]> git.ipfire.org Git - thirdparty/bind9.git/commit
Fix possible race in socket destruction.
authorWitold Kręcicki <wpk@isc.org>
Fri, 17 Jan 2020 13:42:57 +0000 (14:42 +0100)
committerWitold Kręcicki <wpk@isc.org>
Mon, 20 Jan 2020 21:28:36 +0000 (22:28 +0100)
commitfd8788eb94f516d2c6d15ee023c867e938402abf
treee93ec6b2cb2f7e2a64786a41ddeced904975f615
parent42f0e25a4c40b231c04d0493ebbc21105d1617c7
Fix possible race in socket destruction.

When two threads unreferenced handles coming from one socket while
the socket was being destructed we could get a use-after-free:
Having handle H1 coming from socket S1, H2 coming from socket S2,
S0 being a parent socket to S1 and S2:

Thread A                             Thread B
Unref handle H1                      Unref handle H2
Remove H1 from S1 active handles     Remove H2 from S2 active handles
nmsocket_maybe_destroy(S1)           nmsocket_maybe_destroy(S2)
nmsocket_maybe_destroy(S0)           nmsocket_maybe_destroy(S0)
LOCK(S0->lock)
Go through all children, figure
out that we have no more active
handles:
sum of S0->children[i]->ah == 0
UNLOCK(S0->lock)
destroy(S0)
                                     LOCK(S0->lock)
                                      - but S0 is already gone
lib/isc/netmgr/netmgr.c