postscreen seqfaults with abusix rbl

[Benny Pedersen-2]

Oct  5 17:01:09 localhost kernel: postscreen[387]: segfault at 0 ip
00007f78d9773cea sp 00007ffeb1cb0960 error 4 in
libpostfix-util.so[7f78d9759000+29000]
Oct  5 17:09:51 localhost kernel: postscreen[1310]: segfault at 0 ip
00007f372355dcea sp 00007fff7569b520 error 4 in
libpostfix-util.so[7f3723543000+29000]
Oct  5 17:18:20 localhost kernel: postscreen[11822]: segfault at 0 ip
00007f4a3e9bfcea sp 00007ffea70b09c0 error 4 in
libpostfix-util.so[7f4a3e9a5000+29000]
Oct  5 17:19:57 localhost kernel: postscreen[20595]: segfault at 0 ip
00007fe15ba10cea sp 00007ffc68250090 error 4 in
libpostfix-util.so[7fe15b9f6000+29000]
Oct  5 17:21:38 localhost kernel: postscreen[11930]: segfault at 0 ip
00007fdf1de1fcea sp 00007ffffdfc02c0 error 4 in
libpostfix-util.so[7fdf1de05000+29000]
Oct  5 17:22:14 localhost kernel: postscreen[16126]: segfault at 0 ip
00007f69bc4ddcea sp 00007ffeab170220 error 4 in
libpostfix-util.so[7f69bc4c3000+29000]
Oct  5 17:22:20 localhost kernel: postscreen[16138]: segfault at 0 ip
00007f7c9db76cea sp 00007ffc3e818b70 error 4 in
libpostfix-util.so[7f7c9db5c000+29000]
Oct  5 17:27:18 localhost kernel: postscreen[22685]: segfault at 0 ip
00007f027d5a8cea sp 00007ffc70a1b5f0 error 4 in
libpostfix-util.so[7f027d58e000+29000]
Oct  5 17:28:36 localhost kernel: postscreen[22746]: segfault at 0 ip
00007fd00d9f2cea sp 00007fffb5133e70 error 4 in
libpostfix-util.so[7fd00d9d8000+29000]
Oct  5 17:28:36 localhost kernel: postscreen[22752]: segfault at 0 ip
00007f15ed50ecea sp 00007fff054e0ea0 error 4 in
libpostfix-util.so[7f15ed4f4000+29000]
Oct  5 17:29:10 localhost kernel: postscreen[22764]: segfault at 0 ip
00007fbcf74becea sp 00007ffc1c2a6840 error 4 in
libpostfix-util.so[7fbcf74a4000+29000]
Oct  5 17:29:16 localhost kernel: postscreen[22767]: segfault at 0 ip
00007f2c802b1cea sp 00007ffd9c3d28f0 error 4 in
libpostfix-util.so[7f2c80297000+29000]
Oct  5 17:30:02 localhost kernel: postscreen[22771]: segfault at 0 ip
00007f388bc98cea sp 00007ffc372ca850 error 4 in
libpostfix-util.so[7f388bc7e000+29000]

both with postfix 3.5.6 and 3.5.7 on gentoo

removed:

postscreen_dnsbl_reply_map =
texthash:/etc/postfix/postscreen_dnsbl_reply_map
postscreen_dnsbl_sites = APIKEY.combined.mail.abusix.zone

that removed the seqfaults

kernel is 5.4.66, dont know if thats related to my problem, is other
seen that problem ?

[Wietse Venema]

Benny Pedersen:

> Oct  5 17:01:09 localhost kernel: postscreen[387]: segfault at 0 ip
> 00007f78d9773cea sp 00007ffeb1cb0960 error 4 in
> libpostfix-util.so[7f78d9759000+29000]
> Oct  5 17:09:51 localhost kernel: postscreen[1310]: segfault at 0 ip
> 00007f372355dcea sp 00007fff7569b520 error 4 in
> libpostfix-util.so[7f3723543000+29000]
> Oct  5 17:18:20 localhost kernel: postscreen[11822]: segfault at 0 ip
> 00007f4a3e9bfcea sp 00007ffea70b09c0 error 4 in
> libpostfix-util.so[7f4a3e9a5000+29000]
> Oct  5 17:19:57 localhost kernel: postscreen[20595]: segfault at 0 ip
> 00007fe15ba10cea sp 00007ffc68250090 error 4 in
> libpostfix-util.so[7fe15b9f6000+29000]
> Oct  5 17:21:38 localhost kernel: postscreen[11930]: segfault at 0 ip
> 00007fdf1de1fcea sp 00007ffffdfc02c0 error 4 in
> libpostfix-util.so[7fdf1de05000+29000]
> Oct  5 17:22:14 localhost kernel: postscreen[16126]: segfault at 0 ip
> 00007f69bc4ddcea sp 00007ffeab170220 error 4 in
> libpostfix-util.so[7f69bc4c3000+29000]
> Oct  5 17:22:20 localhost kernel: postscreen[16138]: segfault at 0 ip
> 00007f7c9db76cea sp 00007ffc3e818b70 error 4 in
> libpostfix-util.so[7f7c9db5c000+29000]
> Oct  5 17:27:18 localhost kernel: postscreen[22685]: segfault at 0 ip
> 00007f027d5a8cea sp 00007ffc70a1b5f0 error 4 in
> libpostfix-util.so[7f027d58e000+29000]
> Oct  5 17:28:36 localhost kernel: postscreen[22746]: segfault at 0 ip
> 00007fd00d9f2cea sp 00007fffb5133e70 error 4 in
> libpostfix-util.so[7fd00d9d8000+29000]
> Oct  5 17:28:36 localhost kernel: postscreen[22752]: segfault at 0 ip
> 00007f15ed50ecea sp 00007fff054e0ea0 error 4 in
> libpostfix-util.so[7f15ed4f4000+29000]
> Oct  5 17:29:10 localhost kernel: postscreen[22764]: segfault at 0 ip
> 00007fbcf74becea sp 00007ffc1c2a6840 error 4 in
> libpostfix-util.so[7fbcf74a4000+29000]
> Oct  5 17:29:16 localhost kernel: postscreen[22767]: segfault at 0 ip
> 00007f2c802b1cea sp 00007ffd9c3d28f0 error 4 in
> libpostfix-util.so[7f2c80297000+29000]
> Oct  5 17:30:02 localhost kernel: postscreen[22771]: segfault at 0 ip
> 00007f388bc98cea sp 00007ffc372ca850 error 4 in
> libpostfix-util.so[7f388bc7e000+29000]
>
> both with postfix 3.5.6 and 3.5.7 on gentoo
>
> removed:
>
> postscreen_dnsbl_reply_map =
> texthash:/etc/postfix/postscreen_dnsbl_reply_map
> postscreen_dnsbl_sites = APIKEY.combined.mail.abusix.zone
>
> that removed the seqfaults
>
> kernel is 5.4.66, dont know if thats related to my problem, is other
> seen that problem ?

Support for postscreen_dnsbl_* not changed in years. You can try
to attack a debugger as in http://www.postfix.org/DEBUG_README.html,
to find out what function(s) are active at the time.

        Wietse

[John Fawcett]

On 05/10/2020 22:19, Wietse Venema wrote:

> Benny Pedersen:
>> Oct  5 17:01:09 localhost kernel: postscreen[387]: segfault at 0 ip
>> 00007f78d9773cea sp 00007ffeb1cb0960 error 4 in
>> libpostfix-util.so[7f78d9759000+29000]
>> Oct  5 17:09:51 localhost kernel: postscreen[1310]: segfault at 0 ip
>> 00007f372355dcea sp 00007fff7569b520 error 4 in
>> libpostfix-util.so[7f3723543000+29000]
>> Oct  5 17:18:20 localhost kernel: postscreen[11822]: segfault at 0 ip
>> 00007f4a3e9bfcea sp 00007ffea70b09c0 error 4 in
>> libpostfix-util.so[7f4a3e9a5000+29000]
>> Oct  5 17:19:57 localhost kernel: postscreen[20595]: segfault at 0 ip
>> 00007fe15ba10cea sp 00007ffc68250090 error 4 in
>> libpostfix-util.so[7fe15b9f6000+29000]
>> Oct  5 17:21:38 localhost kernel: postscreen[11930]: segfault at 0 ip
>> 00007fdf1de1fcea sp 00007ffffdfc02c0 error 4 in
>> libpostfix-util.so[7fdf1de05000+29000]
>> Oct  5 17:22:14 localhost kernel: postscreen[16126]: segfault at 0 ip
>> 00007f69bc4ddcea sp 00007ffeab170220 error 4 in
>> libpostfix-util.so[7f69bc4c3000+29000]
>> Oct  5 17:22:20 localhost kernel: postscreen[16138]: segfault at 0 ip
>> 00007f7c9db76cea sp 00007ffc3e818b70 error 4 in
>> libpostfix-util.so[7f7c9db5c000+29000]
>> Oct  5 17:27:18 localhost kernel: postscreen[22685]: segfault at 0 ip
>> 00007f027d5a8cea sp 00007ffc70a1b5f0 error 4 in
>> libpostfix-util.so[7f027d58e000+29000]
>> Oct  5 17:28:36 localhost kernel: postscreen[22746]: segfault at 0 ip
>> 00007fd00d9f2cea sp 00007fffb5133e70 error 4 in
>> libpostfix-util.so[7fd00d9d8000+29000]
>> Oct  5 17:28:36 localhost kernel: postscreen[22752]: segfault at 0 ip
>> 00007f15ed50ecea sp 00007fff054e0ea0 error 4 in
>> libpostfix-util.so[7f15ed4f4000+29000]
>> Oct  5 17:29:10 localhost kernel: postscreen[22764]: segfault at 0 ip
>> 00007fbcf74becea sp 00007ffc1c2a6840 error 4 in
>> libpostfix-util.so[7fbcf74a4000+29000]
>> Oct  5 17:29:16 localhost kernel: postscreen[22767]: segfault at 0 ip
>> 00007f2c802b1cea sp 00007ffd9c3d28f0 error 4 in
>> libpostfix-util.so[7f2c80297000+29000]
>> Oct  5 17:30:02 localhost kernel: postscreen[22771]: segfault at 0 ip
>> 00007f388bc98cea sp 00007ffc372ca850 error 4 in
>> libpostfix-util.so[7f388bc7e000+29000]
>>
>> both with postfix 3.5.6 and 3.5.7 on gentoo
>>
>> removed:
>>
>> postscreen_dnsbl_reply_map =
>> texthash:/etc/postfix/postscreen_dnsbl_reply_map
>> postscreen_dnsbl_sites = APIKEY.combined.mail.abusix.zone
>>
>> that removed the seqfaults
>>
>> kernel is 5.4.66, dont know if thats related to my problem, is other
>> seen that problem ?
> Support for postscreen_dnsbl_* not changed in years. You can try
> to attack a debugger as in http://www.postfix.org/DEBUG_README.html,
> to find out what function(s) are active at the time.
>
> Wietse

Hi

maybe just a wild guess... but looking at the code in dict_thash.c is
this guaranteed to return something not null?

        dict = dict_open3(DICT_TYPE_HT, path, open_flags, dict_flags);

If it ever returns null, it would likely produce a segfault later on.

John

[Wietse Venema]

John Fawcett:

> >> Oct  5 17:30:02 localhost kernel: postscreen[22771]: segfault at 0 ip
> >> 00007f388bc98cea sp 00007ffc372ca850 error 4 in
> >> libpostfix-util.so[7f388bc7e000+29000]
> >>
> >> both with postfix 3.5.6 and 3.5.7 on gentoo
> >>
> >> removed:
> >>
> >> postscreen_dnsbl_reply_map =
> >> texthash:/etc/postfix/postscreen_dnsbl_reply_map
> >> postscreen_dnsbl_sites = APIKEY.combined.mail.abusix.zone
> >>
> >> that removed the seqfaults
> >>
> >> kernel is 5.4.66, dont know if thats related to my problem, is other
> >> seen that problem ?
> > Support for postscreen_dnsbl_* not changed in years. You can try
> > to attack a debugger as in http://www.postfix.org/DEBUG_README.html,
> > to find out what function(s) are active at the time.
> >
> > Wietse
>
> Hi
>
> maybe just a wild guess... but looking at the code in dict_thash.c is
> this guaranteed to return something not null?
>
> ??????? dict = dict_open3(DICT_TYPE_HT, path, open_flags, dict_flags);
>
> If it ever returns null, it would likely produce a segfault later on.

dict_open never returns null. In case of error, a dictionary
terminates with a fatal error, or it returns a "surrogate" dictionary
that returns errors for all requests.

        Wietse

[John Fawcett]

On 05/10/2020 23:18, John Fawcett wrote:

> On 05/10/2020 22:19, Wietse Venema wrote:
>> Benny Pedersen:
>>> Oct  5 17:01:09 localhost kernel: postscreen[387]: segfault at 0 ip
>>> 00007f78d9773cea sp 00007ffeb1cb0960 error 4 in
>>> libpostfix-util.so[7f78d9759000+29000]
>>> Oct  5 17:09:51 localhost kernel: postscreen[1310]: segfault at 0 ip
>>> 00007f372355dcea sp 00007fff7569b520 error 4 in
>>> libpostfix-util.so[7f3723543000+29000]
>>> Oct  5 17:18:20 localhost kernel: postscreen[11822]: segfault at 0 ip
>>> 00007f4a3e9bfcea sp 00007ffea70b09c0 error 4 in
>>> libpostfix-util.so[7f4a3e9a5000+29000]
>>> Oct  5 17:19:57 localhost kernel: postscreen[20595]: segfault at 0 ip
>>> 00007fe15ba10cea sp 00007ffc68250090 error 4 in
>>> libpostfix-util.so[7fe15b9f6000+29000]
>>> Oct  5 17:21:38 localhost kernel: postscreen[11930]: segfault at 0 ip
>>> 00007fdf1de1fcea sp 00007ffffdfc02c0 error 4 in
>>> libpostfix-util.so[7fdf1de05000+29000]
>>> Oct  5 17:22:14 localhost kernel: postscreen[16126]: segfault at 0 ip
>>> 00007f69bc4ddcea sp 00007ffeab170220 error 4 in
>>> libpostfix-util.so[7f69bc4c3000+29000]
>>> Oct  5 17:22:20 localhost kernel: postscreen[16138]: segfault at 0 ip
>>> 00007f7c9db76cea sp 00007ffc3e818b70 error 4 in
>>> libpostfix-util.so[7f7c9db5c000+29000]
>>> Oct  5 17:27:18 localhost kernel: postscreen[22685]: segfault at 0 ip
>>> 00007f027d5a8cea sp 00007ffc70a1b5f0 error 4 in
>>> libpostfix-util.so[7f027d58e000+29000]
>>> Oct  5 17:28:36 localhost kernel: postscreen[22746]: segfault at 0 ip
>>> 00007fd00d9f2cea sp 00007fffb5133e70 error 4 in
>>> libpostfix-util.so[7fd00d9d8000+29000]
>>> Oct  5 17:28:36 localhost kernel: postscreen[22752]: segfault at 0 ip
>>> 00007f15ed50ecea sp 00007fff054e0ea0 error 4 in
>>> libpostfix-util.so[7f15ed4f4000+29000]
>>> Oct  5 17:29:10 localhost kernel: postscreen[22764]: segfault at 0 ip
>>> 00007fbcf74becea sp 00007ffc1c2a6840 error 4 in
>>> libpostfix-util.so[7fbcf74a4000+29000]
>>> Oct  5 17:29:16 localhost kernel: postscreen[22767]: segfault at 0 ip
>>> 00007f2c802b1cea sp 00007ffd9c3d28f0 error 4 in
>>> libpostfix-util.so[7f2c80297000+29000]
>>> Oct  5 17:30:02 localhost kernel: postscreen[22771]: segfault at 0 ip
>>> 00007f388bc98cea sp 00007ffc372ca850 error 4 in
>>> libpostfix-util.so[7f388bc7e000+29000]
>>>
>>> both with postfix 3.5.6 and 3.5.7 on gentoo
>>>
>>> removed:
>>>
>>> postscreen_dnsbl_reply_map =
>>> texthash:/etc/postfix/postscreen_dnsbl_reply_map
>>> postscreen_dnsbl_sites = APIKEY.combined.mail.abusix.zone
>>>
>>> that removed the seqfaults
>>>
>>> kernel is 5.4.66, dont know if thats related to my problem, is other
>>> seen that problem ?
>> Support for postscreen_dnsbl_* not changed in years. You can try
>> to attack a debugger as in http://www.postfix.org/DEBUG_README.html,
>> to find out what function(s) are active at the time.
>>
>> Wietse
> Hi
>
> maybe just a wild guess... but looking at the code in dict_thash.c is
> this guaranteed to return something not null?
>
>         dict = dict_open3(DICT_TYPE_HT, path, open_flags, dict_flags);
>
> If it ever returns null, it would likely produce a segfault later on.
>
> John
>

Actually to be more precise: is it guaranteed to return not null and
with all the function pointers in the returned dict struct also not
null. I'm adding this because I think it does always return something
not null, but I'm not sure that the function pointers are always not
null. There's a condition that sometimes does not define update and
delete in dict_surrogate.c

   if (open_flags & O_RDWR) {
        dp->dict.update = dict_surrogate_update;
        dp->dict.delete = dict_surrogate_delete;
    }

Not sure if that helps, but just an idea.

John

John

[Wietse Venema]

John Fawcett:

> Actually to be more precise: is it guaranteed to return not null and
> with all the function pointers in the returned dict struct also not
> null. I'm adding this because I think it does always return something
> not null, but I'm not sure that the function pointers are always not
> null. There's a condition that sometimes does not define update and
> delete in dict_surrogate.c
>
> ?? if (open_flags & O_RDWR) {
> ??????? dp->dict.update = dict_surrogate_update;
> ??????? dp->dict.delete = dict_surrogate_delete;
> ??? }
>
> Not sure if that helps, but just an idea.

Those function pointer are initialized by dict_alloc() as pointers
to function that say "you cannot do this".

        Wietse

[John Fawcett]

On 06/10/2020 00:05, Wietse Venema wrote:

> John Fawcett:
>> Actually to be more precise: is it guaranteed to return not null and
>> with all the function pointers in the returned dict struct also not
>> null. I'm adding this because I think it does always return something
>> not null, but I'm not sure that the function pointers are always not
>> null. There's a condition that sometimes does not define update and
>> delete in dict_surrogate.c
>>
>> ?? if (open_flags & O_RDWR) {
>> ??????? dp->dict.update = dict_surrogate_update;
>> ??????? dp->dict.delete = dict_surrogate_delete;
>> ??? }
>>
>> Not sure if that helps, but just an idea.
> Those function pointer are initialized by dict_alloc() as pointers
> to function that say "you cannot do this".
>
> Wietse

It all looks safe for code paths that pass through dict_surrogate but
also for cases that don't. Not a problem in text hash tables then.
Waiting to see what the core dump throws up.

John