amd64/106604: saslauthd crashes with signal 6 on FreeBSD 6.2-PRERELEASE #1: Sat Dec 2 AMD64

[Timur Khanjanov]

>Number:         106604
>Category:       amd64
>Synopsis:       saslauthd crashes with signal 6 on FreeBSD  6.2-PRERELEASE #1: Sat Dec  2  AMD64
>Confidential:   no
>Severity:       serious
>Priority:       low
>Responsible:    freebsd-amd64
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Mon Dec 11 11:30:03 GMT 2006
>Closed-Date:
>Last-Modified:
>Originator:     Timur Khanjanov
>Release:        FreeBSD  6.2-PRERELEASE #1: Sat Dec  2  AMD64
>Organization:
Intrans
>Environment:
FreeBSD mailer.intrans.baku.az 6.2-PRERELEASE FreeBSD 6.2-PRERELEASE #1: Sat Dec  2 17:03:52 AZT 2006     intel at mailer.intrans.baku.az:/usr/obj/usr/src/sys/SMP  amd64

>Description:
Good time of day

I have a problem with saslauthd "cyrus-sasl-saslauthd-2.1.22"
sometimes it began to core dump on signal 6
ps -ax| grep saslauthd at such  moments show something like this

58015  ??  D      0:06.27 /usr/local/sbin/saslauthd -n 25 -a pam -r (25
times)

and testsaslauthd answer - connection refused
if I run saslauthd again -new copy answer correctly , but old still in
in "disk (or other short term, uninterruptible) wait." about halfhour
until it finished - disk load shown by gstat utility is about 100%
and system is slow in reaction

saslauthd authorized through pam using pam_tacplus from distribution
(slightly modified to prevent authorizaton without password)
and pam-pgsql 0,6,3 from ports

I've recompiled saslauthd with debugging support
and tried to recognize what wrong but without success
backtrace is here

gdb saslauthd saslauthd.core
GNU gdb 6.1.1 [FreeBSD]
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain
conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB.  Type "show warranty" for details.
This GDB was configured as "amd64-marcel-freebsd"...
Core was generated by `saslauthd'.
Program terminated with signal 6, Aborted.
Reading symbols from /usr/lib/libgssapi.so.8...done.
Loaded symbols for /usr/lib/libgssapi.so.8
Reading symbols from /usr/lib/libkrb5.so.8...done.
Loaded symbols for /usr/lib/libkrb5.so.8
Reading symbols from /usr/lib/libasn1.so.8...done.
Loaded symbols for /usr/lib/libasn1.so.8
Reading symbols from /lib/libcrypto.so.4...done.
Loaded symbols for /lib/libcrypto.so.4
Reading symbols from /usr/lib/libroken.so.8...done.
Loaded symbols for /usr/lib/libroken.so.8
Reading symbols from /lib/libcrypt.so.3...done.
Loaded symbols for /lib/libcrypt.so.3
Reading symbols from /usr/lib/libcom_err.so.3...done.
Loaded symbols for /usr/lib/libcom_err.so.3
Reading symbols from /usr/lib/libpam.so.3...done.
Loaded symbols for /usr/lib/libpam.so.3
Reading symbols from /lib/libc.so.6...done.
Loaded symbols for /lib/libc.so.6
Reading symbols from /usr/lib/pam_pgsql.so...done.
Loaded symbols for /usr/lib/pam_pgsql.so
Reading symbols from /usr/local/lib/libpq.so.4...done.
Loaded symbols for /usr/local/lib/libpq.so.4
Reading symbols from /usr/local/lib/libmhash.so.2...done.
Loaded symbols for /usr/local/lib/libmhash.so.2
Reading symbols from /usr/local/lib/libintl.so.6...done.
Loaded symbols for /usr/local/lib/libintl.so.6
Reading symbols from /usr/lib/libssl.so.4...done.
Loaded symbols for /usr/lib/libssl.so.4
Reading symbols from /lib/libpthread.so.2...done.
Loaded symbols for /lib/libpthread.so.2
Reading symbols from /usr/local/lib/libiconv.so.3...done.
Loaded symbols for /usr/local/lib/libiconv.so.3
Reading symbols from /libexec/ld-elf.so.1...done.
Loaded symbols for /libexec/ld-elf.so.1
#0  0x00000008011012bc in kill () from /lib/libc.so.6
[New LWP 100628]
(gdb) bt
#0  0x00000008011012bc in kill () from /lib/libc.so.6
#1  0x000000080110014d in abort () from /lib/libc.so.6
#2  0x00000008017f2125 in pthread_testcancel () from /lib/libpthread.so.2
#3  0x00000008017ee48d in pthread_setconcurrency () from
/lib/libpthread.so.2
#4  0x00000008017f2b46 in __error () from /lib/libpthread.so.2
#5  0x00000008017d8b66 in ?? () from /lib/libpthread.so.2
#6  0x0000000000514380 in ?? ()
#7  0x0000000800514cfd in _rtld_error () from /libexec/ld-elf.so.1
#8  0x0000000800517c5d in dlopen () from /libexec/ld-elf.so.1
#9  0x0000000800f2fc2b in openpam_dynamic () from /usr/lib/libpam.so.3
#10 0x0000000800f2f836 in openpam_load_module () from /usr/lib/libpam.so.3
#11 0x0000000800f2eaba in openpam_dispatch () from /usr/lib/libpam.so.3
#12 0x0000000800f2e85e in openpam_dispatch () from /usr/lib/libpam.so.3
#13 0x0000000800f2e9f8 in openpam_dispatch () from /usr/lib/libpam.so.3
#14 0x0000000800f2e85e in openpam_dispatch () from /usr/lib/libpam.so.3
#15 0x0000000800f2ed03 in openpam_configure () from /usr/lib/libpam.so.3
#16 0x0000000800f2cd86 in pam_start () from /usr/lib/libpam.so.3
#17 0x0000000000403133 in auth_pam (login=0x9d84 <Address 0x9d84 out of
bounds>, password=0x6 <Address 0x6 out of bounds>,
    service=0xffffffff80870e00 <Address 0xffffffff80870e00 out of
bounds>, realm=0x8011012dc "r\001&#65533;H\213\rB]\022") at auth_pam.c:207

here is suspicios place address 0xffffffff80870e00 looks like result
of conversion 32->64bit with sign extension
unfortunately, I can't exactly find where

#18 0x0000000000407028 in do_auth (_login=0x9d84 <Address 0x9d84 out of
bounds>, password=0x7fffffffeaf0 "VALUEISHIDDEN", service=0x7fffffffe9e0
"pop",
    realm=0x7fffffffe8d0 "mail.az") at saslauthd-main.c:399
#19 0x0000000000406b5b in do_request (conn_fd=5) at ipc_unix.c:426
#20 0x0000000000406e79 in ipc_loop () at ipc_unix.c:277
#21 0x0000000000408301 in main (argc=6, argv=0x13) at saslauthd-main.c:358
(gdb)


if it'll helps I can send coredump (it about 700k in bzip2) to you

Sincerely yours
	Timur

>How-To-Repeat:

>Fix:
workaround - restart saslauthd after beginning of problem
using monitoring software (like daedalus)
>Release-Note:
>Audit-Trail:
>Unformatted: