ntpd crashing after update

[Doug Hardie]

> On 27 October 2015, at 08:28, Arthur Chance <freebsd at qeng-ho.org> wrote:
> 
> On 27/10/2015 12:23, Arthur Chance wrote:
>> On 27/10/2015 10:45, Matthew Seaman wrote:
>>> On 10/27/15 08:41, Arthur Chance wrote:
>>>> I updated my systems yesterday in response to FreeBSD-SA-15:25.ntp, and
>>>> now ntpd crashes on SEGV, but only on 2 out of 3 of the machines running
>>>> it. I have no idea whether it's relevant, but the one that doesn't crash
>>>> is the only one with source installed. Anyone else seeing this?
>>> 
>>> Yes -- I've seen that on the one machine I've tried to update so far.
>>> ntpd crashes for me after freebsd-update(8).
>>> 
>>> Anecdotal evidence is that rebooting apparently causes the updated ntpd
>>> to function normally.  I'd be interested in hearing if people can
>>> confirm that, because it means there is system state somehow carrying
>>> over from one invocation of ntpd to another.
>> 
>> I can confirm that it worked for me. I rebooted the two problem machines
>> and ntpd started OK. However, the ntpds on both rebooted machines appear
>> not to be talking to the other machine which initially appeared to have
>> no problem - ntpq -p shows it as in .INIT. state and unreachable on the
>> rebooted machines and it sees the other machines as in INIT and
>> unreachable. I can't reboot the final machine until later today, but
>> restarting ntpd on it without rebooting has no effect. I'll get back to
>> you after I've had a chance to reboot it.
>> 
>> For reference
>> 
>> freebsd-version -ku
>> 10.2-RELEASE
>> 10.2-RELEASE-p6
>> 
>> on all three machines, all updated with freebsd-update, and all had
>> "service ntpd restart" done after the update.
>> 
>>> There's a thread on freebsd-security at .... -- seems there's also a
>>> problem with the ntpq and ntpdc utilities.
>> 
>> ntpq worked fine on all my machines, even before the reboots.
>> 
> 
> Another data point. On one of the machines I rebooted, ntpq -p was reporting slightly strange values so I tried using "service ntpd restart", and ntpd crashed immediately on restart with a SEGV. Only rebooting let it work again.
> 
> There's definitely something dodgy with the latest version of ntpd, so I've used freebsd-update rollback to revert to the old one, which works fine. One strange thing after rollback was that a service restart spat out the PID twice as in
> 
> root at fileserver:0# service ntpd restart
> Stopping ntpd.
> Waiting for PIDS: 670, 670.
> Starting ntpd.
> 
> 
> I'm fairly certain I'm not vulnerable to the problems in the Security Advisory, so I'll wait until the problem has been sorted to (re)upgrade.
> 

I am running several 9.3 systems:

FreeBSD mail 9.3-RELEASE-p24 FreeBSD 9.3-RELEASE-p24 #0: Sat Aug 22 01:54:44 UTC 2015     root at amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

They were all rebooted after the last upgrade and ntpd seems to be working fine.  Nagios reports very low offsets.  However ntpdc crashes on all:

mail# ntpdc
/usr/src/usr.sbin/ntp/libntp/../../../contrib/ntp/lib/isc/unix/net.c:221: fatal error: RUNTIME_CHECK(((pthread_once((&once), (initialize_action)) == 0) ? 0 : 34) == 0) failed
Abort (core dumped)

Rebooting doesn’t help with ntpdc.  ntpq also crashes with the same message:

mail# ntpq
/usr/src/usr.sbin/ntp/libntp/../../../contrib/ntp/lib/isc/unix/net.c:221: fatal error: RUNTIME_CHECK(((pthread_once((&once), (initialize_action)) == 0) ? 0 : 34) == 0) failed
Abort (core dumped)