[Dnsmasq-discuss] double free or corruption in dnsmasq 2.91

[Florian Streibelt]

Hey,

I was unable to find anything on that specific issue in 2.91 maybe its 
already known.

The version of dnsmasq in ubuntu jammy (2.91-0ubuntu0.22.04.1) I have in 
front of me is frequently crashing when sending it a SIGHUP to reload 
it's config.
This should warrant a backport of a fix for ubuntu on their side because 
its a LTS, but I wanted to ask here first if the issue is known and a 
specific patch already exists.
I have seen that a lot of code related to the cache was touched after 
2.91.

Any suggestion how I could move forward? I would try and file a bug with 
ubuntu next and include any info I get in this thread.

I was able to strace the crash, but the core dumps I have are useless to 
me, because I did not manage to find debug symbols for this build 
released anywhere by ubuntu. And my debug build does not crash.

12:41:06.716869 --- SIGHUP {si_signo=SIGHUP, si_code=SI_USER, 
si_pid=2375498, si_uid=0} ---
12:41:06.717013 getpid()                = 2371486
12:41:06.717096 writev(27, [{iov_base="\1\0\0\0\0\0\0\0\0\0\0\0", 
iov_len=12}], 1) = 12
12:41:06.717163 rt_sigreturn({mask=[]}) = -1 EINTR (Interrupted system 
call)
12:41:06.717228 poll([{fd=4, events=POLLIN}, {fd=5, events=POLLIN}, 
{fd=6, events=POLLIN}, {fd=7, events=POLLIN}, {fd=8, events=POLLIN}, 
{fd=9, events=POLLIN}, {fd=10, events=POLLIN}, {fd=11, events=POLLIN}, 
{fd=12, events=POLLIN}, {fd=13, events=POLLIN}, {fd=14, events=POLLIN}, 
{fd=15, events=POLLIN}, {fd=16, events=POLLIN}, {fd=17, events=POLLIN}, 
{fd=18, events=POLLIN}, {fd=19, events=POLLIN}, {fd=20, events=POLLIN}, 
{fd=21, events=POLLIN}, {fd=22, events=POLLIN}, {fd=23, events=POLLIN}, 
{fd=24, events=POLLIN}, {fd=25, events=POLLIN}, {fd=26, events=POLLIN}], 
23, -1) = 1 ([{fd=26, revents=POLLIN}])
12:41:06.717365 read(26, "\1\0\0\0\0\0\0\0\0\0\0\0", 12) = 12
12:41:06.717425 newfstatat(AT_FDCWD, 
"/var/lib/neutron/dhcp/xxxxaddn_hosts", {st_mode=S_IFREG|0644, 
st_size=237, ...}, 0) = 0
12:41:06.717526 openat(AT_FDCWD, 
"/var/lib/neutron/dhcp/xxxx/addn_hosts", O_RDONLY) = 29
12:41:06.717611 newfstatat(29, "", {st_mode=S_IFREG|0644, st_size=237, 
...}, AT_EMPTY_PATH) = 0
12:41:06.717689 read(29, 
"10.216.1.148\thost-10-216-1-148.openstack.xxxxxxxxxxxx. 
host-10-216-1-148\n10.216.1.147\thost-10-216-1-147.openstack.xxxxxxxxxxxx. 
host-10-216-1-147\n10.190.198.10\thost-10-190-198-10.openstack.xxxxxxxxxxxx. 
host-10-190-198-10\n", 4096) = 237
12:41:06.717805 read(29, "", 4096)      = 0
12:41:06.717869 close(29)               = 0
12:41:06.717924 getpid()                = 2371486
12:41:06.717992 openat(AT_FDCWD, "/etc/localtime", O_RDONLY|O_CLOEXEC) = 
-1 ENOENT (No such file or directory)
12:41:06.718059 getpid()                = 2371486
12:41:06.718107 write(28, "<30>Sep 18 12:41:06 dnsmasq[2371486]: read 
/var/lib/neutron/dhcp/xxxx/addn_hosts - 6 names", 122) = 122
12:41:06.718195 writev(2, [{iov_base="double free or corruption (out)", 
iov_len=31}, {iov_base="\n", iov_len=1}], 2) = 32
12:41:06.718273 mmap(NULL, 4096, PROT_READ|PROT_WRITE, 
MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f443e2ed000
12:41:06.718347 rt_sigprocmask(SIG_UNBLOCK, [ABRT], NULL, 8) = 0
12:41:06.718402 gettid()                = 2371486
12:41:06.718454 getpid()                = 2371486
12:41:06.718512 tgkill(2371486, 2371486, SIGABRT) = 0
12:41:06.718564 --- SIGABRT {si_signo=SIGABRT, si_code=SI_TKILL, 
si_pid=2371486, si_uid=65534} ---
12:41:07.349095 +++ killed by SIGABRT (core dumped) +++



cheers,
   Florian