Re: Re: bin/59046: dhcpd issue

[6bone%6bone.informatik.uni-leipzig.de@localhost]

With the additional switches, the error occurs immediately after startup. 
The immediate crash is reproducible.

Internet Systems Consortium DHCP Server 4.4.2
Copyright 2004-2022 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/
Config file: /etc/dhcpd6.conf
Database file: /var/db/dhcpd6.leases
PID file: dhcpd6.pid
Wrote 5 NA, 0 TA, 0 PD leases to lease file.
Bound to *:547
Listening on Socket/53/lagg0/2001:638:902:1::/64
Sending on   Socket/53/lagg0/2001:638:902:1::/64
/usr/src/external/mpl/dhcp/bin/server/../../dist/server/mdb6.c(2045): NULL pointer
/usr/src/external/mpl/dhcp/bin/server/../../dist/server/mdb6.c(2074): negative refcnt
/usr/src/external/mpl/dhcp/bin/server/../../dist/server/mdb6.c(2074): freeing unknown memory: 70e1993bb6c0

gdb output:

This GDB was configured as "x86_64--netbsd".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/obj/external/mpl/dhcp/bin/server/dhcpd...
[New process 13930]
[New process 3448]
[New process 26971]
[New process 4688]
[New process 15302]
[New process 11937]
[New process 14605]
[New process 11483]
[New process 21633]
[New process 16858]
[New process 27887]
[New process 22524]
[New process 4051]
Core was generated by `dhcpd'.
Program terminated with signal SIGABRT, Aborted.
#0  0x000070e19677eeea in _lwp_kill () from /usr/lib/libc.so.12
[Current thread is 1 (process 13930)]
#0  0x000070e19677eeea in _lwp_kill () from /usr/lib/libc.so.12
#1  0x000070e1967846e0 in abort () from /usr/lib/libc.so.12
#2  0x000000012d2971f3 in dfree (ptr=<optimized out>, file=<optimized out>,
    line=<optimized out>)
    at /usr/src/external/mpl/dhcp/lib/omapip/../../dist/omapip/alloc.c:169
#3  0x000000012d2536d0 in iasubopt_dereference (
    iasubopt=iasubopt@entry=0x70e1911f57b8,
    file=file@entry=0x12d45c928 "/usr/src/external/mpl/dhcp/bin/server/../../dist/server/mdb6.c", line=line@entry=2074)
    at /usr/src/external/mpl/dhcp/bin/server/../../dist/server/mdb6.c:307
#4  0x000000012d255a0b in cleanup_old_expired (pool=0x70e19b637f80)
    at /usr/src/external/mpl/dhcp/bin/server/../../dist/server/mdb6.c:2074
#5  lease_timeout_support (vpool=0x70e19b637f80)
    at /usr/src/external/mpl/dhcp/bin/server/../../dist/server/mdb6.c:2120
#6  0x000000012d25c79f in isclib_timer_callback (taskp=<optimized out>,
    eventp=<optimized out>)
    at /usr/src/external/mpl/dhcp/lib/common/../../dist/common/dispatch.c:181
#7  0x000000012d42749b in task_run (task=0x70e19b6375a0)
    at /usr/src/external/mpl/dhcp/bind/lib/libisc/../../dist/lib/isc/task.c:861
#8  isc_task_run (task=0x70e19b6375a0)
    at /usr/src/external/mpl/dhcp/bind/lib/libisc/../../dist/lib/isc/task.c:955
#9  0x000000012d41e2c0 in isc__nm_async_task (worker=0x70e19b3b6d90,
    ev0=0x70e198b7b000)
    at /usr/src/external/mpl/dhcp/bind/lib/libisc/../../dist/lib/isc/netmgr/netmgr.c:883
#10 process_netievent (worker=worker@entry=0x70e19b3b6d90,
    ievent=0x70e198b7b000)
    at /usr/src/external/mpl/dhcp/bind/lib/libisc/../../dist/lib/isc/netmgr/netmgr.c:955
#11 0x000000012d41e97e in process_queue (worker=worker@entry=0x70e19b3b6d90,
    type=type@entry=NETIEVENT_TASK)
    at /usr/src/external/mpl/dhcp/bind/lib/libisc/../../dist/lib/isc/netmgr/netmgr.c:1021
#12 0x000000012d41f2ed in process_all_queues (worker=0x70e19b3b6d90)
    at 
/usr/src/external/mpl/dhcp/bind/lib/libisc/../../dist/lib/isc/netmgr/netmgr.c:796
#13 async_cb (handle=0x70e19b3b70c8)
    at /usr/src/external/mpl/dhcp/bind/lib/libisc/../../dist/lib/isc/netmgr/netmgr.c:825
#14 0x000000012d44c32c in ?? ()
#15 0x000000012d44195c in uv.io_poll ()
#16 0x000000012d4499d4 in uv_run ()
#17 0x000000012d41ebee in nm_thread (worker0=0x70e19b3b6d90)
    at /usr/src/external/mpl/dhcp/bind/lib/libisc/../../dist/lib/isc/netmgr/netmgr.c:727
#18 0x000000012d439193 in isc__trampoline_run (arg=0x70e19b66d820)
    at /usr/src/external/mpl/dhcp/bind/lib/libisc/../../dist/lib/isc/trampoline.c:215
#19 0x000070e19ac0c89f in ?? () from /usr/lib/libpthread.so.1
#20 0x000070e1966930e0 in ?? () from /usr/lib/libc.so.12
#21 0x0000000000200000 in ?? ()
#22 0x0000000000000000 in ?? ()


Best Regards
Uwe


On Tue, 11 Feb 2025, Christos Zoulas wrote:

> On 2025-02-11 6:27 am, 6bone%6bone.informatik.uni-leipzig.de@localhost wrote:
>
> Seems to be dying elsewhere now (in mdb6.c). So something is corrupting 
> memory.
> This code is just too complicated. Lets try to build with all the memory 
> debugging
> it provides to see if it can detect the problem itself. Can you build with:
> -DDEBUG_MEMORY_LEAKAGE) -DDEBUG_MALLOC_POOL) -DDEBUG_MEMORY_LEAKAGE_ON_EXIT 
> -DDEBUG_MALLOC_POOL_EXHAUSTIVELY
>
> and see if that get's us somewhere? If that does not work, we could try 
> -fsanitize=memory...
>
> christos