named crash in tcp test on shutdown in delete_trace_entry()
See the failed tcp
test here: https://gitlab.isc.org/isc-projects/bind9/-/jobs/2724884
D:tcp:--------------------------------------------------------------------------------
D:tcp:Core was generated by `/builds/isc-projects/bind9/bin/named/.libs/lt-named -D tcp-ns1 -X named.lock -m'.
D:tcp:Program terminated with signal SIGABRT, Aborted.
D:tcp:#0 delete_trace_entry (mctx=mctx@entry=0x7fe54d7ea000, ptr=<optimized out>, size=<optimized out>, file=file@entry=0x7fe54f0734fd "message.c", line=line@entry=2577) at mem.c:315
D:tcp:315 dl = ISC_LIST_NEXT(dl, link);
D:tcp:[Current thread is 1 (LWP 1980)]
D:tcp:#0 delete_trace_entry (mctx=mctx@entry=0x7fe54d7ea000, ptr=<optimized out>, size=<optimized out>, file=file@entry=0x7fe54f0734fd "message.c", line=line@entry=2577) at mem.c:315
D:tcp:#1 0x00007fe54f115fc2 in isc__mempool_put (mpctx=0x7fe5243ac720, mem=mem@entry=0x7fe5245eb680, file=file@entry=0x7fe54f0734fd "message.c", line=line@entry=2577) at mem.c:1332
D:tcp:#2 0x00007fe54ef32a00 in dns_message_puttempname (msg=msg@entry=0x7fe5245eac80, itemp=itemp@entry=0x7ffc11dc59c0) at message.c:2577
D:tcp:#3 0x00007fe54ef32d6e in msgresetnames (msg=msg@entry=0x7fe5245eac80, first_section=first_section@entry=0) at message.c:461
D:tcp:#4 0x00007fe54ef33068 in msgreset (msg=msg@entry=0x7fe5245eac80, everything=everything@entry=false) at message.c:532
D:tcp:#5 0x00007fe54ef33cac in dns_message_reset (msg=0x7fe5245eac80, intent=intent@entry=1) at message.c:759
D:tcp:#6 0x00007fe54ee67b7f in ns_client_endrequest (client=0x7fe524621000) at client.c:264
D:tcp:#7 ns__client_reset_cb (client0=0x7fe524621000) at client.c:1631
D:tcp:#8 0x00007fe54f0ee9b9 in nmhandle_detach_cb (handlep=handlep@entry=0x7fe5245afa40) at netmgr/netmgr.c:1264
D:tcp:#9 0x00007fe54f0efc09 in isc__nm_async_detach (ev0=0x7fe5245afa00, worker=0x7fe54dc7c000) at netmgr/netmgr.c:2272
D:tcp:#10 process_netievent (arg=0x7fe5245afa00) at netmgr/netmgr.c:501
D:tcp:#11 0x00007fe54f10abc8 in isc__job_cb (idle=0x7fe5490e43c8) at job.c:75
D:tcp:#12 0x00007fe54e9f0cd1 in uv.run_idle () from /usr/lib/libuv.so.1
D:tcp:#13 0x00007fe54e9eb105 in uv_run () from /usr/lib/libuv.so.1
D:tcp:#14 0x00007fe54f110f3e in loop_run (loop=0x7fe54dc48900) at loop.c:266
D:tcp:#15 loop_thread (arg=0x7fe54dc48900) at loop.c:293
D:tcp:#16 0x00007fe54f1120d5 in isc_loopmgr_run (loopmgr=0x7fe54dc45000) at loop.c:473
D:tcp:#17 0x000055f580bc1a78 in main (argc=16, argv=0x7ffc11dc5ed8) at main.c:1441
D:tcp:--------------------------------------------------------------------------------
It crashed on line 315
in mem.c:delete_trace_entry()
(see below), called by mem.c:isc__mempool_put()
.
307. dl = ISC_LIST_HEAD(mctx->debuglist[idx]);
308. while (dl != NULL) {
309. if (dl->ptr == ptr) {
310. ISC_LIST_UNLINK(mctx->debuglist[idx], dl, link);
311. decrement_malloced(mctx, sizeof(*dl));
312. sdallocx(dl, sizeof(*dl), 0);
313. goto unlock;
314. }
315. dl = ISC_LIST_NEXT(dl, link);
316. }
Which means that dl
became invalid while iterating through the loop, which, I think, means that the memory context was destroyed.
I think this can be fixed by adding an attach and detach pair to the memory context in isc__mempool_create()
and isc__mempool_destroy()
functions respectively.
After a visual inspection, I think v9.16 is also affected.
Edited by Arаm Sаrgsyаn