[LBBS-119] module.c: Use after free when unloading modules with recursive dependents

← All Issues || New Issue →

Sort Normal || Priority

Details

[2025-09-22 23:00:05.293]   DEBUG[43742]: module.c:900 unload_dependencies: Adding mod_smtp_greylisting.so to unload list, since it depends on net_smtp.so
[2025-09-22 23:00:05.293]   DEBUG[43742]: module.c:900 unload_dependencies: Adding mod_smtp_mailing_lists.so to unload list, since it depends on net_smtp.so
[2025-09-22 23:00:05.294]   DEBUG[43742]: module.c:900 unload_dependencies: Adding mod_smtp_recipient_monitor.so to unload list, since it depends on net_smtp.so
[2025-09-22 23:00:05.294]   DEBUG[43742]: module.c:900 unload_dependencies: Adding mod_spamassassin.so to unload list, since it depends on net_smtp.so
[2025-09-22 23:00:05.310]    -- Unloading mod_spamassassin.so, since it depends on net_smtp.so
[2025-09-22 23:00:05.310]   DEBUG[43742]: module.c:993 unload_resource_nolock: Module mod_spamassassin.so has use count 0 (force: 0)
[2025-09-22 23:00:05.310]   DEBUG[43742]: module.c:1032 unload_resource_nolock: Unloading mod_spamassassin.so
[2025-09-22 23:00:05.310]   DEBUG[43742]: module.c:347 logged_dlclose: dlclose: mod_spamassassin
[2025-09-22 23:00:05.323]  === Unregistering module mod_spamassassin
[2025-09-22 23:00:05.385]    -- Unloading mod_smtp_recipient_monitor.so, since it depends on net_smtp.so
[2025-09-22 23:00:05.385]   DEBUG[43742]: module.c:993 unload_resource_nolock: Module mod_smtp_recipient_monitor.so has use count 0 (force: 0)
[2025-09-22 23:00:05.385]   DEBUG[43742]: module.c:1032 unload_resource_nolock: Unloading mod_smtp_recipient_monitor.so
[2025-09-22 23:00:05.385]   DEBUG[43742]: module.c:347 logged_dlclose: dlclose: mod_smtp_recipient_monitor
[2025-09-22 23:00:05.385]  === Unregistering module mod_smtp_recipient_monitor
[2025-09-22 23:00:05.386]    -- Unloading mod_smtp_mailing_lists.so, since it depends on net_smtp.so
[2025-09-22 23:00:05.386]   DEBUG[43742]: module.c:993 unload_resource_nolock: Module mod_smtp_mailing_lists.so has use count 0 (force: 0)
[2025-09-22 23:00:05.386]   DEBUG[43742]: module.c:1032 unload_resource_nolock: Unloading mod_smtp_mailing_lists.so
[2025-09-22 23:00:05.386]   DEBUG[43742]: module.c:347 logged_dlclose: dlclose: mod_smtp_mailing_lists
[2025-09-22 23:00:05.387]  === Unregistering module mod_smtp_mailing_lists
[2025-09-22 23:00:05.390]    -- Unloading mod_smtp_greylisting.so, since it depends on net_smtp.so
[2025-09-22 23:00:05.390]   DEBUG[43742]: module.c:993 unload_resource_nolock: Module mod_smtp_greylisting.so has use count 0 (force: 0)
[2025-09-22 23:00:05.390]   DEBUG[43742]: module.c:1032 unload_resource_nolock: Unloading mod_smtp_greylisting.so
[2025-09-22 23:00:05.391]   DEBUG[43742]: module.c:347 logged_dlclose: dlclose: mod_smtp_greylisting
[2025-09-22 23:00:05.391]  === Unregistering module mod_smtp_greylisting
[2025-09-22 23:00:05.391]    -- Unloading mod_smtp_filter_spf.so, since it depends on net_smtp.so
[2025-09-22 23:00:05.391]   DEBUG[43742]: module.c:993 unload_resource_nolock: Module mod_smtp_filter_spf.so has use count 0 (force: 0)
[2025-09-22 23:00:05.391]   DEBUG[43742]: module.c:1032 unload_resource_nolock: Unloading mod_smtp_filter_spf.so
[2025-09-22 23:00:05.392]   DEBUG[43742]: module.c:347 logged_dlclose: dlclose: mod_smtp_filter_spf
[2025-09-22 23:00:05.392]  === Unregistering module mod_smtp_filter_spf
[2025-09-22 23:00:05.394]    -- Unloading mod_smtp_filter_dkim.so, since it depends on net_smtp.so
[2025-09-22 23:00:05.394]   DEBUG[43742]: module.c:993 unload_resource_nolock: Module mod_smtp_filter_dkim.so has use count 1 (force: 0)
[2025-09-22 23:00:05.394]   DEBUG[43742]: module.c:900 unload_dependencies: Adding mod_smtp_filter_arc.so to unload list, since it depends on mod_smtp_filter_dkim.so
[2025-09-22 23:00:05.394]    -- Unloading mod_smtp_filter_arc.so, since it depends on mod_smtp_filter_dkim.so
[2025-09-22 23:00:05.394]   DEBUG[43742]: module.c:993 unload_resource_nolock: Module mod_smtp_filter_arc.so has use count 0 (force: 0)
[2025-09-22 23:00:05.394]   DEBUG[43742]: module.c:1032 unload_resource_nolock: Unloading mod_smtp_filter_arc.so
[2025-09-22 23:00:05.395]   DEBUG[43742]: module.c:347 logged_dlclose: dlclose: mod_smtp_filter_arc
[2025-09-22 23:00:05.395]  === Unregistering module mod_smtp_filter_arc
[2025-09-22 23:00:05.396]   DEBUG[43742]: module.c:1032 unload_resource_nolock: Unloading mod_smtp_filter_dkim.so
[2025-09-22 23:00:05.397]   DEBUG[43742]: module.c:347 logged_dlclose: dlclose: mod_smtp_filter_dkim
[2025-09-22 23:00:05.397]  === Unregistering module mod_smtp_filter_dkim
[2025-09-22 23:00:05.403]    -- Unloading mod_smtp_filter_arc.so, since it depends on net_smtp.so
[2025-09-22 23:00:05.403]   DEBUG[43742]: module.c:993 unload_resource_nolock: Module mod_smtp_filter_arc.so has use count 0 (force: 0)
[2025-09-22 23:00:05.403]   DEBUG[43742]: module.c:1032 unload_resource_nolock: Unloading mod_smtp_filter_arc.so
Segmentation fault (core dumped)

Thread 1 (Thread 0x7fd4f4ff96c0 (LWP 80551)):
#0  __unload_module (mod=0x55ecbc8af990) at module.c:984
#1  0x000055ec975bbe14 in unload_resource_nolock (mod=0x55ecbc8af990, force=0, usecount=0x7fd4f4ff846c, removed=0x0) at module.c:1033
#2  0x000055ec975bb692 in unload_dependencies (mod=0x55ecbc8538c0, force=0, removed=0x0) at module.c:925
#3  0x000055ec975bbcb8 in unload_resource_nolock (mod=0x55ecbc8538c0, force=0, usecount=0x7fd4f4ff85c4, removed=0x0) at module.c:1015
#4  0x000055ec975bbfc2 in unload_resource (resource_name=0x7fd4f4ff87b7 "net_smtp", force=0, removed=0x0) at module.c:1062
#5  0x000055ec975bcf51 in bbs_module_unload (name=0x7fd4f4ff87b7 "net_smtp") at module.c:1329
        res = 32724

[2025-09-23 20:42:55.064]  === Unregistering module mod_smtp_filter_dkim
==80640== Thread 13:
==80640== Invalid read of size 1
==80640==    at 0x4847782: strlen (vg_replace_strmem.c:494)
==80640==    by 0x4F12257: __vfprintf_internal (vfprintf-process-arg.c:397)
==80640==    by 0x4F32757: __vsnprintf_internal (vsnprintf.c:114)
==80640==    by 0x13552C: __bbs_log (logger.c:508)
==80640==    by 0x13E66D: unload_dependencies (module.c:924)
==80640==    by 0x13ECB7: unload_resource_nolock (module.c:1015)
==80640==    by 0x13EFC1: unload_resource (module.c:1062)
==80640==    by 0x13FF50: bbs_module_unload (module.c:1329)
==80640==    by 0x140C89: threadsafe_unload (module.c:1607)
==80640==    by 0x140D28: cli_unload (module.c:1623)
==80640==    by 0x120016: bbs_cli_exec (cli.c:223)
==80640==    by 0xD22387B: sysop_command (mod_sysop.c:204)
==80640==  Address 0x62621c0 is 208 bytes inside a block of size 231 free'd
==80640==    at 0x484417B: free (vg_replace_malloc.c:872)
==80640==    by 0x13C010: free_module (module.c:132)
==80640==    by 0x13C309: bbs_module_unregister (module.c:187)
==80640==    by 0xCF2002F: __unreg_module (mod_smtp_filter_arc.c:321)
==80640==    by 0x4001129: _dl_call_fini (dl-call_fini.c:43)
==80640==    by 0x5003273: _dl_catch_exception (dl-error-skeleton.c:182)
==80640==    by 0x40017C0: _dl_close_worker (dl-close.c:253)
==80640==    by 0x4002025: _dl_close (dl-close.c:778)
==80640==    by 0x5003219: _dl_catch_exception (dl-error-skeleton.c:208)
==80640==    by 0x50032CE: _dl_catch_error (dl-error-skeleton.c:227)
==80640==    by 0x4F38FA6: _dlerror_run (dlerror.c:138)
==80640==    by 0x4F38D05: dlclose@@GLIBC_2.34 (dlclose.c:31)
==80640==  Block was alloc'd at
==80640==    at 0x48465EF: calloc (vg_replace_malloc.c:1328)
==80640==    by 0x116734: __bbs_calloc (alloc.c:83)
==80640==    by 0x13CEB4: load_dlopen (module.c:380)
==80640==    by 0x13D2B2: load_dynamic_module (module.c:458)
==80640==    by 0x13E18F: load_resource (module.c:802)
==80640==    by 0x13F3A1: do_autoload_module (module.c:1135)
==80640==    by 0x13FBB6: try_autoload_modules (module.c:1268)
==80640==    by 0x141692: load_modules (module.c:1865)
==80640==    by 0x11EF74: main (bbs.c:1216)
...

Comments

You must be logged in to leave a comment.