Ok, here's the patch:
From 6b2ffa8216bcf65f3b20b14171d9732d9583e6f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <[email protected]>
Date: Sat, 27 Jul 2024 04:57:36 +0200
Subject: [PATCH] Disable RTLD_DEEPBIND in Samba DLZ module
When RTLD_DEEPBIND is enabled in the LDB modules inside the Samba DLZ
plugin, and jemalloc is the BIND 9 memory allocator, there's a mismatch
in the used symbols and the LDB allocates memory using BIND 9
allocator (jemalloc), but frees the memory using RLTD_DEEPBIND free()
symbol from libc. This causes assertion failure on BIND 9 startup.
---
bin/named/dlz_dlopen_driver.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/bin/named/dlz_dlopen_driver.c b/bin/named/dlz_dlopen_driver.c
index 55c6e1e3b1..3d74ac07dc 100644
--- a/bin/named/dlz_dlopen_driver.c
+++ b/bin/named/dlz_dlopen_driver.c
@@ -211,6 +211,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc,
char *argv[],
isc_mem_t *mctx = NULL;
isc_result_t result = ISC_R_FAILURE;
int r;
+ char buf[1024];
UNUSED(driverarg);
@@ -233,6 +234,24 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc,
char *argv[],
/* Initialize the lock */
isc_mutex_init(&cd->lock);
+#if HAVE_JEMALLOC
+ /*
+ * Disable RTLD_DEEPBIND in Samba DLZ module,
+ * see https://bugzilla.samba.org/show_bug.cgi?id=15643
+ * for more details.
+ */
+ r = uv_os_getenv("LDB_MODULES_DISABLE_DEEPBIND", buf,
+ &(size_t){ sizeof(buf) });
+ if (r == UV_ENOENT) {
+ r = uv_os_setenv("LDB_MODULES_DISABLE_DEEPBIND", "1");
+ }
+ if (r != 0) {
+ dlopen_log(ISC_LOG_WARNING,
+ "setting LDB_MODULES_DISABLE_DEEPBIND failed: %s",
+ uv_strerror(r));
+ }
+#endif
+
r = uv_dlopen(cd->dl_path, &cd->dl_handle);
if (r != 0) {
const char *errmsg = uv_dlerror(&cd->dl_handle);
--
2.39.2
--
Ondřej Surý (He/Him)
[email protected]
> On 27. 6. 2024, at 6:33, Lucas Bocchi <[email protected]> wrote:
>
> Package: bind9
> Version: 1:9.19.24-185-g392e7199df2-1
> Severity: important
>
> Dear Maintainer,
>
> BIND9 with default configs, only enabling BIND9_DLZ, appears SEGFAULT on new
> bind9 version to debian testing
>
> Jun 27 10:26:01 gw-fw-local systemd[1]: Starting named.service - BIND Domain
> Name Server...
> Jun 27 10:26:01 gw-fw-local named[146587]: starting BIND
> 9.19.25-185-g392e7199df2-1-Debian (Development Release) <id:>
> Jun 27 10:26:01 gw-fw-local named[146587]: running on Linux x86_64 6.9.6 #1
> SMP PREEMPT Fri Jun 21 19:44:55 -03 2024
> Jun 27 10:26:01 gw-fw-local named[146587]: built with
> '--build=x86_64-linux-gnu' '--prefix=/usr' '--includedir=${prefix}/include'
> '--mandir=${prefix}/share/man' '--infodir=${prefix}/share/info'
> '--sysconfdir=/etc' '--localstatedir=/var' '--disable-option-checking'
> '--disable-silent-rules' '--libdir=${prefix}/lib/x86_64-linux-gnu'
> '--runstatedir=/run' '--disable-maintainer-mode'
> '--disable-dependency-tracking' '--libdir=/usr/lib/x86_64-linux-gnu'
> '--sysconfdir=/etc/bind' '--with-python=python3' '--localstatedir=/'
> '--enable-threads' '--enable-largefile' '--with-libtool' '--enable-shared'
> '--disable-static' '--with-gost=no' '--with-openssl=/usr' '--with-gssapi=yes'
> '--with-libidn2' '--with-json-c' '--with-lmdb=/usr' '--with-gnu-ld'
> '--with-maxminddb' '--with-atf=no' '--enable-ipv6' '--enable-rrl'
> '--enable-filter-aaaa' '--disable-native-pkcs11' '--enable-dnstap'
> 'build_alias=x86_64-linux-gnu' 'CFLAGS=-g -O2
> -Werror=implicit-function-declaration
> -ffile-prefix-map=/build/reproducible-path/bind9-9.19.24-185-g392e7199df2=.
> -fstack-protector-strong -fstack-clash-protection -Wformat
> -Werror=format-security -fcf-protection -fno-strict-aliasing
> -fno-delete-null-pointer-checks -DNO_VERSION_DATE -DDIG_SIGCHASE'
> 'LDFLAGS=-Wl,-z,relro -Wl,-z,now' 'CPPFLAGS=-Wdate-time -D_FORTIFY_SOURCE=2'
> Jun 27 10:26:01 gw-fw-local named[146587]: running as: named -f -u bind
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled by GCC 13.2.0
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled with OpenSSL version:
> OpenSSL 3.2.2 4 Jun 2024
> Jun 27 10:26:01 gw-fw-local named[146587]: linked to OpenSSL version: OpenSSL
> 3.2.2 4 Jun 2024
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled with libuv version: 1.48.0
> Jun 27 10:26:01 gw-fw-local named[146587]: linked to libuv version: 1.48.0
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled with liburcu version:
> 0.14.0
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled with jemalloc version:
> 5.3.0
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled with libnghttp2 version:
> 1.62.1
> Jun 27 10:26:01 gw-fw-local named[146587]: linked to libnghttp2 version:
> 1.62.1
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled with libxml2 version:
> 2.12.7
> Jun 27 10:26:01 gw-fw-local named[146587]: linked to libxml2 version: 20914
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled with json-c version: 0.17
> Jun 27 10:26:01 gw-fw-local named[146587]: linked to json-c version: 0.17
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled with zlib version: 1.3.1
> Jun 27 10:26:01 gw-fw-local named[146587]: linked to zlib version: 1.3.1
> Jun 27 10:26:01 gw-fw-local named[146587]: linked to maxminddb version: 1.9.1
> Jun 27 10:26:01 gw-fw-local named[146587]: compiled with protobuf-c version:
> 1.4.1
> Jun 27 10:26:01 gw-fw-local named[146587]: linked to protobuf-c version: 1.4.1
> Jun 27 10:26:01 gw-fw-local named[146587]:
> ----------------------------------------------------
> Jun 27 10:26:01 gw-fw-local named[146587]: BIND 9 is maintained by Internet
> Systems Consortium,
> Jun 27 10:26:01 gw-fw-local named[146587]: Inc. (ISC), a non-profit 501(c)(3)
> public-benefit
> Jun 27 10:26:01 gw-fw-local named[146587]: corporation. Support and training
> for BIND 9 are
> Jun 27 10:26:01 gw-fw-local named[146587]: available at
> https://www.isc.org/support
> Jun 27 10:26:01 gw-fw-local named[146587]:
> ----------------------------------------------------
> Jun 27 10:26:01 gw-fw-local named[146587]: adjusted limit on open files from
> 1024 to 524288
> Jun 27 10:26:01 gw-fw-local named[146587]: found 4 CPUs, using 4 worker
> threads
> Jun 27 10:26:01 gw-fw-local named[146587]: DNSSEC algorithms: RSASHA1
> NSEC3RSASHA1 RSASHA256 RSASHA512 ECDSAP256SHA256 ECDSAP384SHA384 ED25519 ED448
> Jun 27 10:26:01 gw-fw-local named[146587]: DS algorithms: SHA-1 SHA-256
> SHA-384
> Jun 27 10:26:01 gw-fw-local named[146587]: HMAC algorithms: HMAC-MD5
> HMAC-SHA1 HMAC-SHA224 HMAC-SHA256 HMAC-SHA384 HMAC-SHA512
> Jun 27 10:26:01 gw-fw-local named[146587]: TKEY mode 2 support
> (Diffie-Hellman): no
> Jun 27 10:26:01 gw-fw-local named[146587]: TKEY mode 3 support (GSS-API): yes
> Jun 27 10:26:01 gw-fw-local named[146587]: Disabling periodic interface
> re-scans timer
> Jun 27 10:26:01 gw-fw-local named[146587]: config.c: option 'allow-proxy' is
> experimental and subject to change in the future
> Jun 27 10:26:01 gw-fw-local named[146587]: config.c: option 'allow-proxy-on'
> is experimental and subject to change in the future
> Jun 27 10:26:01 gw-fw-local named[146587]: loading configuration from
> '/etc/bind/named.conf'
> Jun 27 10:26:01 gw-fw-local named[146587]: looking for GeoIP2 databases in
> '/usr/share/GeoIP'
> Jun 27 10:26:01 gw-fw-local named[146587]: using default UDP/IPv4 port range:
> [32768, 60999]
> Jun 27 10:26:01 gw-fw-local named[146587]: using default UDP/IPv6 port range:
> [32768, 60999]
> Jun 27 10:26:01 gw-fw-local named[146587]: listening on IPv4 interface lo,
> 127.0.0.1#53
> Jun 27 10:26:01 gw-fw-local named[146587]: listening on IPv4 interface
> enp1s0f0np0, 192.168.5.1#53
> Jun 27 10:26:01 gw-fw-local named[146587]: generating session key for dynamic
> DNS
> Jun 27 10:26:01 gw-fw-local named[146587]: Loading 'AD DNS Zone' using driver
> dlopen
> Jun 27 10:26:01 gw-fw-local kernel: named[146587]: segfault at 8 ip
> 00007ff967100340 sp 00007ffcf4188950 error 4 in
> libc.so.6[7ff96708f000+157000] likely on CPU 0 (core 0, socket 0)
> Jun 27 10:26:01 gw-fw-local kernel: Code: 5c 41 5d 41 5e e9 f0 fa ff ff 48 8d
> 3d a9 71 10 00 e8 14 e1 ff ff 0f 1f 40 00 48 8d 3d 31 71 10 00 e8 04 e1 ff ff
> 0f 1f 40 00 <48> 8b 50 08 48 83 e2 f8 48 01 d0 49 39 c5 0f 82 38 ff ff ff 48
> 8d
> Jun 27 10:26:01 gw-fw-local systemd[1]: named.service: Main process exited,
> code=killed, status=11/SEGV
> Jun 27 10:26:01 gw-fw-local systemd[1]: named.service: Failed with result
> 'signal'.
> Jun 27 10:26:01 gw-fw-local systemd[1]: Failed to start named.service - BIND
> Domain Name Server.
> Jun 27 10:26:01 gw-fw-local systemd[1]: named.service: Scheduled restart job,
> restart counter is at 5.
> Jun 27 10:26:01 gw-fw-local systemd[1]: named.service: Start request repeated
> too quickly.
> Jun 27 10:26:01 gw-fw-local systemd[1]: named.service: Failed with result
> 'signal'.
> Jun 27 10:26:01 gw-fw-local systemd[1]: Failed to start named.service - BIND
> Domain Name Server.
>
> No change on configs since last testing update from debian. Only upgrade
> testing and bind9 and bug start occurs
>
> -- System Information:
> Debian Release: trixie/sid
> APT prefers testing
> APT policy: (500, 'testing')
> Architecture: amd64 (x86_64)
>
> Kernel: Linux 6.9.6 (SMP w/4 CPU threads; PREEMPT)
> Kernel taint flags: TAINT_WARN, TAINT_TEST
> Locale: LANG=pt_BR.ISO-8859-1, LC_CTYPE=pt_BR.ISO-8859-1
> (charmap=ISO-8859-1), LANGUAGE=pt_BR:pt:en
> Shell: /bin/sh linked to /usr/bin/dash
> Init: systemd (via /run/systemd/system)
>
> Versions of packages bind9 depends on:
> ii adduser 3.137
> ii bind9-libs 1:9.19.24-185-g392e7199df2-1
> ii bind9-utils 1:9.19.24-185-g392e7199df2-1
> ii debconf [debconf-2.0] 1.5.86
> ii dns-root-data 2024041801
> ii init-system-helpers 1.66
> ii iproute2 6.9.0-1
> ii libc6 2.38-13
> ii libcap2 1:2.66-5
> ii libfstrm0 0.6.1-1+b2
> ii libjemalloc2 5.3.0-2+b1
> ii libjson-c5 0.17-1+b1
> ii liblmdb0 0.9.31-1+b1
> ii libmaxminddb0 1.9.1-1
> ii libnghttp2-14 1.62.1-1
> ii libprotobuf-c1 1.4.1-1+b2
> ii libssl3t64 3.2.2-1
> ii libsystemd0 256.1-2
> ii libuv1t64 1.48.0-5
> ii libxml2 2.9.14+dfsg-1.3+b3
> ii lsb-base 11.6
> ii netbase 6.4
> ii sysvinit-utils [lsb-base] 3.09-2
> ii zlib1g 1:1.3.dfsg+really1.3.1-1
>
> bind9 recommends no packages.
>
> Versions of packages bind9 suggests:
> pn bind-doc <none>
> ii bind9-dnsutils [dnsutils] 1:9.19.24-185-g392e7199df2-1
> pn resolvconf <none>
> pn ufw <none>
>
> -- Configuration Files:
> dlz "AD DNS Zone" {
> # For BIND 9.8.x
> # database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9.so";
>
> # For BIND 9.9.x
> # database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_9.so";
>
> # For BIND 9.10.x
> # database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_10.so";
>
> # For BIND 9.11.x
> # database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_11.so";
>
> # For BIND 9.12.x
> # database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_12.so";
>
> # For BIND 9.14.x
> # database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_14.so";
>
> # For BIND 9.16.x
> # database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_16.so";
> #
> # For BIND 9.18.x
> database "dlopen /usr/lib/x86_64-linux-gnu/samba/bind9/dlz_bind9_18.so -d
> 9";
> };
>
> -- no debconf information
>
