Skip to content

Connect callback calling bug in TLS stream

While working on c6d215b1, a new ThreadSanitizer error and crash has happened:

==================
WARNING: ThreadSanitizer: heap-use-after-free (pid=3475979)
  Read of size 4 at 0x7b4c001c1500 by thread T291:
    #0 isc__nmhandle_detach /home/ondrej/Projects/bind9/lib/isc/netmgr/netmgr.c:1035:2 (libisc-9.19.12-dev.so+0x1ee74) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #1 tls_senddone /home/ondrej/Projects/bind9/lib/isc/netmgr/tlsstream.c:191:3 (libisc-9.19.12-dev.so+0x40bed) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #2 isc___nm_sendcb /home/ondrej/Projects/bind9/lib/isc/netmgr/netmgr.c:1910:2 (libisc-9.19.12-dev.so+0x249cb) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #3 <null> <null> (libuv.so.1+0x168a0) (BuildId: 7f7f8c148150666c7b116bf98bf6e27f96c697a9)
    #4 loop_thread /home/ondrej/Projects/bind9/lib/isc/loop.c:299:2 (libisc-9.19.12-dev.so+0x743e0) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #5 isc__trampoline_run /home/ondrej/Projects/bind9/lib/isc/trampoline.c:202:11 (libisc-9.19.12-dev.so+0xa7cce) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)

  Previous write of size 8 at 0x7b4c001c1500 by thread T291:
    #0 free <null> (tls_test+0x44e285) (BuildId: 0a4db467257a69fefc960e3385738e8f478c2a73)
    #1 sdallocx /home/ondrej/Projects/bind9/lib/isc/./jemalloc_shim.h:80:2 (libisc-9.19.12-dev.so+0x803fa) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #2 mem_put /home/ondrej/Projects/bind9/lib/isc/mem.c:326:2 (libisc-9.19.12-dev.so+0x79ca6) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #3 isc__mem_put /home/ondrej/Projects/bind9/lib/isc/mem.c:684:2 (libisc-9.19.12-dev.so+0x7ac23) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #4 nmhandle_free /home/ondrej/Projects/bind9/lib/isc/netmgr/netmgr.c:972:2 (libisc-9.19.12-dev.so+0x2818f) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #5 nmhandle_destroy /home/ondrej/Projects/bind9/lib/isc/netmgr/netmgr.c:1008:2 (libisc-9.19.12-dev.so+0x1f5d2) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #6 isc__nmhandle_detach /home/ondrej/Projects/bind9/lib/isc/netmgr/netmgr.c:1047:3 (libisc-9.19.12-dev.so+0x1efe1) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #7 connect_send_cb /home/ondrej/Projects/bind9/tests/isc/netmgr_common.c:293:2 (tls_test+0x4d8b80) (BuildId: 0a4db467257a69fefc960e3385738e8f478c2a73)
    #8 tls_senddone /home/ondrej/Projects/bind9/lib/isc/netmgr/tlsstream.c:190:3 (libisc-9.19.12-dev.so+0x40be4) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #9 isc___nm_sendcb /home/ondrej/Projects/bind9/lib/isc/netmgr/netmgr.c:1910:2 (libisc-9.19.12-dev.so+0x249cb) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #10 <null> <null> (libuv.so.1+0x168a0) (BuildId: 7f7f8c148150666c7b116bf98bf6e27f96c697a9)
    #11 loop_thread /home/ondrej/Projects/bind9/lib/isc/loop.c:299:2 (libisc-9.19.12-dev.so+0x743e0) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)

  Thread T291 'isc-loop-0003' (tid=3476621, running) created by main thread at:
    #0 pthread_create <null> (tls_test+0x44f85b) (BuildId: 0a4db467257a69fefc960e3385738e8f478c2a73)
    #1 isc_thread_create /home/ondrej/Projects/bind9/lib/isc/thread.c:70:8 (libisc-9.19.12-dev.so+0x9c00e) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #2 isc_loopmgr_run /home/ondrej/Projects/bind9/lib/isc/loop.c:478:3 (libisc-9.19.12-dev.so+0x741d4) (BuildId: a03629bc4ef7d953712229d3b234a56784137779)
    #3 run_test_tls_recv_send_quota /home/ondrej/Projects/bind9/tests/isc/tls_test.c:88:1 (tls_test+0x4d7547) (BuildId: 0a4db467257a69fefc960e3385738e8f478c2a73)

SUMMARY: ThreadSanitizer: heap-use-after-free /home/ondrej/Projects/bind9/lib/isc/netmgr/netmgr.c:1035:2 in isc__nmhandle_detach
==================

I've uploaded the systemctl dump to: ondrej@bikeshed.isc.org:/data/shared/sweng/ondrej

To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information