[master] fix dns_resolver_destroyfetch race

3747.	[bug]		A race condition could lead to a core dump when
			destroying a resolver fetch object. [RT #35385]

diff --git a/CHANGES b/CHANGES
index 7dd836779a26fcadd99fc3ff976ccf7dd9668682..a2c409ff52ef0ac6ba586107531c5c20c0334b31 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3747.  [bug]           A race condition could lead to a core dump when
+                       destroying a resolver fetch object. [RT #35385]
+
 3746.  [func]          New "max-zone-ttl" option enforces maximum
                        TTLs for zones. If loading a zone containing a
                        higher TTL, the load fails. DDNS updates with

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index fa188c128717b1bde77e947b3ebadeca3746eda5..66ab41fe523fbbd1eedbfa211939fe746430ba97 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -357,6 +357,7 @@ typedef struct {
 
 struct dns_fetch {
        unsigned int                    magic;
+       isc_mem_t *                     mctx;
        fetchctx_t *                    private;
 };
 
@@ -8561,6 +8562,8 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
        fetch = isc_mem_get(res->mctx, sizeof(*fetch));
        if (fetch == NULL)
                return (ISC_R_NOMEMORY);
+       fetch->mctx = NULL;
+       isc_mem_attach(res->mctx, &fetch->mctx);
 
        bucketnum = dns_name_fullhash(name, ISC_FALSE) % res->nbuckets;
 
@@ -8651,7 +8654,7 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
                FTRACE("created");
                *fetchp = fetch;
        } else
-               isc_mem_put(res->mctx, fetch, sizeof(*fetch));
+               isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
 
        return (result);
 }
@@ -8742,7 +8745,7 @@ dns_resolver_destroyfetch(dns_fetch_t **fetchp) {
 
        UNLOCK(&res->buckets[bucketnum].lock);
 
-       isc_mem_put(res->mctx, fetch, sizeof(*fetch));
+       isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
        *fetchp = NULL;
 
        if (bucket_empty)