bin/39292: dhclient running amok, sending hundreds of requests per second

[<hans.rosenfeld%grumpf.hope-2000.org@localhost>]

>Number:         39292
>Category:       bin
>Synopsis:       dhclient running amok, sending hundreds of requests per second
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Aug 05 12:20:00 +0000 2008
>Originator:     Hans Rosenfeld
>Release:        NetBSD 4.0_STABLE
>Organization:
>Environment:
System: NetBSD escobedo 4.0_STABLE NetBSD 4.0_STABLE (ESCOBEDO) #5: Mon Feb 11 
21:13:51 CET 2008 hrosenfe@escobedo:/usr/src/sys/arch/amd64/compile/ESCOBEDO 
amd64
Architecture: x86_64
Machine: amd64
>Description:
dhclient suddenly started looping, sending out requests as fast as it
could. It logged thousands of messages just like these:

Aug  3 19:31:25 escobedo dhclient: DHCPDISCOVER on ex0 to 255.255.255.255 port 
67 interval 4
Aug  3 19:31:25 escobedo dhclient: DHCPOFFER from xx.xx.xx.xx
Aug  3 19:31:25 escobedo dhclient: DHCPREQUEST on ex0 to 255.255.255.255 port 67
Aug  3 19:31:25 escobedo dhclient: DHCPACK from xx.xx.xx.xx
Aug  3 19:31:25 escobedo dhclient: 
/home/builds/ab/netbsd-4-0-RELEASE/src/dist/dhcp/client/dhclient.c(2072): null 
pointer
Aug  3 19:31:25 escobedo dhclient: DHCPDECLINE on ex0 to 255.255.255.255 port 67
Aug  3 19:31:25 escobedo dhclient: DHCPDISCOVER on ex0 to 255.255.255.255 port 
67 interval 7
Aug  3 19:31:25 escobedo dhclient: DHCPOFFER from xx.xx.xx.xx
Aug  3 19:31:25 escobedo dhclient: DHCPREQUEST on ex0 to 255.255.255.255 port 67
Aug  3 19:31:25 escobedo dhclient: DHCPACK from xx.xx.xx.xx
Aug  3 19:31:25 escobedo dhclient: 
/home/builds/ab/netbsd-4-0-RELEASE/src/dist/dhcp/client/dhclient.c(2072): null 
pointer
Aug  3 19:31:25 escobedo dhclient: DHCPDECLINE on ex0 to 255.255.255.255 port 67

>How-To-Repeat:
Before dhclient began acting strange, amd(8) segfaulted and filled /
with a coredump. After a while there were enough processes hanging in
NFS accesses that no more forking was possible. The dhclient loop then
caused /var to fill up too, not only on this machine but also on the
dhcp server.

I don't know exactly what caused this behaviour, but I think it is
related to the execution of a script failing in bind_lease. The error
occured in make_decline, which is only called from bind_lease and only
if the script execution fails.

>Fix:
I looked at the dhclient code, but I have no idea where to fix it. The
error is logged in option_state_dereference (dist/dhcp/common/alloc.c:926), 
but it is subsequently ignored, so dhclient just tries again.