- Fix #1394: mix of serve-expired and response-ip could cause a crash.

git-svn-id: file:///svn/unbound/trunk@4289 be551aaa-1e26-0410-a405-d3ace91eadb9

diff --git a/daemon/worker.c b/daemon/worker.c
index 2c4cf5ba6c0a18beb5791bfac9217e6204d6b69c..38b3d1873a1b9529d1e731ae85379476db68efd9 100644 (file)
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -1355,6 +1355,10 @@ lookup_cache:
                                        lock_rw_unlock(&e->lock);
                                        regional_free_all(worker->scratchpad);
                                        goto send_reply;
+                               } else {
+                                       /* Note that we've already released the
+                                        * lock if we're here after prefetch. */
+                                       lock_rw_unlock(&e->lock);
                                }
                                /* We've found a partial reply ending with an
                                 * alias.  Replace the lookup qinfo for the
@@ -1362,7 +1366,6 @@ lookup_cache:
                                 * (possibly) complete the reply.  As we're
                                 * passing the "base" reply, there will be no
                                 * more alias chasing. */
-                               lock_rw_unlock(&e->lock);
                                memset(&qinfo_tmp, 0, sizeof(qinfo_tmp));
                                get_cname_target(alias_rrset, &qinfo_tmp.qname,
                                        &qinfo_tmp.qname_len);
@@ -1669,7 +1672,17 @@ worker_init(struct worker* worker, struct config_file *cfg,
        worker->env.send_query = &worker_send_query;
        worker->env.alloc = &worker->alloc;
        worker->env.rnd = worker->rndstate;
-       worker->env.scratch = worker->scratchpad;
+       /* If case prefetch is triggered, the corresponding mesh will clear
+        * the scratchpad for the module env in the middle of request handling.
+        * It would be prone to a use-after-free kind of bug, so we avoid
+        * sharing it with worker's own scratchpad at the cost of having
+        * one more pad per worker. */
+       worker->env.scratch = regional_create_custom(cfg->msg_buffer_size);
+       if(!worker->env.scratch) {
+               log_err("malloc failure");
+               worker_delete(worker);
+               return 0;
+       }
        worker->env.mesh = mesh_create(&worker->daemon->mods, &worker->env);
        worker->env.detach_subs = &mesh_detach_subs;
        worker->env.attach_sub = &mesh_attach_sub;
@@ -1758,6 +1771,7 @@ worker_delete(struct worker* worker)
        comm_base_delete(worker->base);
        ub_randfree(worker->rndstate);
        alloc_clear(&worker->alloc);
+       regional_destroy(worker->env.scratch);
        regional_destroy(worker->scratchpad);
        free(worker);
 }

diff --git a/doc/Changelog b/doc/Changelog
index 194bbc644cebcccd0bd57acc232f8524caf81710..a1d3f945e6edca52a163f2d6969cffcdcdd84e48 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+3 August 2017: Wouter
+       - Fix #1394: mix of serve-expired and response-ip could cause a crash.
+
 24 July 2017: Wouter
        - upgrade aclocal(pkg.m4 0.29.1), config.guess(2016-10-02),
          config.sub(2016-09-05).