Re: misc/57491: dhcpd segfaulting

[Tobias Nygren <tnn%NetBSD.org@localhost>]

The following reply was made to PR misc/57491; it has been noted by GNATS.

From: Tobias Nygren <tnn%NetBSD.org@localhost>
To: gnats-bugs%netbsd.org@localhost
Cc: 
Subject: Re: misc/57491: dhcpd segfaulting
Date: Wed, 26 Jul 2023 16:43:00 +0200

 Better backtrace below.
 The problem is we end up calling isc_timer_destroy() twice
 in the isclib_timer_callback code path. Once here:
 
 https://github.com/NetBSD/src/blob/9b7b03a80b0e9ab376ba074ddc9718702afc059d/external/mpl/dhcp/dist/common/dispatch.c#L186
 
 And then again here:
 
 https://github.com/NetBSD/src/blob/9b7b03a80b0e9ab376ba074ddc9718702afc059d/external/mpl/bind/dist/lib/isc/event.c#L95
 
 via here:
 
 https://github.com/NetBSD/src/blob/9b7b03a80b0e9ab376ba074ddc9718702afc059d/external/mpl/dhcp/dist/common/dispatch.c#L197
 
 I assume this is because event->ev_destroy is now set by libisc
 and thus the dhcpd code needs to be changed to either no longer destroy the timer,
 or it should set the event->ev_destroy to NULL after destroying the timer
 to prevent double destruction.
 
 dhcpd: Error detected by libpthread: Invalid mutex.
 Detected by file "/usr/src/lib/libpthread/pthread_mutex.c", line 207, function "pthread_mutex_lock".
 See pthread(3) for information.
 
 Thread 6 "net-0" received signal SIGABRT, Aborted.
 [Switching to LWP 18354 of process 5889]
 0x0000f2a3c3b4085c in _lwp_kill () from /usr/lib/libc.so.12
 (gdb) bt
 #0  0x0000f2a3c3b4085c in _lwp_kill () from /usr/lib/libc.so.12
 #1  0x0000f2a3c48be1e4 in pthread.errorfunc () from /usr/lib/libpthread.so.1
 #2  0x0000f2a3c48baca4 in pthread_mutex_lock () from /usr/lib/libpthread.so.1
 #3  0x0000f2a3c4ceaf30 in timerevent_destroy (event0=0xf2a3c0908000)
     at /usr/src/external/mpl/bind/lib/libisc/../../dist/lib/isc/timer.c:224
 #4  0x0000f2a3c4d16094 in isc_event_free (eventp=0xf2a3bf5f5800)
     at /usr/src/external/mpl/bind/lib/libisc/../../dist/lib/isc/event.c:95
 #5  0x0000000005577fac in isclib_timer_callback ()
 #6  0x0000f2a3c4d0f734 in task_run (task=0xf2a3c48edcc0)
     at /usr/src/external/mpl/bind/lib/libisc/../../dist/lib/isc/task.c:861
 #7  0x0000f2a3c4d0f9fc in isc_task_run (task=0xf2a3c48edcc0)
 (irrelevant stuff omitted)