From: Alessio Podda Date: Tue, 16 Dec 2025 14:39:45 +0000 (+0100) Subject: Unpack struct vecheader X-Git-Tag: v9.21.17~34^2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=46f96b0543d94ffb0392aaaf1c467750f915a7fd;p=thirdparty%2Fbind9.git Unpack struct vecheader The bitset packing of the resign_lsb and heap_index in struct vecheader was causing a race condition, since both bindrdataset and heap operations tried to access the same byte (even though they are accessing different fields). While heap operations are protected by the node lock of the header being inserted, they aren't protected by the node locks of the headers being displaced, leading to the race condition. This commit fixes the issue by reverting the struct packing optimization. --- diff --git a/lib/dns/include/dns/rdatavec.h b/lib/dns/include/dns/rdatavec.h index f7ba2e1a26f..b92f6762740 100644 --- a/lib/dns/include/dns/rdatavec.h +++ b/lib/dns/include/dns/rdatavec.h @@ -81,18 +81,24 @@ struct dns_vecheader { _Atomic(uint16_t) attributes; _Atomic(dns_trust_t) trust; + /*% + * Locked by the heap lock. Can't be packed together with other fields + * since it is protected by a different lock. + */ + unsigned int heap_index; + /*% * Locked by the owning node's lock. */ - uint16_t resign_lsb : 1; - unsigned int heap_index : 31; uint32_t serial; dns_ttl_t ttl; dns_typepair_t typepair; - /* resigning (zone). The lsb is not adjacent for struct packing reasons + /* + * resigning (zone). */ isc_stdtime_t resign; + uint16_t resign_lsb : 1; /*% * Link to the other versions of this rdataset.