From: Vladimír Čunát <vladimir.cunat@nic.cz>
Date: Thu, 29 May 2025 09:07:40 +0000 (+0200)
Subject: daemon/{session2,worker}: relax a few kr_require() cases
X-Git-Tag: v6.0.13~1^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2b27b60f11d8954566cc0da38d9eb492dfeb2973;p=thirdparty%2Fknot-resolver.git

daemon/{session2,worker}: relax a few kr_require() cases

These cases aren't obviously impossible,
and I fail to see why force a crash there.
---

diff --git a/NEWS b/NEWS
index fab6cf9ae..04da13725 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,7 @@ Security
 --------
 - DoS: fix more rare crashes with `requirement` failing (#930, !1696)
   [system] requirement "session2_is_empty(s)" failed in session2_transport_event
+  (and others not observed in practice)
 
 Bugfixes
 --------
diff --git a/daemon/session2.c b/daemon/session2.c
index 450796ded..997e54544 100644
--- a/daemon/session2.c
+++ b/daemon/session2.c
@@ -1094,7 +1094,8 @@ void session2_tasklist_finalize(struct session2 *session, int status)
 		defer_sample_start(&defer_prev_sample_state);
 		do {
 			struct qr_task *t = session2_tasklist_del_first(session, false);
-			kr_require(worker_task_numrefs(t) > 0);
+			if (kr_fails_assert(worker_task_numrefs(t) > 0))
+				continue; // t has been freed already?
 			worker_task_finalize(t, status);
 			worker_task_unref(t);
 			defer_sample_restart();
@@ -1686,7 +1687,7 @@ static inline int session2_transport_push(struct session2 *s,
 static void on_session2_handle_close(uv_handle_t *handle)
 {
 	struct session2 *session = handle->data;
-	kr_require(session->transport.type == SESSION2_TRANSPORT_IO &&
+	kr_assert(session->transport.type == SESSION2_TRANSPORT_IO &&
 			session->transport.io.handle == handle);
 	io_free(handle);
 }
diff --git a/daemon/worker.c b/daemon/worker.c
index 16191a8e0..f7d253234 100644
--- a/daemon/worker.c
+++ b/daemon/worker.c
@@ -502,10 +502,9 @@ static void qr_task_free(struct qr_task *task)
 {
 	struct request_ctx *ctx = task->ctx;
 
-	if (kr_fails_assert(ctx))
+	if (kr_fails_assert(ctx && ctx->task == NULL))
 		return;
 
-	kr_require(ctx->task == NULL);
 	request_free(ctx);
 
 	/* Update stats */
@@ -549,7 +548,7 @@ static void qr_task_complete(struct qr_task *task)
 
 	struct session2 *s = ctx->source.session;
 	if (s) {
-		kr_require(!s->outgoing && session2_waitinglist_is_empty(s));
+		kr_assert(!s->outgoing && session2_waitinglist_is_empty(s));
 		ctx->source.session = NULL;
 		session2_tasklist_del(s, task);
 	}