[Kea-users] kea crashes from global reservation ip mismatch

Wed May 28 07:08:09 UTC 2025

Hi, 

Thank you for finding this issue. 

I was able to replicate this on 2.4, 2.6 and master. 
It seems that this only occurs if also configuring "early-global-reservations-lookup": true 

Do you want to open a confidential issue on https://gitlab.isc.org/isc-projects/kea 
or should I? 

Regards, 
Razvan 

-----Original Message-----

From: Darren <darren.ankney at gmail.com>
To: Kea <kea-users at lists.isc.org>
Date: Tuesday, 27 May 2025 2:54 PM EEST
Subject: Re: [Kea-users] kea crashes from global reservation ip mismatch

Hi Nathan, 

Thank you for this detail. I am traveling now, but will attempt reproduction of this issue next week.  I will be working from the following assumptions (please correct if any of these are wrong): 

- The reservations are stored directly in the global are of the configuration file (not in a PostgreSQL or MySQL database) 
- The leases are stored in "memfile" (not in a PostgreSQL or MySQL database). 
- The configuration is stored completely in the json configuration file (i.e., the "configuration backend" (see: https://kea.readthedocs.io/en/kea-2.6.2/arm/dhcp4-srv.html#dhcp4-cb) is not in use). 
- You have not set any of these configuration directives: reservations-global, reservations-in-subnet, reservations-out-of-pool (see: https://kea.readthedocs.io/en/kea-2.6.2/arm/dhcp4-srv.html#address-reservation-types) 
- you have not placed any client-class guards (see: https://kea.readthedocs.io/en/kea-2.6.2/arm/dhcp4-srv.html#pool-selection-with-client-class-reservations) on any of the subnets. 

Thank you, 
Darren Ankney 

On Fri, May 23, 2025 at 2:19 PM Nathan Wicka via Kea-users <kea-users at lists.isc.org> wrote:  

 Hi, Darren.    We installed it via a package for OL8.   Name         : isc-kea
Version      : 2.6.1
Release      : isc20240725093407.el8
Architecture : x86_64
Size         : 17 k
Source       : isc-kea-2.6.1-isc20240725093407.el8.src.rpm
Repository   : @System
>From repo    : isc-kea-2-6
Summary      : DHCPv4, DHCPv6 and DDNS server from ISC
URL          : http://kea.isc.org
License      : MPLv2.0 and Boost

 We then compiled it with debug flags via gitlab from the same tag(2.6.1) and were able to reproduce the same error     

 From: Kea-users <kea-users-bounces at lists.isc.org> On Behalf Of Darren Ankney
Sent: Thursday, May 22, 2025 1:24 PM
To: Kea user's list <kea-users at lists.isc.org>
Subject: Re: [Kea-users] kea crashes from global reservation ip mismatch     
 Hi Nate, How was Kea installed? Did you compile from source or install via packages? It doesn't look like that crash from 2018 is relevant. User was able to avoid the crash by not loading a hook he was trying to create. Thank you, Darren Ankney  
 ZjQcmQRYFpfptBannerStart              This Message Is From an Untrusted Sender      You have not previously corresponded with this sender.              
 ZjQcmQRYFpfptBannerEnd  Hi Nate,   How was Kea installed?  Did you compile from source or install via packages?  It doesn't look like that crash from 2018 is relevant. User was able to avoid the crash by not loading a hook he was trying to create.   Thank you, Darren Ankney   On Wed, May 21, 2025 at 5:59 PM Nathan Wicka via Kea-users <kea-users at lists.isc.org> wrote: >  >  >  > Hello. I’m running a kea configuration where we leverage kea global reservations w/ Kea v 2.6.1. >  >  >  > Most of them look something like this: >  > { >  >               "hw-address": "74:86:e2:9d:cf:25", >  >               "ip-address": "10.221.53.34", >  >               "hostname": "test-switch-123", >  >               "option-data": [] >  > } >  >  >  > Whenever a DHCP request arrives from the client and there is a subnet mismatch: >  > e.g. >  >  >  > ./dhcp4-packets.log.3:33153:2025-05-08 07:42:10.381 INFO  [kea-dhcp4.packets/231784.140559790003968] DHCP4_PACKET_RECEIVED [hwtype=1 74:86:e2:9d:cf:25], cid=[no info], tid=0x510c7747: DHCPDISCOVER (type 1) received from 10.254.82.1 to 10.80.252.85 on interface ens192 >  >  >  > Kea crashes with the following error: >  >  >  > kea-dhcp4: /usr/include/boost/smart_ptr/shared_ptr.hpp:734: typename boost::detail::sp_member_access<T>::type boost::shared_ptr<T>::operator->() const [with T = const isc::dhcp::Host; typename boost::detail::sp_member_access<T>::type = const isc::dhcp::Host*]: Assertion `px != 0' failed. >  >  >  > Running it through GDB, we see this stack trace: >  >  >  >  >  > Thread 12 "lt-kea-dhcp4" received signal SIGABRT, Aborted. >  > [Switching to Thread 0x7fffe9ff7700 (LWP 519001)] >  > 0x00007ffff21c55ef in raise () from /lib64/libc.so.6 >  > Missing separate debuginfos, use: yum debuginfo-install boost-system-1.66.0-13.el8.x86_64 cyrus-sasl-lib-2.1.27-6.el8_5.x86_64 glibc-2.28-251.0.2.el8_10.11.x86_64 isc-kea-common-2.6.1-isc20240725093407.el8.x86_64 isc-kea-hooks-2.6.1-isc20240725093407.el8.x86_64 keyutils-libs-1.5.10-9.0.1.el8.x86_64 krb5-libs-1.18.2-30.0.1.el8_10.x86_64 libcom_err-1.46.2-2.el8.x86_64 libgcc-8.5.0-22.0.1.el8_10.x86_64 libpq-13.11-1.el8.x86_64 libselinux-2.9-9.el8_10.x86_64 libstdc++-8.5.0-22.0.1.el8_10.x86_64 libxcrypt-4.1.1-6.el8.x86_64 log4cplus-1.2.0-11.el8.x86_64 mariadb-connector-c-3.1.11-2.el8_3.x86_64 openldap-2.4.46-20.el8_10.x86_64 openssl-libs-1.1.1k-14.el8_6.x86_64 pcre2-10.32-3.el8_6.x86_64 zlib-1.2.11-25.el8.x86_64 >  > (gdb) backtrace >  > #0  0x00007ffff21c55ef in raise () from /lib64/libc.so.6 >  > #1  0x00007ffff2198e65 in abort () from /lib64/libc.so.6 >  > #2  0x00007ffff2198d39 in __assert_fail_base.cold.0 () from /lib64/libc.so.6 >  > #3  0x00007ffff21bdf46 in __assert_fail () from /lib64/libc.so.6 >  > #4  0x0000000000570c53 in boost::shared_ptr<isc::dhcp::Host const>::operator-> (this=0x7fffe9ff4630) at /usr/include/boost/smart_ptr/shared_ptr.hpp:734 >  > #5  0x00007ffff779c6d9 in (anonymous namespace)::hasAddressReservation (ctx=...) at alloc_engine.cc:3462 >  > #6  0x00007ffff779ea5d in isc::dhcp::AllocEngine::discoverLease4 (this=0x918a50, ctx=...) at alloc_engine.cc:3856 >  > #7  0x00007ffff779dc19 in isc::dhcp::AllocEngine::allocateLease4 (this=0x918a50, ctx=...) at alloc_engine.cc:3702 >  > #8  0x0000000000558a08 in isc::dhcp::Dhcpv4Srv::assignLease (this=0x7fffffffd250, ex=...) at dhcp4_srv.cc:3060 >  > #9  0x000000000055c8e6 in isc::dhcp::Dhcpv4Srv::processDiscover (this=0x7fffffffd250, discover=..., context=...) at dhcp4_srv.cc:3709 >  > #10 0x000000000054d809 in isc::dhcp::Dhcpv4Srv::processLocalizedQuery4 (this=0x7fffffffd250, ctx=..., allow_answer_park=true) at dhcp4_srv.cc:1586 >  > #11 0x000000000054c655 in isc::dhcp::Dhcpv4Srv::processDhcp4Query (this=0x7fffffffd250, query=..., allow_answer_park=true) at dhcp4_srv.cc:1532 >  > #12 0x000000000054b49b in isc::dhcp::Dhcpv4Srv::processPacket (this=0x7fffffffd250, query=..., allow_answer_park=true) at dhcp4_srv.cc:1455 >  > #13 0x000000000054a215 in isc::dhcp::Dhcpv4Srv::processPacketAndSendResponse (this=0x7fffffffd250, query=...) at dhcp4_srv.cc:1256 >  > #14 0x0000000000549f98 in isc::dhcp::Dhcpv4Srv::processPacketAndSendResponseNoThrow (this=0x7fffffffd250, query=...) at dhcp4_srv.cc:1244 >  > #15 0x0000000000598e09 in std::__invoke_impl<void, void (isc::dhcp::Dhcpv4Srv::*&)(boost::shared_ptr<isc::dhcp::Pkt4>), isc::dhcp::Dhcpv4Srv*&, boost::shared_ptr<isc::dhcp::Pkt4>&> (__f= >  >     @0x93aa30: (void (isc::dhcp::Dhcpv4Srv::*)(isc::dhcp::Dhcpv4Srv * const, boost::shared_ptr<isc::dhcp::Pkt4>)) 0x549f4a <isc::dhcp::Dhcpv4Srv::processPacketAndSendResponseNoThrow(boost::shared_ptr<isc::dhcp::Pkt4>)>, __t=@0x93aa50: 0x7fffffffd250) at /usr/include/c++/8/bits/invoke.h:73 >  > #16 0x0000000000595cb7 in std::__invoke<void (isc::dhcp::Dhcpv4Srv::*&)(boost::shared_ptr<isc::dhcp::Pkt4>), isc::dhcp::Dhcpv4Srv*&, boost::shared_ptr<isc::dhcp::Pkt4>&> (__fn= >  >     @0x93aa30: (void (isc::dhcp::Dhcpv4Srv::*)(isc::dhcp::Dhcpv4Srv * const, boost::shared_ptr<isc::dhcp::Pkt4>)) 0x549f4a <isc::dhcp::Dhcpv4Srv::processPacketAndSendResponseNoThrow(boost::shared_ptr<isc::dhcp::Pkt4>)>) at /usr/include/c++/8/bits/invoke.h:95 >  > #17 0x0000000000592359 in std::_Bind<void (isc::dhcp::Dhcpv4Srv::*(isc::dhcp::Dhcpv4Srv*, boost::shared_ptr<isc::dhcp::Pkt4>))(boost::shared_ptr<isc::dhcp::Pkt4>)>::__call<void, , 0ul, 1ul>(std::tuple<>&&, std::_Index_tuple<0ul, 1ul>) (this=0x93aa30, __args=...) at /usr/include/c++/8/functional:400 >  > #18 0x000000000058c8c2 in std::_Bind<void (isc::dhcp::Dhcpv4Srv::*(isc::dhcp::Dhcpv4Srv*, boost::shared_ptr<isc::dhcp::Pkt4>))(boost::shared_ptr<isc::dhcp::Pkt4>)>::operator()<, void>() ( >  >     this=0x93aa30) at /usr/include/c++/8/functional:484 >  > #19 0x0000000000584d2f in std::_Function_handler<void (), std::_Bind<void (isc::dhcp::Dhcpv4Srv::*(isc::dhcp::Dhcpv4Srv*, boost::shared_ptr<isc::dhcp::Pkt4>))(boost::shared_ptr<isc::dhcp::Pkt4>)> >::_M_invoke(std::_Any_data const&) (__functor=...) at /usr/include/c++/8/bits/std_function.h:297 >  > #20 0x00007ffff79143a6 in std::function<void ()>::operator()() const (this=0x1426af0) at /usr/include/c++/8/bits/std_function.h:687 >  > #21 0x00007ffff4187348 in isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::run() (this=0x7ffff43ffa58 <isc::util::MultiThreadingMgr::instance()::manager+24>) at ../../../src/lib/util/thread_pool.h:599 >  > #22 0x00007ffff4189058 in std::__invoke_impl<void, void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*>(std::__invoke_memfun_deref, void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*&&)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*&&) ( >  >     __f=@0x1531210: (void (isc::util::ThreadPool<std::function<void()>, std::deque<boost::shared_ptr<std::function<void()> >, std::allocator<boost::shared_ptr<std::function<void()> > > > >::*)(isc::util::ThreadPool<std::function<void()>, std::deque<boost::shared_ptr<std::function<void()> >, std::allocator<boost::shared_ptr<std::function<void()> > > > > * const)) 0x7ffff41872e6 <isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::run()>, >  >     __t=@0x1531208: 0x7ffff43ffa58 <isc::util::MultiThreadingMgr::instance()::manager+24>) at /usr/include/c++/8/bits/invoke.h:73 >  > #23 0x00007ffff418827d in std::__invoke<void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*>(void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*&&)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*&&) ( >  >     __fn=@0x1531210: (void (isc::util::ThreadPool<std::function<void()>, std::deque<boost::shared_ptr<std::function<void()> >, std::allocator<boost::shared_ptr<std::function<void()> > > > >::*)(isc::util::ThreadPool<std::function<void()>, std::deque<boost::shared_ptr<std::function<void()> >, std::allocator<boost::shared_ptr<std::function<void()> > > > > * const)) 0x7ffff41872e6 <isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::run()>) >  >     at /usr/include/c++/8/bits/invoke.h:95 >  > #24 0x00007ffff418accb in std::thread::_Invoker<std::tuple<void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*> >::_M_invoke<0ul, 1ul>(std::_Index_tuple<0ul, 1ul>) (this=0x1531208) at /usr/include/c++/8/thread:244 >  > #25 0x00007ffff418ac4a in std::thread::_Invoker<std::tuple<void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*> >::operator()() (this=0x1531208) at /usr/include/c++/8/thread:253 >  > #26 0x00007ffff418ab6a in std::thread::_State_impl<std::thread::_Invoker<std::tuple<void (isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >::*)(), isc::util::ThreadPool<std::function<void ()>, std::deque<boost::shared_ptr<std::function<void ()> >, std::allocator<boost::shared_ptr<std::function<void ()> > > > >*> > >::_M_run() (this=0x1531200) at /usr/include/c++/8/thread:196 >  > #27 0x00007ffff2baab23 in execute_native_thread_routine () from /lib64/libstdc++.so.6 >  > #28 0x00007ffff3c941da in start_thread () from /lib64/libpthread.so.0 >  > #29 0x00007ffff21b08d3 in clone () from /lib64/libc.so.6, this is the full stack trace: >  >  >  > So it appears that Kea is not handling the subnet/IP mismatch. >  > For reference, I also see this error being referenced in this thread from 2018 https://urldefense.com/v3/__https://lists.isc.org/pipermail/kea-users/2018-October/002062.html__;!!E3l7wfIP!nxTjPGDuAaEG8QB73V_RrZkNJsctgtCW1LocmxRc3kOn0aLwOLmOG8zIR1EOZSHFwZmzJSz9WJAJla12BQrqCg$ >  >  >  > Can someone investigate this potential bug, or, if there is a preferred configuration change we can make to stabilize this, we can share more about our configs. >  >  >  > Thanks! >  > -Nate >  > -- > ISC funds the development of this software with paid support subscriptions. Contact us at https://urldefense.com/v3/__https://www.isc.org/contact/__;!!E3l7wfIP!nxTjPGDuAaEG8QB73V_RrZkNJsctgtCW1LocmxRc3kOn0aLwOLmOG8zIR1EOZSHFwZmzJSz9WJAJla3Ql1-h7w$ for more information. >  > To unsubscribe visit https://urldefense.com/v3/__https://lists.isc.org/mailman/listinfo/kea-users__;!!E3l7wfIP!nxTjPGDuAaEG8QB73V_RrZkNJsctgtCW1LocmxRc3kOn0aLwOLmOG8zIR1EOZSHFwZmzJSz9WJAJla2Yz9InKQ$. >  > Kea-users mailing list > Kea-users at lists.isc.org > https://urldefense.com/v3/__https://lists.isc.org/mailman/listinfo/kea-users__;!!E3l7wfIP!nxTjPGDuAaEG8QB73V_RrZkNJsctgtCW1LocmxRc3kOn0aLwOLmOG8zIR1EOZSHFwZmzJSz9WJAJla2Yz9InKQ$ --  ISC funds the development of this software with paid support subscriptions. Contact us at https://urldefense.com/v3/__https://www.isc.org/contact/__;!!E3l7wfIP!nxTjPGDuAaEG8QB73V_RrZkNJsctgtCW1LocmxRc3kOn0aLwOLmOG8zIR1EOZSHFwZmzJSz9WJAJla3Ql1-h7w$ for more information.   To unsubscribe visit https://urldefense.com/v3/__https://lists.isc.org/mailman/listinfo/kea-users__;!!E3l7wfIP!nxTjPGDuAaEG8QB73V_RrZkNJsctgtCW1LocmxRc3kOn0aLwOLmOG8zIR1EOZSHFwZmzJSz9WJAJla2Yz9InKQ$.   Kea-users mailing list Kea-users at lists.isc.org https://urldefense.com/v3/__https://lists.isc.org/mailman/listinfo/kea-users__;!!E3l7wfIP!nxTjPGDuAaEG8QB73V_RrZkNJsctgtCW1LocmxRc3kOn0aLwOLmOG8zIR1EOZSHFwZmzJSz9WJAJla2Yz9InKQ$   -- 
ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.

To unsubscribe visit https://lists.isc.org/mailman/listinfo/kea-users.

Kea-users mailing list
Kea-users at lists.isc.org
https://lists.isc.org/mailman/listinfo/kea-users       
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/kea-users/attachments/20250528/1edb3fdb/attachment-0001.htm>