|
 |
d4e835 |
From 7f5bdf7f4063c2fefb18900468d2c851f8de7816 Mon Sep 17 00:00:00 2001
|
|
|
d4e835 |
From: Evan Hunt <each@isc.org>
|
|
|
d4e835 |
Date: Tue, 18 Feb 2014 23:32:02 -0800
|
|
|
d4e835 |
Subject: [PATCH] [master] fix dns_resolver_destroyfetch race
|
|
|
d4e835 |
|
|
|
d4e835 |
3747. [bug] A race condition could lead to a core dump when
|
|
|
d4e835 |
destroying a resolver fetch object. [RT #35385]
|
|
|
d4e835 |
---
|
|
|
d4e835 |
lib/dns/resolver.c | 7 +++++--
|
|
|
d4e835 |
1 file changed, 5 insertions(+), 2 deletions(-)
|
|
|
d4e835 |
|
|
|
d4e835 |
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
|
|
|
d4e835 |
index fa188c1..66ab41f 100644
|
|
|
d4e835 |
--- a/lib/dns/resolver.c
|
|
|
d4e835 |
+++ b/lib/dns/resolver.c
|
|
|
d4e835 |
@@ -357,6 +357,7 @@ typedef struct {
|
|
|
d4e835 |
|
|
|
d4e835 |
struct dns_fetch {
|
|
|
d4e835 |
unsigned int magic;
|
|
|
d4e835 |
+ isc_mem_t * mctx;
|
|
|
d4e835 |
fetchctx_t * private;
|
|
|
d4e835 |
};
|
|
|
d4e835 |
|
|
|
d4e835 |
@@ -8561,6 +8562,8 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
|
|
|
d4e835 |
fetch = isc_mem_get(res->mctx, sizeof(*fetch));
|
|
|
d4e835 |
if (fetch == NULL)
|
|
|
d4e835 |
return (ISC_R_NOMEMORY);
|
|
|
d4e835 |
+ fetch->mctx = NULL;
|
|
|
d4e835 |
+ isc_mem_attach(res->mctx, &fetch->mctx);
|
|
|
d4e835 |
|
|
|
d4e835 |
bucketnum = dns_name_fullhash(name, ISC_FALSE) % res->nbuckets;
|
|
|
d4e835 |
|
|
|
d4e835 |
@@ -8651,7 +8654,7 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
|
|
|
d4e835 |
FTRACE("created");
|
|
|
d4e835 |
*fetchp = fetch;
|
|
|
d4e835 |
} else
|
|
|
d4e835 |
- isc_mem_put(res->mctx, fetch, sizeof(*fetch));
|
|
|
d4e835 |
+ isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
|
|
|
d4e835 |
|
|
|
d4e835 |
return (result);
|
|
|
d4e835 |
}
|
|
|
d4e835 |
@@ -8742,7 +8745,7 @@ dns_resolver_destroyfetch(dns_fetch_t **fetchp) {
|
|
|
d4e835 |
|
|
|
d4e835 |
UNLOCK(&res->buckets[bucketnum].lock);
|
|
|
d4e835 |
|
|
|
d4e835 |
- isc_mem_put(res->mctx, fetch, sizeof(*fetch));
|
|
|
d4e835 |
+ isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
|
|
|
d4e835 |
*fetchp = NULL;
|
|
|
d4e835 |
|
|
|
d4e835 |
if (bucket_empty)
|
|
|
d4e835 |
--
|
|
|
d4e835 |
1.9.0
|
|
|
d4e835 |
|