CARVIEW |
Navigation Menu
-
-
Notifications
You must be signed in to change notification settings - Fork 397
Description
Unbound crashes due to NULL pointer dereference. This definitely is associated with TCP requests, however my reading of the code says the bug is in the event library and is not specific to TCP.
#3 0x000000080115f531 in comm_point_stop_listening (c=0x801dd0000)
at unbound/util/netevent.c:4107
#4 0x00000008011458fa in tcp_req_info_setup_listen (req=0x801c55100, req@entry=0x1)
at unbound/services/listen_dnsport.c:1941
#5 0x0000000801145aaf in tcp_req_info_handle_readdone (req=<optimized out>)
at unbound/services/listen_dnsport.c:2079
#6 0x00000008011619ca in tcp_callback_reader (c=c@entry=0x801dd0000)
at unbound/util/netevent.c:1168
#7 0x000000080115f8bc in comm_point_tcp_handle_read (fd=fd@entry=0xd, c=c@entry=0x801dd0000, short_ok=short_ok@entry=0x0)
at unbound/util/netevent.c:1758
#8 0x000000080115efe1 in comm_point_tcp_handle_callback (fd=0xd, event=<optimized out>, arg=0x801dd0000)
at unbound/util/netevent.c:2152
#9 0x000000080115348c in handle_select (base=0x801c70780, wait=<optimized out>)
at unbound/util/mini_event.c:220
#10 minievent_base_dispatch (base=0x801c70780) at unbound/util/mini_event.c:242
#11 0x000000000104077a in ub_event_base_dispatch (base=0x801ca10c0)
at unbound/util/ub_event.c:280
#12 0x000000080115ce21 in comm_base_dispatch (b=<optimized out>)
at unbound/util/netevent.c:256
#13 0x000000000104574e in worker_work (worker=<optimized out>)
at unbound/daemon/worker.c:1940
#14 0x0000000001035563 in daemon_fork (daemon=<optimized out>, daemon@entry=0x801c1a000)
at unbound/daemon/daemon.c:701
#15 0x0000000001040d4f in run_daemon (cfgfile=0x7fffffffeef7 "/unbound.conf", cmdline_verbose=0x0, debug_mode=0x0, need_pidfile=0x1)
at unbound/daemon/unbound.c:736
#16 main (argc=<optimized out>, argv=<optimized out>) at unbound/daemon/unbound.c:837
Looking into the node we see it was not removed before, since removed node would have pointers set to <rbtree_null_node>
.
(gdb) frame 0
(gdb) p *to_delete
$16 = {
parent = 0x0,
left = 0x0,
right = 0x0,
key = 0x801ca10c0,
color = 0x0
}
Thus, node was never inserted into the tree.
The node insertion predicate is timeout pointer passed and EV_TIMEOUT flag set in event_add() at mini_event.c:311:
if(tv && (ev->ev_events&EV_TIMEOUT)) {
#ifndef S_SPLINT_S
struct timeval *now = ev->ev_base->time_tv;
ev->ev_timeout.tv_sec = tv->tv_sec + now->tv_sec;
ev->ev_timeout.tv_usec = tv->tv_usec + now->tv_usec;
while(ev->ev_timeout.tv_usec >= 1000000) {
ev->ev_timeout.tv_usec -= 1000000;
ev->ev_timeout.tv_sec++;
}
#endif
(void)rbtree_insert(ev->ev_base->times, &ev->node);
}
The node removal predicate is just the flag, see event_del() at mini_event.c:332.
So potentially we would create offending event if event_add() is ever called with NULL tv. This is possible in netevent.c:4165.
To reproduce
We don't have a reproduce case for this. Happens not so often at a large fleet of machines.
Expected behavior
Not crash!
System:
OS: FreeBSD 14
local-unbound -V
Version 1.13.1
Configure line: --with-ssl=/usr --with-libexpat=/usr --disable-dnscrypt --disable-dnstap --enable-ecdsa --disable-event-api --enable-gost --with-libevent --disable-subnet --disable-tfo-client --disable-tfo-server --with-pthreads--prefix=/usr --localstatedir=/var/unbound --mandir=/usr/share/man --build=freebsd
Linked libs: mini-event internal (it uses select), OpenSSL 1.1.1l-freebsd 24 Aug 2021
Linked modules: dns64 respip validator iterator
BSD licensed, see LICENSE in source package for details.
Report bugs to unbound-bugs@nlnetlabs.nl or https://github.com/NLnetLabs/unbound/issues