_callback (auth.c:415)
==4562==    by 0x12C7EC: res_readreply (res.c:593)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Block was alloc'd at
==4562==    at 0x4837B65: calloc (vg_replace_malloc.c:752)
==4562==    by 0x1290E0: xcalloc (memory.c:39)
==4562==    by 0x12BF33: make_request (res.c:117)
==4562==    by 0x12C50A: do_query_name (res.c:321)
==4562==    by 0x12EE86: comm_connect_tcp (s_bsd.c:408)
==4562==    by 0x113D59: auth_start_query (auth.c:475)
==4562==    by 0x113D59: auth_start (auth.c:500)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==
==4562== Invalid read of size 8
==4562==    at 0x127E14: dlinkDelete (list.c:125)
==4562==    by 0x12C7FB: rem_request (res.c:107)
==4562==    by 0x12C7FB: res_readreply (res.c:627)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Address 0xf82e608 is 8 bytes inside a block of size 472 free'd
==4562==    at 0x48369AB: free (vg_replace_malloc.c:530)
==4562==    by 0x12CBAA: rem_request (res.c:108)
==4562==    by 0x12CBAA: delete_resolver_queries (res.c:230)
==4562==    by 0x124610: fd_close (fdlist.c:127)
==4562==    by 0x113653: auth_error (auth.c:235)
==4562==    by 0x1139AD: auth_connect_callback (auth.c:415)
==4562==    by 0x12C7EC: res_readreply (res.c:593)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Block was alloc'd at
==4562==    at 0x4837B65: calloc (vg_replace_malloc.c:752)
==4562==    by 0x1290E0: xcalloc (memory.c:39)
==4562==    by 0x12BF33: make_request (res.c:117)
==4562==    by 0x12C50A: do_query_name (res.c:321)
==4562==    by 0x12EE86: comm_connect_tcp (s_bsd.c:408)
==4562==    by 0x113D59: auth_start_query (auth.c:475)
==4562==    by 0x113D59: auth_start (auth.c:500)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==
==4562== Invalid write of size 8
==4562==    at 0x127E2E: dlinkDelete (list.c:142)
==4562==    by 0x12C7FB: rem_request (res.c:107)
==4562==    by 0x12C7FB: res_readreply (res.c:627)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Address 0xf82e610 is 16 bytes inside a block of size 472 free'd
==4562==    at 0x48369AB: free (vg_replace_malloc.c:530)
==4562==    by 0x12CBAA: rem_request (res.c:108)
==4562==    by 0x12CBAA: delete_resolver_queries (res.c:230)
==4562==    by 0x124610: fd_close (fdlist.c:127)
==4562==    by 0x113653: auth_error (auth.c:235)
==4562==    by 0x1139AD: auth_connect_callback (auth.c:415)
==4562==    by 0x12C7EC: res_readreply (res.c:593)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Block was alloc'd at
==4562==    at 0x4837B65: calloc (vg_replace_malloc.c:752)
==4562==    by 0x1290E0: xcalloc (memory.c:39)
==4562==    by 0x12BF33: make_request (res.c:117)
==4562==    by 0x12C50A: do_query_name (res.c:321)
==4562==    by 0x12EE86: comm_connect_tcp (s_bsd.c:408)
==4562==    by 0x113D59: auth_start_query (auth.c:475)
==4562==    by 0x113D59: auth_start (auth.c:500)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==
==4562== Invalid write of size 8
==4562==    at 0x127E36: dlinkDelete (list.c:143)
==4562==    by 0x12C7FB: rem_request (res.c:107)
==4562==    by 0x12C7FB: res_readreply (res.c:627)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Address 0xf82e608 is 8 bytes inside a block of size 472 free'd
==4562==    at 0x48369AB: free (vg_replace_malloc.c:530)
==4562==    by 0x12CBAA: rem_request (res.c:108)
==4562==    by 0x12CBAA: delete_resolver_queries (res.c:230)
==4562==    by 0x124610: fd_close (fdlist.c:127)
==4562==    by 0x113653: auth_error (auth.c:235)
==4562==    by 0x1139AD: auth_connect_callback (auth.c:415)
==4562==    by 0x12C7EC: res_readreply (res.c:593)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Block was alloc'd at
==4562==    at 0x4837B65: calloc (vg_replace_malloc.c:752)
==4562==    by 0x1290E0: xcalloc (memory.c:39)
==4562==    by 0x12BF33: make_request (res.c:117)
==4562==    by 0x12C50A: do_query_name (res.c:321)
==4562==    by 0x12EE86: comm_connect_tcp (s_bsd.c:408)
==4562==    by 0x113D59: auth_start_query (auth.c:475)
==4562==    by 0x113D59: auth_start (auth.c:500)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==
==4562== Invalid free() / delete / delete[] / realloc()
==4562==    at 0x48369AB: free (vg_replace_malloc.c:530)
==4562==    by 0x12C803: rem_request (res.c:108)
==4562==    by 0x12C803: res_readreply (res.c:627)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Address 0xf82e600 is 0 bytes inside a block of size 472 free'd
==4562==    at 0x48369AB: free (vg_replace_malloc.c:530)
==4562==    by 0x12CBAA: rem_request (res.c:108)
==4562==    by 0x12CBAA: delete_resolver_queries (res.c:230)
==4562==    by 0x124610: fd_close (fdlist.c:127)
==4562==    by 0x113653: auth_error (auth.c:235)
==4562==    by 0x1139AD: auth_connect_callback (auth.c:415)
==4562==    by 0x12C7EC: res_readreply (res.c:593)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==  Block was alloc'd at
==4562==    at 0x4837B65: calloc (vg_replace_malloc.c:752)
==4562==    by 0x1290E0: xcalloc (memory.c:39)
==4562==    by 0x12BF33: make_request (res.c:117)
==4562==    by 0x12C50A: do_query_name (res.c:321)
==4562==    by 0x12EE86: comm_connect_tcp (s_bsd.c:408)
==4562==    by 0x113D59: auth_start_query (auth.c:475)
==4562==    by 0x113D59: auth_start (auth.c:500)
==4562==    by 0x12B706: comm_select (s_bsd_epoll.c:153)
==4562==    by 0x11325B: io_loop (ircd.c:181)
==4562==    by 0x11325B: main (ircd.c:491)
==4562==


Cheers,
Julien
#940230#10
Date:
2019-09-15 09:13:20 UTC
From:
To:
Control: tags -1 + moreinfo

Does this happen with a default config file? If not, could you share your
configuration? (feel free to email it to me privately if you don't want
it to be public).

And although I suspect it's not the same problem, could you check whether
you have a dhparam.pem file created where your config file refers to it?
See <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=932774>

Cheers,
Dominic.
#940230#17
Date:
2019-10-12 09:09:34 UTC
From:
To:
Since this only happens under specific circumstances, I'm downgrading
this. I have now received example configuration from Julien, so
will look at this soon to try and pin down the problem.
#940230#22
Date:
2019-10-12 09:09:34 UTC
From:
To:
Since this only happens under specific circumstances, I'm downgrading
this. I have now received example configuration from Julien, so
will look at this soon to try and pin down the problem.
#940230#27
Date:
2021-07-31 07:00:47 UTC
From:
To:
私に戻ってください。
Please get back to me.