[Dnsmasq-discuss] dnsmasq crashing when serving multiple prefixes

Wed Sep 4 18:16:39 BST 2013

Hi,

we're experiencing a crash in dnsmasq 2.66 (also newest git) using it as 
DHCPv6 server serving multiple prefixes.

This is on a slightly changed OpenWrt box with ARM/kirkwood architecture 
and uClibc.

Linux router.ip 3.8.13 #42 Tue Sep 3 13:53:54 CEST 2013 armv5tel GNU/Linux

Here's the dnsmasq output:
root at router:/tmp# gdbserver :9000 /usr/sbin/dnsmasq 
--conf-dir=/var/etc/dnsmasq.d -d
Process /usr/sbin/dnsmasq created; pid = 10423
Listening on port 9000
Remote debugging from host 192.168.2.5
dnsmasq: started, version 2.66 cachesize 150
dnsmasq: compile time options: IPv6 GNU-getopt no-DBus no-i18n no-IDN 
DHCP DHCPv6 no-Lua TFTP no-conntrack no-ipset no-auth
dnsmasq-dhcp: DHCP, IP range 192.168.2.100 -- 192.168.2.249, lease time 12h
dnsmasq-dhcp: DHCPv6 stateless on fd46:b82e:3f6d::1
dnsmasq-dhcp: router advertisement on fd46:b82e:3f6d::
dnsmasq-dhcp: DHCPv6, IP range 2a00:c31:8533:900::2 -- 
2a00:c31:8533:900:ffff:ffff:ffff:ffff, lease time 1h
dnsmasq-dhcp: DHCPv6 stateless on 2a00:c31:8533:900::2
dnsmasq-dhcp: router advertisement on 2a00:c31:8533:900::
dnsmasq-dhcp: DHCPv6, IP range 2a00:c31:1133:900::2 -- 
2a00:c31:1133:900:ffff:ffff:ffff:ffff, lease time 1h
dnsmasq-dhcp: DHCPv6, IP range 2a00:c31:1933:900::2 -- 
2a00:c31:1933:900:ffff:ffff:ffff:ffff, lease time 1h
dnsmasq: using local addresses only for domain lan
dnsmasq: reading /tmp/resolv.conf.auto
dnsmasq: using nameserver 2a00:c31:e404:0:ffff:ffff:ffff:fc72#53
dnsmasq: using nameserver 2a00:c31:e404:0:ffff:ffff:ffff:fc71#53
dnsmasq: using local addresses only for domain lan
dnsmasq: read /etc/hosts - 1 addresses
dnsmasq-dhcp: read /etc/ethers - 0 addresses
dnsmasq-dhcp: RTR-ADVERT(br-lan) 2a00:c31:8533:900::
dnsmasq-dhcp: RTR-ADVERT(br-lan) fd46:b82e:3f6d::
dnsmasq-dhcp: RTR-ADVERT(br-lan) 2a00:c31:8533:900::
dnsmasq-dhcp: RTR-ADVERT(br-lan) fd46:b82e:3f6d::
dnsmasq-dhcp: RTR-ADVERT(br-lan) 2a00:c31:8533:900::
dnsmasq-dhcp: RTR-ADVERT(br-lan) fd46:b82e:3f6d::
dnsmasq-dhcp: DHCPSOLICIT(br-lan) 00:01:00:01:19:ba:81:2c:70:54:d2:7b:32:45

And here's the exact spot & backtrace:
0xb6ff0e38 in _start ()
    from 
/home/kaspar/tlabs/buildbot/openrouter3/ea4500_noclean/build/scripts/../staging_dir/target-arm_v5te_uClibc-0.9.33.2_eabi/root-kirkwood/lib/ld-uClibc.so.0
(gdb) c
Continuing.

Program received signal SIGSEGV, Segmentation fault.
0x0002c8e0 in match_netid (pool=<optimized out>, check=0x3fb40, 
tagnotneeded=<optimized out>) at dhcp-common.c:170
170	      if (check->net[0] != '!' && check->net[0] != '#')
(gdb) bt
#0  0x0002c8e0 in match_netid (pool=<optimized out>, check=0x3fb40, 
tagnotneeded=<optimized out>) at dhcp-common.c:170
#1  match_netid (check=<optimized out>, pool=0xbefff900, 
tagnotneeded=<optimized out>) at dhcp-common.c:160
#2  0x0002b600 in dhcp6_no_relay (now=52, is_unicast=263256, 
sz=<optimized out>, inbuff=0xbefff9bc, fallback=0x2c758 <dhcp6_reply+156>,
     iface_name=0x18 <Address 0x18 out of bounds>, interface=0, 
context=0x3fd90, tags=<optimized out>, link_address=<optimized out>, 
msg_type=<optimized out>)
     at rfc3315.c:683
#3  dhcp6_maybe_relay (link_address=<optimized out>, 
relay_tagsp=<optimized out>, context=0x3fd90, interface=0, 
iface_name=0xbefff9bc "br-lan",
     fallback=0xbefff9e0, inbuff=0x40458, sz=52, is_unicast=0, 
now=1378314215) at rfc3315.c:149
#4  0x0002c758 in dhcp6_reply (context=0x3fd90, interface=9, 
iface_name=0xbefff9bc "br-lan", fallback=0xbefff9e0, sz=52, 
is_unicast=0, now=1378314215)
     at rfc3315.c:88
#5  0x00028d14 in dhcp6_packet (now=1378314215) at dhcp6.c:173
#6  0x0000b848 in main (argc=<optimized out>, argv=<optimized out>) at 
dnsmasq.c:884
(gdb)

Output from dhclient on wheezy:
root at router666:~# dhclient -6 -sf /bin/echo --no-pid -d -v eth1
Internet Systems Consortium DHCP Client 4.2.2
Copyright 2004-2011 Internet Systems Consortium.
All rights reserved.
For info, please visit https://www.isc.org/software/dhcp/

Bound to *:546
Listening on Socket/eth1
Sending on   Socket/eth1
PRC: Soliciting for leases (INIT).
XMT: Forming Solicit, 0 ms elapsed.
XMT:  X-- IA_NA d2:7b:32:45
XMT:  | X-- Request renew in  +3600
XMT:  | X-- Request rebind in +5400
XMT: Solicit on eth1, interval 1010ms.
XMT: Forming Solicit, 1010 ms elapsed.
XMT:  X-- IA_NA d2:7b:32:45
XMT:  | X-- Request renew in  +3600
XMT:  | X-- Request rebind in +5400
XMT: Solicit on eth1, interval 1960ms.
XMT: Forming Solicit, 2970 ms elapsed.
XMT:  X-- IA_NA d2:7b:32:45
XMT:  | X-- Request renew in  +3600
XMT:  | X-- Request rebind in +5400
XMT: Solicit on eth1, interval 3970ms.
XMT: Forming Solicit, 6940 ms elapsed.
XMT:  X-- IA_NA d2:7b:32:45
XMT:  | X-- Request renew in  +3600
XMT:  | X-- Request rebind in +5400
XMT: Solicit on eth1, interval 8310ms.
XMT: Forming Solicit, 15260 ms elapsed.
XMT:  X-- IA_NA d2:7b:32:45
XMT:  | X-- Request renew in  +3600
XMT:  | X-- Request rebind in +5400
XMT: Solicit on eth1, interval 17260ms.

Ideas?

Cheers,
Kaspar