Strange Bind 9 crash (lenny, squeeze)

[Jan Ingvoldstad <frettled@gmail.com>]

Hi.

At $workplace, two of our internal, caching DNS servers, running Bind
9 experienced crashes in quick order today.

I was wondering if other Debian users with Bind 9 have experienced
similar crashes lately, and know how to avoid them (installing other
recursive DNS servers is, of course, an option).

They were both running 1:9.6.ESV.R4+dfsg-0+lenny1 at the time, and
here's the log lines from daemon.log I think are relevant (the logs
are fairly spammy):

May 26 17:16:14 dns2 named[13336]: buffer.c:285: REQUIRE(b->used + 1
<= b->length) failed
May 26 17:16:14 dns2 named[13336]: exiting (due to assertion failure)

May 26 17:36:15 dns1 named[4488]: buffer.c:285: REQUIRE(b->used + 1 <=
b->length) failed
May 26 17:36:15 dns1 named[4488]: exiting (due to assertion failure)

I then upgraded "dns2" to squeeze, which provides 1:9.7.3.dfsg-1~squeeze1.

There was a change: more log entries in daemon.log:


May 26 22:26:19 dns2 named[1608]: buffer.c:285: REQUIRE(b->used + 1 <=
b->length) failed, back trace
May 26 22:26:19 dns2 named[1608]: #0 0xb77ebfa0 in ??
May 26 22:26:19 dns2 named[1608]: #1 0xb7411093 in ??
May 26 22:26:19 dns2 named[1608]: #2 0xb7412d78 in ??
May 26 22:26:19 dns2 named[1608]: #3 0xb76793ce in ??
May 26 22:26:19 dns2 named[1608]: #4 0xb76f7e3e in ??
May 26 22:26:19 dns2 named[1608]: #5 0xb76feb9f in ??
May 26 22:26:19 dns2 named[1608]: #6 0xb7433ebb in ??
May 26 22:26:19 dns2 named[1608]: #7 0xb7235955 in ??
May 26 22:26:19 dns2 named[1608]: #8 0xb708be7e in ??
May 26 22:26:19 dns2 named[1608]: exiting (due to assertion failure)


The relevant code snippet from lib/isc/buffer.c is:


void
isc__buffer_putuint48(isc_buffer_t *b, isc_uint64_t val) {
        isc_uint16_t valhi;
        isc_uint32_t vallo;

        REQUIRE(ISC_BUFFER_VALID(b));
        REQUIRE(b->used + 6 <= b->length);

        valhi = (isc_uint16_t)(val >> 32);
        vallo = (isc_uint32_t)(val & 0xFFFFFFFF);
        ISC__BUFFER_PUTUINT16(b, valhi);
        ISC__BUFFER_PUTUINT32(b, vallo);
}


This function is used via the macro isc_buffer_putuint48 only in lib/dns/tsig.c.

I have googled for these problems, and found other examples of Bind 9
falling over because of assertion failures, but not for this
particular case. I have also found that Bind 10 has copied this code
verbatim, which may not be such a good idea, if it falls over every so
often. :)
--
Jan