evdns crash in evdns_request_transmit

[ghazel]

This is with libevent 2.0.21

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0x12d
Stack frame #00  pc 00024872  mylib.so: Routine evdns_request_transmit in libevent/evdns.c:2262
Stack frame #01  pc 00024c29  mylib.so: Routine evdns_requests_pump_waiting_queue in libevent/evdns.c:760
Stack frame #02  pc 000273a9  mylib.so: Routine evdns_base_resume in libevent/evdns.c:2448

The line numbers are a little funny I think because of gcc optimization. Anyway, on this system, it appears that 0x12d matches the offset of the choked member of a struct nameserver * which is NULL. So the crash is probably in the access to req->ns->choked where req->ns is NULL. Not sure how it got to be NULL -- right before this, I did this:

void update_dns()
{
    evdns_base_clear_nameservers_and_suspend(g_evdns_base);

    evdns_base_nameserver_ip_add(g_evdns_base, "8.8.8.8");
    evdns_base_nameserver_ip_add(g_evdns_base, "8.8.4.4");

    // crashes in here
    evdns_base_resume(g_evdns_base);
}

[nmathewson]

I applied a few patches by Azat Khuzhin to the Libevent 2.1 branch recently to resolve these; please check for his name in the commit logs to see them. Any interest in backporting these to 2.0?

[ghazel]

His patch ( 14971a8 ) does seem related (and even addresses the issue), but as you can see from my code some nameservers were just installed. Maybe doesn't matter, but it seems like there is some way the nameservers are being removed. It's also worth noting that 5c710c0 solves the issue too.

I backported Azat Khuzhin's changeset to 2.0 here https://github.com/ghazel/Libevent/tree/20_evdns_resume_fix . Want a pull request?

[nmathewson]

A pull request would be great there, yes! Especially if the backport was at all nontrivial.

I think that the issue isn't that the nameservers are being removed, but that any requests inflight when clear_and_suspend wind up with NULL-valued nameservers.

[azat]

Seems that patches are merged in https://github.com/nmathewson/Libevent/pull/79
Can this be closed?