pkg/46759: net-snmp hangs/CPU races on start for tun and stf interfaces

[jsl%apache.org@localhost]

>Number:         46759
>Category:       pkg
>Synopsis:       net-snmp hangs/CPU races on start for tun and stf interfaces
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Jul 31 01:00:01 +0000 2012
>Originator:     Jason Lingohr
>Release:        NetBSD 5.1.2
>Organization:

>Environment:
        
        
System: NetBSD bastion 5.1.2 NetBSD 5.1.2 (GENERIC) #0: Thu Feb 2 17:22:10 UTC 
2012 
builds%b6.netbsd.org@localhost:/home/builds/ab/netbsd-5-1-2-RELEASE/i386/201202021012Z-obj/home/builds/ab/netbsd-5-1-2-RELEASE/src/sys/arch/i386/compile/GENERIC
 i386
Architecture: i386
Machine: i386
net-snmp-5.6.1.1nb3
>Description:
Since upgrading to 5.1.2, and the same for pkgs, I've noticed that snmpd 
doesn't like tun or stf interfaces.

As soon as I destroy them, snmpd starts and runs fine.  If I destroy, start 
snmpd, then bring them up, the same behaviour occurs.

/usr/pkg/sbin/snmpd:
        -lnetsnmpagent.25 => /usr/pkg/lib/libnetsnmpagent.so.25
        -lnetsnmp.25 => /usr/pkg/lib/libnetsnmp.so.25
        -lc.12 => /usr/lib/libc.so.12
        -lwrap.0 => /usr/lib/libwrap.so.0
        -ldes.7 => /usr/lib/libdes.so.7
        -lnetsnmpmibs.25 => /usr/pkg/lib/libnetsnmpmibs.so.25
        -lkvm.5 => /usr/lib/libkvm.so.5

gdb info:

Reading symbols from /usr/pkg/lib/libnetsnmpagent.so.25...(no debugging symbols 
found)...done.
Loaded symbols for /usr/pkg/lib/libnetsnmpagent.so.25
Reading symbols from /usr/pkg/lib/libnetsnmpmibs.so.25...(no debugging symbols 
found)...done.
Loaded symbols for /usr/pkg/lib/libnetsnmpmibs.so.25
Reading symbols from /usr/pkg/lib/libnetsnmp.so.25...(no debugging symbols 
found)...done.
Loaded symbols for /usr/pkg/lib/libnetsnmp.so.25
Reading symbols from /usr/lib/libwrap.so.0...(no debugging symbols 
found)...done.
Loaded symbols for /usr/lib/libwrap.so.0
Reading symbols from /usr/lib/libkvm.so.5...
(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libkvm.so.5
Reading symbols from /usr/lib/libdes.so.7...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libdes.so.7
Reading symbols from /usr/lib/libc.so.12...(no debugging symbols found)...done.
Loaded symbols for /usr/lib/libc.so.12
Reading symbols from /usr/libexec/ld.elf_so...(no debugging symbols 
found)...done.
Loaded symbols for /usr/libexec/ld.elf_so

Core was generated by `snmpd'.
Program terminated with signal 3, Quit.
#0  0xbbb21b34 in netsnmp_arch_interface_container_load () from 
/usr/pkg/lib/libnetsnmpmibs.so.25
(gdb) bt
#0  0xbbb21b34 in netsnmp_arch_interface_container_load () from 
/usr/pkg/lib/libnetsnmpmibs.so.25
#1  0xbbb186c0 in netsnmp_access_interface_container_load () from 
/usr/pkg/lib/libnetsnmpmibs.so.25
#2  0xbbb1886c in netsnmp_access_interface_init () from 
/usr/pkg/lib/libnetsnmpmibs.so.25
#3  0xbbb22580 in init_mib_modules () from /usr/pkg/lib/libnetsnmpmibs.so.25
#4  0x0804af2b in main ()
(gdb)

This is the ktruss output (the final few lines are a kill -9):

 19461      1 snmpd    pipe()                      = 6, 7
 19461      1 snmpd    gettimeofday(0xbfbfe8f4, 0) = 0
 19461      1 snmpd    __sysctl(0xbfbfe9e0, 0x6, 0, 0xbfbfe9f8, 0, 0) = 0
 19461      1 snmpd    __sysctl(0xbfbfe9e0, 0x6, 0xbb717000, 0xbfbfe9f8, 0, 0) 
= 0
 19461      1 snmpd    __socket30(0x2, 0x2, 0)     = 8
 19461      1 snmpd    ioctl(0x8, SIOCGIFMEDIA, 0xbfbfe8ec) = 0
       
"fxp0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
 19461      1 snmpd    close(0x8)                  = 0
 19461      1 snmpd    __socket30(0x2, 0x2, 0)     = 8
 19461      1 snmpd    ioctl(0x8, SIOCGIFMEDIA, 0xbfbfe8ec) = 0
       
"fxp1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
 19461      1 snmpd    ioctl(0x8, SIOCGIFMEDIA, 0xbfbfe8ec) = 0
       "fxp1\0\0\0\0\0\0\0\0\0\0\0\0 
\0\0\0\0\^F@\M-p\^C\0\0\0&\^FP\0\^E\0\0\0\M-``q\M-;"
 19461      1 snmpd    close(0x8)                  = 0
 19461      1 snmpd    __socket30(0x2, 0x2, 0)     = 8
 19461      1 snmpd    ioctl(0x8, SIOCGIFMEDIA, 0xbfbfe8ec) = 0
       
"fxp2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
 19461      1 snmpd    ioctl(0x8, SIOCGIFMEDIA, 0xbfbfe8ec) = 0
       "fxp2\0\0\0\0\0\0\0\0\0\0\0\0 
\0\0\0\0\^F@\M-p\^A\0\0\0"\^F@\0\^E\0\0\0\M-``q\M-;"
 19461      1 snmpd    close(0x8)                  = 0
 19461      1 snmpd    __socket30(0x2, 0x2, 0)     = 8
 19461      1 snmpd    ioctl(0x8, SIOCGIFMEDIA, 0xbfbfe8ec) = 0
       
"fxp3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
 19461      1 snmpd    ioctl(0x8, SIOCGIFMEDIA, 0xbfbfe8ec) = 0
       "fxp3\0\0\0\0\0\0\0\0\0\0\0\0 
\0\0\0\0\^F@\M-p\0\0\0\0"\0\0\0\^E\0\0\0\M-``q\M-;"
 19461      1 snmpd    close(0x8)                  = 0
 19461      1 snmpd    __socket30(0x2, 0x2, 0)     = 8
 19461      1 snmpd    ioctl(0x8, SIOCGIFMEDIA, 0xbfbfe8ec) Err#22 EINVAL
       
"lo0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
 19461      1 snmpd    close(0x8)                  = 0
 19461      1 snmpd    __socket30(0x2, 0x2, 0)     = 8
 19461      1 snmpd    ioctl(0x8, SIOCGIFMEDIA, 0xbfbfe8ec) Err#22 EINVAL
       
"stf0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
 19461      1 snmpd    close(0x8)                  = 0
 19461      1 snmpd    SIGINT caught handler=0x804a35c mask=0x0 code=0x0
 19461      1 snmpd    setcontext(0xbfbfe638)      JUSTRETURN
 19461      1 snmpd    SIGTERM caught handler=0x804a35c mask=0x0 code=0x0
 19461      1 snmpd    setcontext(0xbfbfe638)      JUSTRETURN
 19461      1 snmpd    SIGKILL SIG_DFL

>How-To-Repeat:
        ifconfig tun0 create, and attempt to start snmpd.
>Fix:
        Unknown.

>Unformatted: