coredump after command unbound-control stop unbound

[eaglegai]

Describe the bug
there is a core file after executing the command unbound-control stop unbound.

To reproduce
Steps to reproduce the behavior:

ulimit -c unlimited
sysctl fs.suid_dumpable=1
unbound-control start unbound
unbound-control set_option shm-enable yes
unbound-control stop unbound
coredumpctl info
[root@localhost ~]# coredumpctl info
           PID: 391492 (unbound)
           UID: 997 (unbound)
           GID: 949 (unbound)
        Signal: 11 (SEGV)
     Timestamp: Tue 2025-01-21 14:03:33 CST (33min ago)
  Command Line: /usr/sbin/unbound -d
    Executable: /usr/sbin/unbound
 Control Group: /system.slice/unbound.service
          Unit: unbound.service
         Slice: system.slice
       Boot ID: 95d8e597478b4fc991c09a6d6fa2c292
    Machine ID: 59add13ba12b47c7ba0d8c5ae72895cc
      Hostname: localhost.localdomain
       Storage: /var/lib/systemd/coredump/core.unbound.997.95d8e597478b4fc991c09a6d6fa2c292.391492.1737439413000000.lz4 (present)
     Disk Size: 1.7M
       Message: Process 391492 (unbound) of user 997 dumped core.

bt:

Core was generated by `unbound -c /etc/unbound/unbound.conf'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x00005588c4121bd7 in shm_main_shutdown (daemon=daemon@entry=0x558903a992a0) at util/shm_side/shm_main.c:201
201             verbose(VERB_DETAIL, "SHM shutdown - KEY [%d] - ID CTL [%d] ARR [%d] - PTR CTL [%p] ARR [%p]",
(gdb) bt
#0  0x00005588c4121bd7 in shm_main_shutdown (daemon=daemon@entry=0x558903a992a0) at util/shm_side/shm_main.c:201
#1  0x00005588c4121365 in daemon_fork (daemon=0x558903a992a0) at daemon/daemon.c:714
#2  0x00005588c411ca85 in run_daemon (need_pidfile=1, debug_mode=0, cmdline_verbose=0, cfgfile=0x7ffce48887e2 "/etc/unbound/unbound.conf") at daemon/unbound.c:736
#3  main (argc=<optimized out>, argv=<optimized out>) at daemon/unbound.c:837
(gdb) f 0
#0  0x00005588c4121bd7 in shm_main_shutdown (daemon=daemon@entry=0x558903a992a0) at util/shm_side/shm_main.c:201
201             verbose(VERB_DETAIL, "SHM shutdown - KEY [%d] - ID CTL [%d] ARR [%d] - PTR CTL [%p] ARR [%p]",
(gdb) l
196     #ifdef HAVE_SHMGET
197             /* web are OK, just disabled */
198             if(!daemon->cfg->shm_enable)
199                     return;
200
201             verbose(VERB_DETAIL, "SHM shutdown - KEY [%d] - ID CTL [%d] ARR [%d] - PTR CTL [%p] ARR [%p]",
202                     daemon->shm_info->key, daemon->shm_info->id_ctl, daemon->shm_info->id_arr, daemon->shm_info->ptr_ctl, daemon->shm_info->ptr_arr);
203
204             /* Destroy previous SHM */
205             if (daemon->shm_info->id_ctl >= 0)
(gdb) p daemon->shm_info
$1 = (struct shm_main_info *) 0x0
(gdb)

Expected behavior
no core happens

System:

• Unbound version: all version include the latest
• configuration:

 [root@localhost unbound-1.13.2]# cat /etc/unbound/unbound.conf | grep -v "^#" | grep -v ".#" | sed '/^$/d'
server:
        verbosity: 1
        statistics-interval: 0
        statistics-cumulative: no
        extended-statistics: yes
        num-threads: 4
        interface-automatic: no
        outgoing-port-permit: 32768-60999
        outgoing-port-avoid: 0-32767
        outgoing-port-avoid: 61000-65535
        so-reuseport: yes
        ip-transparent: yes
        max-udp-size: 3072


        chroot: ""
        username: "unbound"
        directory: "/etc/unbound"

        log-time-ascii: yes
        pidfile: "/var/run/unbound/unbound.pid"
        harden-glue: yes
        harden-dnssec-stripped: yes
        harden-below-nxdomain: yes
        harden-referral-path: yes
        qname-minimisation: yes
        aggressive-nsec: yes
        unwanted-reply-threshold: 10000000
        prefetch: yes
        prefetch-key: yes
        rrset-roundrobin: yes
        minimal-responses: yes
        module-config: "ipsecmod validator iterator"
        trust-anchor-signaling: yes
        root-key-sentinel: yes
        trusted-keys-file: /etc/unbound/keys.d/*.key
        auto-trust-anchor-file: "/var/lib/unbound/root.key"
        val-clean-additional: yes
        val-permissive-mode: no
        serve-expired: yes
        val-log-level: 1
        include: /etc/unbound/local.d/*.conf
        ipsecmod-enabled: no
        ipsecmod-hook:/usr/libexec/ipsec/_unbound-hook
python:
remote-control:
        control-enable: yes
        server-key-file: "/etc/unbound/unbound_server.key"
        server-cert-file: "/etc/unbound/unbound_server.pem"
        control-key-file: "/etc/unbound/unbound_control.key"
        control-cert-file: "/etc/unbound/unbound_control.pem"
include: /etc/unbound/conf.d/*.conf
auth-zone:
        name: "."
        for-downstream: no
        for-upstream: yes
        fallback-enabled: yes
        master: b.root-servers.net
        master: c.root-servers.net
        master: e.root-servers.net

Additional information
Add any other information that you may have gathered about the issue here.

[eaglegai]

This is because shm_main_init is only in daemon_fork, unbound-control set_option shm-enable yes couldn't calloc for daemon->shm_info.
but when executing unbound-control stop, cleanup operation could use daemon->shm_info->xxx while daemon->shm_info is NULL, which cause core happening.
So add a check before using daemon->shm_info.

[wcawijngaards]

Thank you for the bug fix! The change was merged to the code repository. Good to have proper cleanup also for error cases.