Report information
The Basics
Id:
38621
Status:
resolved
Priority:
Medium/Medium
Queue:

People
Owner:
Nobody in particular
Requestors:
Cc:
AdminCc:

BugTracker
Version Fixed:
9.10.3, 9.11.0
Version Found:
(no value)
Versions Affected:
(no value)
Versions Planned:
(no value)
Priority:
(no value)
Severity:
S2 Normal
CVSS Score:
(no value)
CVE ID:
(no value)
Component:
(no value)
Area:
bug

Dates
Created:Thu, 12 Feb 2015 09:13:46 -0500
Updated:Thu, 03 Aug 2017 23:20:31 -0400
Closed:Mon, 02 Mar 2015 02:26:58 -0500



This bug tracker is no longer active.

Please go to our Gitlab to submit issues (both feature requests and bug reports) for active projects maintained by Internet Systems Consortium (ISC).

Due to security and confidentiality requirements, full access is limited to the primary maintainers.

Subject: [v9.10.2rc1] DSCP code works with uninitialized memory
Date: Thu, 12 Feb 2015 15:13:37 +0100
To: bind9-bugs@isc.org
From: "Petr Spacek" <pspacek@redhat.com>
Hello, while experimenting with BIND v9.10.2rc1 I found few Valgrind warnings about operations with uninitialized memory: $ valgrind --leak-check=full --track-origins=yes named -4 -g -u named -m record -n 10 -d 10 ==9645== Memcheck, a memory error detector ==9645== Copyright (C) 2002-2013, and GNU GPL'd, by Julian Seward et al. ==9645== Using Valgrind-3.10.1 and LibVEX; rerun with -h for copyright info ==9645== Command: named -4 -g -u named -m record -n 10 -d 10 ==9645== 12-Feb-2015 15:10:49.935 starting BIND 9.10.2rc1-RedHat-9.10.2-0.1.rc1pspacekO0.fc21 -4 -g -u named -m record -n 10 -d 10 12-Feb-2015 15:10:49.968 built with '--build=x86_64-redhat-linux-gnu' '--host=x86_64-redhat-linux-gnu' '--program-prefix=' '--disable-dependency-tracking' '--prefix=/usr' '--exec-prefix=/usr' '--bindir=/usr/bin' '--sbindir=/usr/sbin' '--sysconfdir=/etc' '--datadir=/usr/share' '--includedir=/usr/include' '--libdir=/usr/lib64' '--libexecdir=/usr/libexec' '--sharedstatedir=/var/lib' '--mandir=/usr/share/man' '--infodir=/usr/share/info' '--with-libtool' '--localstatedir=/var' '--enable-threads' '--enable-ipv6' '--enable-filter-aaaa' '--enable-rrl' '--with-pic' '--disable-static' '--disable-openssl-version-check' '--enable-exportlib' '--with-export-libdir=/usr/lib64' '--with-export-includedir=/usr/include' '--includedir=/usr/include/bind9' '--enable-native-pkcs11' '--with-pkcs11=/usr/lib64/pkcs11/libsofthsm2.so' '--with-dlopen=yes' '--with-dlz-ldap=yes' '--with-dlz-postgres=yes' '--with-dlz-mysql=yes' '--with-dlz-filesystem=yes' '--with-dlz-bdb=yes' '--with-gssapi=yes' '--disable-isc-spnego' '--enable-fixed-rrset' '--with-docbook-xsl=/usr/share/sgml/docbook/xsl-stylesheets' 'build_alias=x86_64-redhat-linux-gnu' 'host_alias=x86_64-redhat-linux-gnu' 'CFLAGS= -O0 -ggdb' 'LDFLAGS=-Wl,-z,relro ' 'CPPFLAGS= -DDIG_SIGCHASE' 12-Feb-2015 15:10:49.969 ---------------------------------------------------- 12-Feb-2015 15:10:49.969 BIND 9 is maintained by Internet Systems Consortium, 12-Feb-2015 15:10:49.970 Inc. (ISC), a non-profit 501(c)(3) public-benefit 12-Feb-2015 15:10:49.970 corporation. Support and training for BIND 9 are 12-Feb-2015 15:10:49.970 available at https://www.isc.org/support 12-Feb-2015 15:10:49.970 ---------------------------------------------------- 12-Feb-2015 15:10:49.975 found 8 CPUs, using 10 worker threads 12-Feb-2015 15:10:49.976 using 4 UDP listeners per interface 12-Feb-2015 15:10:50.192 using up to 4096 sockets 12-Feb-2015 15:10:50.209 Registering DLZ_dlopen driver 12-Feb-2015 15:10:50.210 Registering SDLZ driver 'dlopen' 12-Feb-2015 15:10:50.212 Registering DLZ driver 'dlopen' 12-Feb-2015 15:10:50.827 decrement_reference: delete from rbt: 0x8c309c8 . 12-Feb-2015 15:10:51.174 loading configuration from '/etc/named.conf' 12-Feb-2015 15:10:51.294 set maximum stack size to 18446744073709551615: success 12-Feb-2015 15:10:51.296 set maximum data size to 18446744073709551615: success 12-Feb-2015 15:10:51.297 set maximum core size to 18446744073709551615: success 12-Feb-2015 15:10:51.297 set maximum open files to 18446744073709551615: success 12-Feb-2015 15:10:51.299 max open files (1024) is smaller than max sockets (4096) 12-Feb-2015 15:10:51.336 processing statistics channel 127.0.0.2#8053 12-Feb-2015 15:10:51.358 statistics channel listening on 127.0.0.2#8053 12-Feb-2015 15:10:51.396 using default UDP/IPv4 port range: [1024, 65535] 12-Feb-2015 15:10:51.551 listening on IPv4 interface lo, 127.0.0.2#53 12-Feb-2015 15:10:51.555 clientmgr @0x8c5a890: create ==9645== Thread 6: ==9645== Syscall param sendmsg(msg.msg_control) points to uninitialised byte(s) ==9645== at 0x6CC571D: ??? (syscall-template.S:81) ==9645== by 0x688493D: cmsgsend (net.c:555) ==9645== by 0x6884D28: try_dscp_v4 (net.c:670) ==9645== by 0x6884FA7: try_dscp (net.c:745) ==9645== by 0x6CC3B2F: pthread_once (pthread_once.S:103) ==9645== by 0x6884FC5: initialize_dscp (net.c:751) ==9645== by 0x6884FEF: isc_net_probedscp (net.c:756) ==9645== by 0x6889E0B: socket_create (socket.c:2928) ==9645== by 0x688A155: isc__socket_create (socket.c:2996) ==9645== by 0x6892DE5: isc_socket_create (socket_api.c:108) ==9645== by 0x509E5C3: open_socket (dispatch.c:1881) ==9645== by 0x50A1674: get_udpsocket (dispatch.c:2930) ==9645== Address 0xbc19d71 is on thread 6's stack ==9645== in frame #1, created by cmsgsend (net.c:491) ==9645== Uninitialised value was created by a stack allocation ==9645== at 0x688468D: cmsgsend (net.c:491) ==9645== 12-Feb-2015 15:10:51.585 sendmsg: Invalid argument ==9645== Syscall param sendmsg(msg.msg_control) points to uninitialised byte(s) ==9645== at 0x6CC571D: ??? (syscall-template.S:81) ==9645== by 0x688493D: cmsgsend (net.c:555) ==9645== by 0x6884F70: try_dscp_v6 (net.c:731) ==9645== by 0x6884FAC: try_dscp (net.c:746) ==9645== by 0x6CC3B2F: pthread_once (pthread_once.S:103) ==9645== by 0x6884FC5: initialize_dscp (net.c:751) ==9645== by 0x6884FEF: isc_net_probedscp (net.c:756) ==9645== by 0x6889E0B: socket_create (socket.c:2928) ==9645== by 0x688A155: isc__socket_create (socket.c:2996) ==9645== by 0x6892DE5: isc_socket_create (socket_api.c:108) ==9645== by 0x509E5C3: open_socket (dispatch.c:1881) ==9645== by 0x50A1674: get_udpsocket (dispatch.c:2930) ==9645== Address 0xbc19d74 is on thread 6's stack ==9645== in frame #1, created by cmsgsend (net.c:491) ==9645== Uninitialised value was created by a stack allocation ==9645== at 0x688468D: cmsgsend (net.c:491) ==9645== 12-Feb-2015 15:10:51.603 clientmgr @0x8c5a890: createclients I'm attaching named.conf I use. Have a nice day! -- Petr Spacek @ Red Hat

Message body is not shown because sender requested not to inline it.

Subject: Re: [ISC-Bugs #38621] [v9.10.2rc1] DSCP code works with uninitialized memory
Date: Thu, 12 Feb 2015 19:53:26 +0530
To: "Petr Spacek via RT" <bind9-bugs@isc.org>
From: "Mukund Sivaraman" <muks@isc.org>
Hi Petr On Thu, Feb 12, 2015 at 02:13:47PM +0000, Petr Spacek via RT wrote: > ==9645== Thread 6: > ==9645== Syscall param sendmsg(msg.msg_control) points to uninitialised byte(s) > ==9645== at 0x6CC571D: ??? (syscall-template.S:81) These have been fixed, along with many other Valgrind reported problems and are scheduled for release in the next point releases of BIND (not -P? patch releases, but point releases). Please wait for them. Also, thank you for reporting them. Mukund

Message body not shown because it is not plain text.