Skip site navigation (1)Skip section navigation (2)
Date:      Tue, 27 Oct 2015 16:28:01 -0700
From:      Doug Hardie <bc979@lafn.org>
To:        Arthur Chance <freebsd@qeng-ho.org>
Cc:        Matthew Seaman <matthew@freebsd.org>, freebsd-questions@freebsd.org
Subject:   Re: ntpd crashing after update
Message-ID:  <9BA003EB-815B-44C8-8DE7-554BD51D98AC@lafn.org>
In-Reply-To: <562F982E.1090007@qeng-ho.org>
References:  <562F38D5.40107@qeng-ho.org> <562F55AD.7020405@freebsd.org> <562F6CAB.8030205@qeng-ho.org> <562F982E.1090007@qeng-ho.org>

next in thread | previous in thread | raw e-mail | index | archive | help

> On 27 October 2015, at 08:28, Arthur Chance <freebsd@qeng-ho.org> =
wrote:
>=20
> On 27/10/2015 12:23, Arthur Chance wrote:
>> On 27/10/2015 10:45, Matthew Seaman wrote:
>>> On 10/27/15 08:41, Arthur Chance wrote:
>>>> I updated my systems yesterday in response to FreeBSD-SA-15:25.ntp, =
and
>>>> now ntpd crashes on SEGV, but only on 2 out of 3 of the machines =
running
>>>> it. I have no idea whether it's relevant, but the one that doesn't =
crash
>>>> is the only one with source installed. Anyone else seeing this?
>>>=20
>>> Yes -- I've seen that on the one machine I've tried to update so =
far.
>>> ntpd crashes for me after freebsd-update(8).
>>>=20
>>> Anecdotal evidence is that rebooting apparently causes the updated =
ntpd
>>> to function normally.  I'd be interested in hearing if people can
>>> confirm that, because it means there is system state somehow =
carrying
>>> over from one invocation of ntpd to another.
>>=20
>> I can confirm that it worked for me. I rebooted the two problem =
machines
>> and ntpd started OK. However, the ntpds on both rebooted machines =
appear
>> not to be talking to the other machine which initially appeared to =
have
>> no problem - ntpq -p shows it as in .INIT. state and unreachable on =
the
>> rebooted machines and it sees the other machines as in INIT and
>> unreachable. I can't reboot the final machine until later today, but
>> restarting ntpd on it without rebooting has no effect. I'll get back =
to
>> you after I've had a chance to reboot it.
>>=20
>> For reference
>>=20
>> freebsd-version -ku
>> 10.2-RELEASE
>> 10.2-RELEASE-p6
>>=20
>> on all three machines, all updated with freebsd-update, and all had
>> "service ntpd restart" done after the update.
>>=20
>>> There's a thread on freebsd-security@.... -- seems there's also a
>>> problem with the ntpq and ntpdc utilities.
>>=20
>> ntpq worked fine on all my machines, even before the reboots.
>>=20
>=20
> Another data point. On one of the machines I rebooted, ntpq -p was =
reporting slightly strange values so I tried using "service ntpd =
restart", and ntpd crashed immediately on restart with a SEGV. Only =
rebooting let it work again.
>=20
> There's definitely something dodgy with the latest version of ntpd, so =
I've used freebsd-update rollback to revert to the old one, which works =
fine. One strange thing after rollback was that a service restart spat =
out the PID twice as in
>=20
> root@fileserver:0# service ntpd restart
> Stopping ntpd.
> Waiting for PIDS: 670, 670.
> Starting ntpd.
>=20
>=20
> I'm fairly certain I'm not vulnerable to the problems in the Security =
Advisory, so I'll wait until the problem has been sorted to (re)upgrade.
>=20

I am running several 9.3 systems:

FreeBSD mail 9.3-RELEASE-p24 FreeBSD 9.3-RELEASE-p24 #0: Sat Aug 22 =
01:54:44 UTC 2015     =
root@amd64-builder.daemonology.net:/usr/obj/usr/src/sys/GENERIC  amd64

They were all rebooted after the last upgrade and ntpd seems to be =
working fine.  Nagios reports very low offsets.  However ntpdc crashes =
on all:

mail# ntpdc
=
/usr/src/usr.sbin/ntp/libntp/../../../contrib/ntp/lib/isc/unix/net.c:221: =
fatal error: RUNTIME_CHECK(((pthread_once((&once), (initialize_action)) =
=3D=3D 0) ? 0 : 34) =3D=3D 0) failed
Abort (core dumped)

Rebooting doesn=E2=80=99t help with ntpdc.  ntpq also crashes with the =
same message:

mail# ntpq
=
/usr/src/usr.sbin/ntp/libntp/../../../contrib/ntp/lib/isc/unix/net.c:221: =
fatal error: RUNTIME_CHECK(((pthread_once((&once), (initialize_action)) =
=3D=3D 0) ? 0 : 34) =3D=3D 0) failed
Abort (core dumped)






Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?9BA003EB-815B-44C8-8DE7-554BD51D98AC>