robertdavidgraham / masscan

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
GNU Affero General Public License v3.0
22.97k stars 3.02k forks source link

Reproducible segmentation fault #778

Open berezhinskiy opened 1 month ago

berezhinskiy commented 1 month ago

Hi, it seems there's a reproducible segmentation fault occurring.

Command:

masscan --wait=0 --open-only --interactive --config ...

Config:

rate = 5000
adapter-port = 60834-61089

ports = U:161,U:123,U:500,U:137,U:111,U:69

range = ...

Output:

Starting masscan 1.3.9-integration (http://bit.ly/14GZzcT) at 2024-05-10 13:55:21 GMT
Initiating SYN Stealth Scan
Scanning 207515 hosts [10 ports/host]

....

30 seconds later:

12: [/lib/x86_64-linux-gnu/libc.so.6(+0x129c3c) [0x7f77d1729c3c]]
?? ??:0
11: [/lib/x86_64-linux-gnu/libc.so.6(+0x9ca94) [0x7f77d169ca94]]
?? ??:0
10: [masscan(+0x19c7a) [0x5d7419ee0c7a]]
?? ??:0
9: [masscan(+0x37780) [0x5d7419efe780]]
?? ??:0
8: [masscan(+0x2d1b5) [0x5d7419ef41b5]]
?? ??:0
7: [masscan(+0x2cb36) [0x5d7419ef3b36]]
?? ??:0
6: [masscan(+0x278e4) [0x5d7419eee8e4]]
?? ??:0
5: [/lib/x86_64-linux-gnu/libc.so.6(+0x8fcb6) [0x7f77d168fcb6]]
?? ??:0
4: [/lib/x86_64-linux-gnu/libc.so.6(+0x6ad98) [0x7f77d166ad98]]
?? ??:0
3: [/lib/x86_64-linux-gnu/libc.so.6(+0x18b75d) [0x7f77d178b75d]]
?? ??:0
2: [/lib/x86_64-linux-gnu/libc.so.6(+0x45320) [0x7f77d1645320]]
?? ??:0
1: [masscan(+0x25b57) [0x5d7419eecb57]]
?? ??:0

If there's any additional info I can provide to help resolve this issue, please let me know. Thank you for your attention to this matter.

berezhinskiy commented 1 month ago

update: I discovered that this issue is only reproduced for port 500/udp

mzpqnxow commented 3 weeks ago

Build from source and run in gdb, and post the stack trace from there

The built-in stack unwinding (the backtrace you included) is better than nothing, but not as good as gdb output

$ git clone ... && cd masscan && make -j
$ sudo gdb bin/masscan
(gdb) r --wait=0 --open-only --interactive --config ...
...
crash
(gdb) 

Then paste the output from:

(gdb) bt
(gdb) i r

If you do that, I'll take a look