seg fault in handle_subagent_set_response

[joeclarkia]

We have built a subagent (using NetSNMP 5.8.dev) and we occasionally see our subagent crash with a seg fault in handle_subagent_set_response. By looking at the disassembly of the core file in gdb, I can tell that the error is in subagent.c at (or very near) line 680:

https://github.com/net-snmp/net-snmp/blob/master/agent/mibgroup/agentx/subagent.c#L680

There are a couple reports online of what is probably the same error:

• https://sourceforge.net/p/net-snmp/bugs/2468/
  -- proposed patch: https://sourceforge.net/p/net-snmp/bugs/_discuss/thread/1fffee9e/d758/attachment/subagent-set-response.patch
• https://sourceforge.net/p/net-snmp/mailman/message/29293701/
• (possible patch) https://code.rdkcentral.com/r/plugins/gitiles/rdkb/components/opensource/ccsp/utilities/+/85bcc84847da950a8afe425cab03c87e3a8cc06e/opensource/patches/net-snmp/03-double_free.patch

Has there been any progress on resolving this issue? The current master code looks fairly similar to our existing code. Apparently none of the available patches have been "blessed" and committed to the main repository. We would very much like to resolve this issue, but we would prefer not to apply "random" patches we find online....

[bvanassche]

A candidate fix has been checked in on the V5.8 and master branches. Please retest.

[joeclarkia]

I tested the candidate fix and it didn't seem to resolve the issue. I believe that in our case retsess is not NULL but is invalid, as indicated by gdb disassembly. Other previous error reports suggest the same thing, with wording like "corrupt" vs "NULL".

Continuing the investigation, I applied the patch linked in the problem statement, and so far that seems to be a solid solution to this problem -- since applying the patch we still have some SNMP unhappiness at high CPU load levels, but the subagent doesn't crash. I'm not sure why the patch was never applied to the net-snmp trunk, but here's my vote that it probably should be...