- Fix locking in libunbound ub_ctx_set_event call.

  Thanks to Qifan Zhang, Palo Alto Networks, for the report.

diff --git a/doc/Changelog b/doc/Changelog
index 65c5983f29a9f5ac8c27cd584be64e472630784c..0bcd8a1824e51639b6db1dc69f3b7a771ae5ae98 100644 (file)
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -36,6 +36,8 @@
          inconsistency between secret and public keys. Also
          duplicate files are skipped. Thanks to Qifan Zhang, Palo
          Alto Networks, for the report.
+       - Fix locking in libunbound ub_ctx_set_event call.
+         Thanks to Qifan Zhang, Palo Alto Networks, for the report.
 
 15 June 2026: Wouter
        - Fix to add `max-transfer-size` and `max-transfer-time` that

diff --git a/libunbound/libunbound.c b/libunbound/libunbound.c
index 9c6a3e309717076e3f895e2336c48f818d816d30..8431b6bb11caba64422a1b835879347940691766 100644 (file)
--- a/libunbound/libunbound.c
+++ b/libunbound/libunbound.c
@@ -1467,8 +1467,15 @@ ub_ctx_set_event(struct ub_ctx* ctx, struct event_base* base) {
        
        lock_basic_lock(&ctx->cfglock);
        /* destroy the current worker - safe to pass in NULL */
+
+       /* Unlock the cfglock during libworker_delete_event, since it
+        * calls context_release_alloc, that wants to lock cfglock again.
+        * Since the event base is used from one thread, the one that
+        * called this function, it is safe to do so. */
+       lock_basic_unlock(&ctx->cfglock);
        libworker_delete_event(ctx->event_worker);
        ctx->event_worker = NULL;
+       lock_basic_lock(&ctx->cfglock);
        new_base = ub_libevent_event_base(base);
        if (new_base)
                ctx->event_base = new_base;