SIGSEGV on FreeBSD with version 1.13.0

[kapfenho]

With version 1.13.0 I got a segmentation violation (sorry, no core file). That's the first time, after years of stability.

Last messages:

Dec 14 01:03:59 <daemon.notice> homer unbound[72482]: [72482:0] notice: sendto failed: Permission denied  
Dec 14 01:03:59 <kern.info> homer kernel: pid 72482 (unbound), jid 0, uid 59: exited on signal 11  

System:

FreeBSD homer 12.2-RELEASE-p1 FreeBSD 12.2-RELEASE-p1 GENERIC  amd64

Unbound config (using IPv4 & IPv6):

server:
        verbosity: 1
        statistics-interval: 3600
        interface: ::1
        interface: ...
        interface-automatic: yes
        outgoing-interface: ...
        access-control: ... allow
        root-hints: "/usr/local/etc/unbound/root.hints"
        hide-identity: yes
        hide-version: yes
        harden-algo-downgrade: yes
        auto-trust-anchor-file: "/usr/local/etc/unbound/root.key"
remote-control:
        control-enable: yes
        control-interface: 127.0.0.1

[rozhuk-im]

Crash for me too, build from sources: TFOCL, TFOSE, THREADS options is set.

[kapfenho]

Options here: ECDSA GOST LIBEVENT THREADS

[emikulic]

Some debugging and backtraces in https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251821

[delphij]

I think this was caused by commit 15e8f5c .

The problem is that the logging code really expects a valid addr pointer, and now in udp_connect case it's no longer true.

I think this would stop unbound from crashing for the FreeBSD case:

diff --git a/services/outside_network.c b/services/outside_network.c
index 0886907f..e2843573 100644
--- a/services/outside_network.c
+++ b/services/outside_network.c
@@ -1901,6 +1901,9 @@ randomize_and_send_udp(struct pending* pend, sldns_buffer* packet, int timeout)
 	/* send it over the commlink */
 	if(outnet->udp_connect) {
 		if(!comm_point_send_udp_msg(pend->pc->cp, packet, NULL, 0)) {
+			log_addr(VERB_OPS, "remote address is",
+				(struct sockaddr_storage*)&pend->addr,
+				pend->addrlen);
 			portcomm_loweruse(outnet, pend->pc);
 			return 0;
 		}
diff --git a/util/netevent.c b/util/netevent.c
index 7c6da50b..27e94438 100644
--- a/util/netevent.c
+++ b/util/netevent.c
@@ -367,9 +367,14 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
 #endif
 			int e;
 			fd_set_block(c->fd);
-			sent = sendto(c->fd, (void*)sldns_buffer_begin(packet), 
-				sldns_buffer_remaining(packet), 0,
-				addr, addrlen);
+			if (addr) {
+				sent = sendto(c->fd, (void*)sldns_buffer_begin(packet),
+					sldns_buffer_remaining(packet), 0,
+					addr, addrlen);
+			} else {
+				sent = send(c->fd, (void*)sldns_buffer_begin(packet),
+					sldns_buffer_remaining(packet), 0);
+			}
 			e = errno;
 			fd_set_nonblock(c->fd);
 			errno = e;
@@ -378,9 +383,13 @@ comm_point_send_udp_msg(struct comm_point *c, sldns_buffer* packet,
 	if(sent == -1) {
 		if(!udp_send_errno_needs_log(addr, addrlen))
 			return 0;
-		verbose(VERB_OPS, "sendto failed: %s", sock_strerror(errno));
-		log_addr(VERB_OPS, "remote address is", 
-			(struct sockaddr_storage*)addr, addrlen);
+		if (addr) {
+			verbose(VERB_OPS, "sendto failed: %s", sock_strerror(errno));
+			log_addr(VERB_OPS, "remote address is",
+				(struct sockaddr_storage*)addr, addrlen);
+		} else {
+			verbose(VERB_OPS, "send failed: %s", sock_strerror(errno));
+		}
 		return 0;
 	} else if((size_t)sent != sldns_buffer_remaining(packet)) {
 		log_err("sent %d in place of %d bytes", 

but it would introduce a layer violation; and arguably it's not safe to call udp_send_errno_needs_log with NULL either, although it would not cause a crash with ENOBUFS. It's late here so I'm posting the patch here in the hope that someone familiar with the code can create a better fix.

[gthess]

@delphij You found a bug for sure, thanks for the patch!
I modified it and included it in 08968ba.

It seems it solves the problems reported here but not sure about the one reported over at https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251821. It seems to be TCP related.

[Sp1l]

Added to FreeBSD ports in 558269 and 558271 (2020Q4)
See freebsd/freebsd-ports@1d6fa91
freebsd/freebsd-ports@aa6db09

[delphij]

@delphij You found a bug for sure, thanks for the patch!
I modified it and included it in 08968ba.

It seems it solves the problems reported here but not sure about the one reported over at https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251821. It seems to be TCP related.

That one looks like a different bug. Unfortunately I was unable to trigger it locally...

[cschuber]

@delphij You found a bug for sure, thanks for the patch!
I modified it and included it in 08968ba.
It seems it solves the problems reported here but not sure about the one reported over at https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=251821. It seems to be TCP related.

That one looks like a different bug. Unfortunately I was unable to trigger it locally...

I'm not able to reproduce this here either.