From: Ondřej Surý <ondrej@isc.org>
Date: Fri, 22 Apr 2022 11:22:12 +0000 (+0200)
Subject: Run resume_dslookup() from the correct task
X-Git-Tag: v9.19.1~58^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=741a7096fc9c5a76ab59b6146a51bae7c0807f79;p=thirdparty%2Fbind9.git

Run resume_dslookup() from the correct task

The rctx_chaseds() function calls dns_resolver_createfetch(), passing
fctx->task as the target task to run resume_dslookup() from.  This
breaks task-based serialization of events as fctx->task is the task that
the dns_resolver_createfetch() caller wants to receive its fetch
completion event in; meanwhile, intermediate fetches started by the
resolver itself (e.g. related to QNAME minimization) must use
res->buckets[bucketnum].task instead.  This discrepancy may cause
trouble if the resume_dslookup() callback happens to be run concurrently
with e.g. fctx_doshutdown().

Fix by passing the correct task to dns_resolver_createfetch() in
rctx_chaseds().
---

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 0c69b47af13..cd647fea82f 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -9713,6 +9713,7 @@ rctx_chaseds(respctx_t *rctx, dns_message_t *message,
 	fetchctx_t *fctx = rctx->fctx;
 	unsigned int n;
 	fetchctx_t *ev_fctx = NULL;
+	isc_task_t *task = NULL;
 
 	add_bad(fctx, message, addrinfo, result, rctx->broken_type);
 	fctx_cancelqueries(fctx, true, false);
@@ -9725,10 +9726,11 @@ rctx_chaseds(respctx_t *rctx, dns_message_t *message,
 
 	fctx_attach(fctx, &ev_fctx);
 
+	task = fctx->res->buckets[fctx->bucketnum].task;
 	result = dns_resolver_createfetch(
 		fctx->res, fctx->nsname, dns_rdatatype_ns, NULL, NULL, NULL,
-		NULL, 0, fctx->options, 0, NULL, fctx->task, resume_dslookup,
-		ev_fctx, &fctx->nsrrset, NULL, &fctx->nsfetch);
+		NULL, 0, fctx->options, 0, NULL, task, resume_dslookup, ev_fctx,
+		&fctx->nsrrset, NULL, &fctx->nsfetch);
 	if (result != ISC_R_SUCCESS) {
 		if (result == DNS_R_DUPLICATE) {
 			result = DNS_R_SERVFAIL;