Skip Menu |
Report information
The Basics
Id: 46719
Status: resolved
Estimated: 1.67 hours (100 minutes)
Worked: 1.67 hours (100 minutes)
Users:
tmark: 1.67 hours (100 minutes)
Priority: 0/
Queue: dhcp-public

Bug Information
Version Fixed: 4.4.0 4.3.7-dev
Version Found: 4.4.0-dev
Versions Affected: (no value)
Versions Planned: 4.4.0 4.3.7
Priority: P0 Critical
Severity: S0 Critical
CVSS Score: (no value)
CVE ID: (no value)
Component: (no value)
Area: bug

Dates
Created:Tue, 28 Nov 2017 08:58:21 -0500
Updated:Thu, 02 May 2019 06:49:12 -0400
Closed:Fri, 01 Dec 2017 09:23:23 -0500



This bug tracker is no longer active.

Please go to our Gitlab to submit issues (both feature requests and bug reports) for active projects maintained by Internet Systems Consortium (ISC).

Due to security and confidentiality requirements, full access is limited to the primary maintainers.

To: dhcp-confidential@isc.org
Subject: Change to isc_heap_delete crashes ISC DHCP unit tests
Date: Tue, 28 Nov 2017 13:58:21 +0000
From: tmark@isc.org
Three server unit tests began failing after BIND9 46709 was merged into 9.11.2. Mark Andrews suggested the attached patch as a fix.
Subject: bind9.diff
Download bind9.diff
text/x-patch 5.9KiB
diff --git a/includes/dhcpd.h b/includes/dhcpd.h index aac2c108..c83dc9a6 100644 --- a/includes/dhcpd.h +++ b/includes/dhcpd.h @@ -1622,8 +1622,9 @@ struct iasubopt { */ #define EXPIRED_IPV6_CLEANUP_TIME (60*60) - int heap_index; /* index into heap, or -1 - (internal use only) */ + /* index into heaps, or -1 (internal use only) */ + int active_index; + int inactive_index; /* * A pointer to the state of the ddns update for this lease. diff --git a/server/mdb6.c b/server/mdb6.c index 1a728eb3..418ff606 100644 --- a/server/mdb6.c +++ b/server/mdb6.c @@ -216,7 +216,8 @@ iasubopt_allocate(struct iasubopt **iasubopt, const char *file, int line) { tmp->refcnt = 1; tmp->state = FTS_FREE; - tmp->heap_index = -1; + tmp->active_index = -1; + tmp->inactive_index = -1; tmp->plen = 255; *iasubopt = tmp; @@ -604,10 +605,14 @@ lease_older(void *a, void *b) { * Callback when an address's position in the heap changes. */ static void -lease_index_changed(void *iasubopt, unsigned int new_heap_index) { - ((struct iasubopt *)iasubopt)-> heap_index = new_heap_index; +active_changed(void *iasubopt, unsigned int new_heap_index) { + ((struct iasubopt *)iasubopt)-> active_index = new_heap_index; } +static void +inactive_changed(void *iasubopt, unsigned int new_heap_index) { + ((struct iasubopt *)iasubopt)-> inactive_index = new_heap_index; +} /*! * @@ -660,13 +665,13 @@ ipv6_pool_allocate(struct ipv6_pool **pool, u_int16_t type, dfree(tmp, file, line); return ISC_R_NOMEMORY; } - if (isc_heap_create(dhcp_gbl_ctx.mctx, lease_older, lease_index_changed, + if (isc_heap_create(dhcp_gbl_ctx.mctx, lease_older, active_changed, 0, &(tmp->active_timeouts)) != ISC_R_SUCCESS) { iasubopt_free_hash_table(&(tmp->leases), file, line); dfree(tmp, file, line); return ISC_R_NOMEMORY; } - if (isc_heap_create(dhcp_gbl_ctx.mctx, lease_older, lease_index_changed, + if (isc_heap_create(dhcp_gbl_ctx.mctx, lease_older, inactive_changed, 0, &(tmp->inactive_timeouts)) != ISC_R_SUCCESS) { isc_heap_destroy(&(tmp->active_timeouts)); iasubopt_free_hash_table(&(tmp->leases), file, line); @@ -1361,7 +1366,7 @@ cleanup_lease6(ia_hash_t *ia_table, * Remove the old lease from the active heap and from the hash table * then remove the lease from the IA and clean up the IA if necessary. */ - isc_heap_delete(pool->active_timeouts, test_iasubopt->heap_index); + isc_heap_delete(pool->active_timeouts, test_iasubopt->active_index); pool->num_active--; if (pool->ipv6_pond) pool->ipv6_pond->num_active--; @@ -1434,7 +1439,7 @@ add_lease6(struct ipv6_pool *pool, struct iasubopt *lease, if ((test_iasubopt->state == FTS_ACTIVE) || (test_iasubopt->state == FTS_ABANDONED)) { isc_heap_delete(pool->active_timeouts, - test_iasubopt->heap_index); + test_iasubopt->active_index); pool->num_active--; if (pool->ipv6_pond) pool->ipv6_pond->num_active--; @@ -1446,7 +1451,7 @@ add_lease6(struct ipv6_pool *pool, struct iasubopt *lease, } } else { isc_heap_delete(pool->inactive_timeouts, - test_iasubopt->heap_index); + test_iasubopt->inactive_index); pool->num_inactive--; } @@ -1567,14 +1572,13 @@ lease6_usable(struct iasubopt *lease) { static isc_result_t move_lease_to_active(struct ipv6_pool *pool, struct iasubopt *lease) { isc_result_t insert_result; - int old_heap_index; - old_heap_index = lease->heap_index; insert_result = isc_heap_insert(pool->active_timeouts, lease); if (insert_result == ISC_R_SUCCESS) { iasubopt_hash_add(pool->leases, &lease->addr, sizeof(lease->addr), lease, MDL); - isc_heap_delete(pool->inactive_timeouts, old_heap_index); + isc_heap_delete(pool->inactive_timeouts, + lease->inactive_index); pool->num_active++; pool->num_inactive--; lease->state = FTS_ACTIVE; @@ -1624,16 +1628,16 @@ renew_lease6(struct ipv6_pool *pool, struct iasubopt *lease) { if (lease->state == FTS_ACTIVE) { if (old_end_time <= lease->hard_lifetime_end_time) { isc_heap_decreased(pool->active_timeouts, - lease->heap_index); + lease->active_index); } else { isc_heap_increased(pool->active_timeouts, - lease->heap_index); + lease->active_index); } return ISC_R_SUCCESS; } else if (lease->state == FTS_ABANDONED) { char tmp_addr[INET6_ADDRSTRLEN]; lease->state = FTS_ACTIVE; - isc_heap_increased(pool->active_timeouts, lease->heap_index); + isc_heap_increased(pool->active_timeouts, lease->active_index); log_info("Reclaiming previously abandoned address %s", inet_ntop(AF_INET6, &(lease->addr), tmp_addr, sizeof(tmp_addr))); @@ -1655,9 +1659,7 @@ static isc_result_t move_lease_to_inactive(struct ipv6_pool *pool, struct iasubopt *lease, binding_state_t state) { isc_result_t insert_result; - int old_heap_index; - old_heap_index = lease->heap_index; insert_result = isc_heap_insert(pool->inactive_timeouts, lease); if (insert_result == ISC_R_SUCCESS) { /* @@ -1708,7 +1710,7 @@ move_lease_to_inactive(struct ipv6_pool *pool, struct iasubopt *lease, iasubopt_hash_delete(pool->leases, &lease->addr, sizeof(lease->addr), MDL); - isc_heap_delete(pool->active_timeouts, old_heap_index); + isc_heap_delete(pool->active_timeouts, lease->active_index); lease->state = state; pool->num_active--; pool->num_inactive++; @@ -1786,7 +1788,7 @@ decline_lease6(struct ipv6_pool *pool, struct iasubopt *lease) { pool->ipv6_pond->num_abandoned++; lease->hard_lifetime_end_time = MAX_TIME; - isc_heap_decreased(pool->active_timeouts, lease->heap_index); + isc_heap_decreased(pool->active_timeouts, lease->active_index); return ISC_R_SUCCESS; } @@ -2059,7 +2061,7 @@ cleanup_old_expired(struct ipv6_pool *pool) { break; } - isc_heap_delete(pool->inactive_timeouts, tmp->heap_index); + isc_heap_delete(pool->inactive_timeouts, tmp->inactive_index); pool->num_inactive--; if (tmp->ia != NULL) {