[Kea-users] kea crashes from global reservation ip mismatch

Wed May 21 21:59:28 UTC 2025

Hello. I'm running a kea configuration where we leverage kea global reservations w/ Kea v 2.6.1.

Most of them look something like this:
{
              "hw-address": "74:86:e2:9d:cf:25",
              "ip-address": "10.221.53.34",
              "hostname": "test-switch-123",
              "option-data": []
}

Whenever a DHCP request arrives from the client and there is a subnet mismatch:
e.g.

./dhcp4-packets.log.3:33153:2025-05-08 07:42:10.381 INFO  [kea-dhcp4.packets/231784.140559790003968] DHCP4_PACKET_RECEIVED [hwtype=1 74:86:e2:9d:cf:25], cid=[no info], tid=0x510c7747: DHCPDISCOVER (type 1) received from 10.254.82.1 to 10.80.252.85 on interface ens192

Kea crashes with the following error:

kea-dhcp4: /usr/include/boost/smart_ptr/shared_ptr.hpp:734: typename boost::detail::sp_member_access<T>::type boost::shared_ptr<T>::operator->() const [with T = const isc::dhcp::Host; typename boost::detail::sp_member_access<T>::type = const isc::dhcp::Host*]: Assertion `px != 0' failed.

Running it through GDB, we see this stack trace:

Thread 12 "lt-kea-dhcp4" received signal SIGABRT, Aborted.
[Switching to Thread 0x7fffe9ff7700 (LWP 519001)]
0x00007ffff21c55ef in raise () from /lib64/libc.so.6
Missing separate debuginfos, use: yum debuginfo-install boost-system-1.66.0-13.el8.x86_64 cyrus-sasl-lib-2.1.27-6.el8_5.x86_64 glibc-2.28-251.0.2.el8_10.11.x86_64 isc-kea-common-2.6.1-isc20240725093407.el8.x86_64 isc-kea-hooks-2.6.1-isc20240725093407.el8.x86_64 keyutils-libs-1.5.10-9.0.1.el8.x86_64 krb5-libs-1.18.2-30.0.1.el8_10.x86_64 libcom_err-1.46.2-2.el8.x86_64 libgcc-8.5.0-22.0.1.el8_10.x86_64 libpq-13.11-1.el8.x86_64 libselinux-2.9-9.el8_10.x86_64 libstdc++-8.5.0-22.0.1.el8_10.x86_64 libxcrypt-4.1.1-6.el8.x86_64 log4cplus-1.2.0-11.el8.x86_64 mariadb-connector-c-3.1.11-2.el8_3.x86_64 openldap-2.4.46-20.el8_10.x86_64 openssl-libs-1.1.1k-14.el8_6.x86_64 pcre2-10.32-3.el8_6.x86_64 zlib-1.2.11-25.el8.x86_64
(gdb) backtrace
#0  0x00007ffff21c55ef in raise () from /lib64/libc.so.6
#1  0x00007ffff2198e65 in abort () from /lib64/libc.so.6
#2  0x00007ffff2198d39 in __assert_fail_base.cold.0 () from /lib64/libc.so.6
#3  0x00007ffff21bdf46 in __assert_fail () from /lib64/libc.so.6
#4  0x0000000000570c53 in boost::shared_ptr<isc::dhcp::Host const>::operator-> (this=0x7fffe9ff4630) at /usr/include/boost/smart_ptr/shared_ptr.hpp:734
#5  0x00007ffff779c6d9 in (anonymous namespace)::hasAddressReservation (ctx=...) at alloc_engine.cc:3462
#6  0x00007ffff779ea5d in isc::dhcp::AllocEngine::discoverLease4 (this=0x918a50, ctx=...) at alloc_engine.cc:3856
#7  0x00007ffff779dc19 in isc::dhcp::AllocEngine::allocateLease4 (this=0x918a50, ctx=...) at alloc_engine.cc:3702
#8  0x0000000000558a08 in isc::dhcp::Dhcpv4Srv::assignLease (this=0x7fffffffd250, ex=...) at dhcp4_srv.cc:3060
#9  0x000000000055c8e6 in isc::dhcp::Dhcpv4Srv::processDiscover (this=0x7fffffffd250, discover=..., context=...) at dhcp4_srv.cc:3709
#10 0x000000000054d809 in isc::dhcp::Dhcpv4Srv::processLocalizedQuery4 (this=0x7fffffffd250, ctx=..., allow_answer_park=true) at dhcp4_srv.cc:1586
#11 0x000000000054c655 in isc::dhcp::Dhcpv4Srv::processDhcp4Query (this=0x7fffffffd250, query=..., allow_answer_park=true) at dhcp4_srv.cc:1532
#12 0x000000000054b49b in isc::dhcp::Dhcpv4Srv::processPacket (this=0x7fffffffd250, query=..., allow_answer_park=true) at dhcp4_srv.cc:1455
#13 0x000000000054a215 in isc::dhcp::Dhcpv4Srv::processPacketAndSendResponse (this=0x7fffffffd250, query=...) at dhcp4_srv.cc:1256
#14 0x0000000000549f98 in isc::dhcp::Dhcpv4Srv::processPacketAndSendResponseNoThrow (this=0x7fffffffd250, query=...) at dhcp4_srv.cc:1244
#15 0x0000000000598e09 in std::__invoke_impl<void, void (isc::dhcp::Dhcpv4Srv::*&)(boost::shared_ptr<isc::dhcp::Pkt4>), isc::dhcp::Dhcpv4Srv*&, boost::shared_ptr<isc::dhcp::Pkt4>&> (__f=
    @0x93aa30: (void (isc::dhcp::Dhcpv4Srv::*)(isc::dhcp::Dhcpv4Srv * const, boost::shared_ptr<isc::dhcp::Pkt4>)) 0x549f4a <isc::dhcp::Dhcpv4Srv::processPacketAndSendResponseNoThrow(boost::shared_ptr<isc::dhcp::Pkt4>)>, __t=@0x93aa50: 0x7fffffffd250) at /usr/include/c++/8/bits/invoke.h:73
#16 0x0000000000595cb7 in std::__invoke<void (isc::dhcp::Dhcpv4Srv::*&)(boost::shared_ptr<isc::dhcp::Pkt4>), isc::dhcp::Dhcpv4Srv*&, boost::shared_ptr<isc::dhcp::Pkt4>&> (__fn=
    @0x93aa30: (void (isc::dhcp::Dhcpv4Srv::*)(isc::dhcp::Dhcpv4Srv * const, boost::shared_ptr<isc::dhcp::Pkt4>)) 0x549f4a <isc::dhcp::Dhcpv4Srv::processPacketAndSendResponseNoThrow(boost::shared_ptr<isc::dhcp::Pkt4>)>) at /usr/include/c++/8/bits/invoke.h:95
#17 0x0000000000592359 in std::_Bind<void (isc::dhcp::Dhcpv4Srv::*(isc::dhcp::Dhcpv4Srv*, boost::shared_ptr<isc::dhcp::Pkt4>))(boost::shared_ptr<isc::dhcp::Pkt4>)>::__call<void, , 0ul, 1ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) (this=0x93aa30, __args=...) at /usr/include/c++/8/functional:400
#18 0x000000000058c8c2 in std::_Bind<void (isc::dhcp::Dhcpv4Srv::*(isc::dhcp::Dhcpv4Srv*, boost::shared_ptr<isc::dhcp::Pkt4>))(boost::shared_ptr<isc::dhcp::Pkt4>)>::operator()<, void>() (
    this=0x93aa30) at /usr/include/c++/8/functional:484
#19 0x0000000000584d2f in std::_Function_handler<void (), std::_Bind<void (isc::dhcp::Dhcpv4Srv::*(isc::dhcp::Dhcpv4Srv*, boost::shared_ptr<isc::dhcp::Pkt4>))(boost::shared_ptr<isc::dhcp::Pkt4>)> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/include/c++/8/bits/std_function.h:297
#20 0x00007ffff79143a6 in std::function<void ()>::operator()() const (this=0x1426af0) at /usr/include/c++/8/bits/std_function.h:687
#21 0x00007ffff4187348 in isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::run() (this=0x7ffff43ffa58 <isc::util::MultiThreadingMgr::instance()::manager+24>) at ../../../src/lib/util/thread_pool.h:599
#22 0x00007ffff4189058 in std::__invoke_impl<void, void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*>(std::__invoke_memfun_deref, void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*&&)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*&&) (
    __f=@0x1531210: (void (isc::util::ThreadPool<std::function<void()>, std::deque<boost::shared_ptr<std::function<void()> >, std::allocator<boost::shared_ptr<std::function<void()> > > > >::*)(isc::util::ThreadPool<std::function<void()>, std::deque<boost::shared_ptr<std::function<void()> >, std::allocator<boost::shared_ptr<std::function<void()> > > > > * const)) 0x7ffff41872e6 <isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::run()>,
    __t=@0x1531208: 0x7ffff43ffa58 <isc::util::MultiThreadingMgr::instance()::manager+24>) at /usr/include/c++/8/bits/invoke.h:73
#23 0x00007ffff418827d in std::__invoke<void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*>(void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*&&)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*&&) (
    __fn=@0x1531210: (void (isc::util::ThreadPool<std::function<void()>, std::deque<boost::shared_ptr<std::function<void()> >, std::allocator<boost::shared_ptr<std::function<void()> > > > >::*)(isc::util::ThreadPool<std::function<void()>, std::deque<boost::shared_ptr<std::function<void()> >, std::allocator<boost::shared_ptr<std::function<void()> > > > > * const)) 0x7ffff41872e6 <isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::run()>)
    at /usr/include/c++/8/bits/invoke.h:95
#24 0x00007ffff418accb in std::thread::_Invoker<std::tuple<void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) (this=0x1531208) at /usr/include/c++/8/thread:244
#25 0x00007ffff418ac4a in std::thread::_Invoker<std::tuple<void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*> >::operator()() (this=0x1531208) at /usr/include/c++/8/thread:253
#26 0x00007ffff418ab6a in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*> > >::_M_run() (this=0x1531200) at /usr/include/c++/8/thread:196
#27 0x00007ffff2baab23 in execute_native_thread_routine () from /lib64/libstdc++.so.6
#28 0x00007ffff3c941da in start_thread () from /lib64/libpthread.so.0
#29 0x00007ffff21b08d3 in clone () from /lib64/libc.so.6, this is the full stack trace:

So it appears that Kea is not handling the subnet/IP mismatch.
For reference, I also see this error being referenced in this thread from 2018 https://lists.isc.org/pipermail/kea-users/2018-October/002062.html

Can someone investigate this potential bug, or, if there is a preferred configuration change we can make to stabilize this, we can share more about our configs.

Thanks!
-Nate
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/kea-users/attachments/20250521/1b1cacdb/attachment-0001.htm>