[master] fix race

3804.   [bug]           Corrected a race condition in dispatch.c in which
                        portentry could be reset leading to an assertion
                        failure in socket_search(). (Change #3708
                        addressed the same issue but was incomplete.)
                        [RT #35128]

diff --git a/CHANGES b/CHANGES
index 02e289ae2bd000df0830e6ea5f9f68068962febe..fd134719c2adec84f4478082ea5cf0eea776e075 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+3804.   [bug]           Corrected a race condition in dispatch.c in which
+                        portentry could be reset leading to an assertion
+                        failure in socket_search(). (Change #3708
+                        addressed the same issue but was incomplete.)
+                        [RT #35128]
+
 3803.  [bug]           "named-checkconf -z" incorrectly rejected zones
                        using alternate data sources for not having a "file"
                        option. [RT #35685]

diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 38505562dc2fb3448628312677e60c79a375c9c5..e510dc27d8d5005ac15093dc670e18a992b059f0 100644 (file)
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -796,14 +796,19 @@ deref_portentry(dns_dispatch_t *disp, dispportentry_t **portentryp) {
                                portentry, link);
                isc_mempool_put(disp->portpool, portentry);
        }
-       UNLOCK(&qid->lock);
 
+       /*
+        * Set '*portentryp' to NULL inside the lock so that
+        * dispsock->portentry does not change in socket_search.
+        */
        *portentryp = NULL;
+
+       UNLOCK(&qid->lock);
 }
 
 /*%
  * Find a dispsocket for socket address 'dest', and port number 'port'.
- * Return NULL if no such entry exists.
+ * Return NULL if no such entry exists.  Requires qid->lock to be held.
  */
 static dispsocket_t *
 socket_search(dns_qid_t *qid, isc_sockaddr_t *dest, in_port_t port,