3138. [bug] Address memory leaks and out-of-order operations when

                        shutting named down. [RT #25210]

diff --git a/CHANGES b/CHANGES
index b75cb442cf8b60aa5b724285a01aee329fbc308b..99ccfe9ab91af06d137be3e3d96db5bc34041b71 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3138.  [bug]           Address memory leaks and out-of-order operations when
+                       shutting named down. [RT #25210]
+
 3135.  [port]          FreeBSD: workaround broken IPV6_USE_MIN_MTU processing.
                        See http://www.freebsd.org/cgi/query-pr.cgi?pr=158307
                        [RT #24950]

diff --git a/bin/named/client.c b/bin/named/client.c
index 9186bb902b7d6b81fc3d090812f571c257f48e4c..0eea5ad9c169a60bc1324301b78f2d3ded9907fb 100644 (file)
--- a/bin/named/client.c
+++ b/bin/named/client.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: client.c,v 1.271.10.1 2011/05/05 23:53:16 marka Exp $ */
+/* $Id: client.c,v 1.271.10.2 2011/07/28 04:30:54 marka Exp $ */
 
 #include <config.h>
 
@@ -1313,6 +1313,12 @@ ns_client_isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 
        UNUSED(arg);
 
+       /*
+        * ns_g_server->interfacemgr is task exclusive locked.
+        */
+       if (ns_g_server->interfacemgr == NULL)
+               return (ISC_TRUE);
+
        if (!ns_interfacemgr_listeningon(ns_g_server->interfacemgr, dstaddr))
                return (ISC_FALSE);
 

diff --git a/bin/named/xfrout.c b/bin/named/xfrout.c
index 4b4d6c0ceb62893bedeebacbb35128951258ce59..b749f40c66aa01c50b72e7200dfa30ba8415f1f6 100644 (file)
--- a/bin/named/xfrout.c
+++ b/bin/named/xfrout.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: xfrout.c,v 1.139.16.2 2011/03/10 23:47:25 tbox Exp $ */
+/* $Id: xfrout.c,v 1.139.16.3 2011/07/28 04:30:54 marka Exp $ */
 
 #include <config.h>
 
@@ -1064,9 +1064,9 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 
        CHECK(xfr->stream->methods->first(xfr->stream));
 
-       if (xfr->tsigkey != NULL) {
+       if (xfr->tsigkey != NULL)
                dns_name_format(&xfr->tsigkey->name, keyname, sizeof(keyname));
-       } else
+       else
                keyname[0] = '\0';
        if (is_poll)
                xfrout_log1(client, question_name, question_class,
@@ -1136,7 +1136,8 @@ xfrout_ctx_create(isc_mem_t *mctx, ns_client_t *client, unsigned int id,
        xfr = isc_mem_get(mctx, sizeof(*xfr));
        if (xfr == NULL)
                return (ISC_R_NOMEMORY);
-       xfr->mctx = mctx;
+       xfr->mctx = NULL;
+       isc_mem_attach(mctx, &xfr->mctx);
        xfr->client = NULL;
        ns_client_attach(client, &xfr->client);
        xfr->id = id;
@@ -1510,6 +1511,7 @@ sendstream(xfrout_ctx_t *xfr) {
 static void
 xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
        xfrout_ctx_t *xfr = *xfrp;
+       ns_client_t *client = NULL;
 
        INSIST(xfr->sends == 0);
 
@@ -1533,9 +1535,14 @@ xfrout_ctx_destroy(xfrout_ctx_t **xfrp) {
        if (xfr->db != NULL)
                dns_db_detach(&xfr->db);
 
+       /*
+        * We want to detch the client after we have released the memory
+        * context as ns_client_detach checks the memory reference count.
+        */
+       ns_client_attach(xfr->client, &client);
        ns_client_detach(&xfr->client);
-
-       isc_mem_put(xfr->mctx, xfr, sizeof(*xfr));
+       isc_mem_putanddetach(&xfr->mctx, xfr, sizeof(*xfr));
+       ns_client_detach(&client);
 
        *xfrp = NULL;
 }

diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index 003c75ab0e06de0d4afafcdce1c2d6860b38244b..837e67640c2807a4b0c67ad3a51425c8b1b34e88 100644 (file)
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.c,v 1.333.14.7 2011/07/21 23:47:14 tbox Exp $ */
+/* $Id: socket.c,v 1.333.14.8 2011/07/28 04:30:54 marka Exp $ */
 
 /*! \file */
 
@@ -4489,9 +4489,8 @@ isc__socket_recvv(isc_socket_t *sock0, isc_bufferlist_t *buflist,
        INSIST(sock->bound);
 
        dev = allocate_socketevent(sock, ISC_SOCKEVENT_RECVDONE, action, arg);
-       if (dev == NULL) {
+       if (dev == NULL)
                return (ISC_R_NOMEMORY);
-       }
 
        /*
         * UDP sockets are always partial read
@@ -4695,9 +4694,8 @@ isc__socket_sendto(isc_socket_t *sock0, isc_region_t *region,
        INSIST(sock->bound);
 
        dev = allocate_socketevent(sock, ISC_SOCKEVENT_SENDDONE, action, arg);
-       if (dev == NULL) {
+       if (dev == NULL)
                return (ISC_R_NOMEMORY);
-       }
 
        dev->region = *region;
 
@@ -4736,9 +4734,8 @@ isc__socket_sendtov(isc_socket_t *sock0, isc_bufferlist_t *buflist,
        REQUIRE(iocount > 0);
 
        dev = allocate_socketevent(sock, ISC_SOCKEVENT_SENDDONE, action, arg);
-       if (dev == NULL) {
+       if (dev == NULL)
                return (ISC_R_NOMEMORY);
-       }
 
        /*
         * Move each buffer from the passed in list to our internal one.
@@ -5155,6 +5152,7 @@ isc__socket_accept(isc_socket_t *sock0,
         */
        isc_task_attach(task, &ntask);
        if (isc_task_exiting(ntask)) {
+               free_socket(&nsock);
                isc_task_detach(&ntask);
                isc_event_free(ISC_EVENT_PTR(&dev));
                UNLOCK(&sock->lock);

diff --git a/lib/isc/win32/socket.c b/lib/isc/win32/socket.c
index bf915f7f0d0945fd572087e7d0266838f391f0c9..047e1397b3ea6c6f49029b6979f99cb6e5d601ab 100644 (file)
--- a/lib/isc/win32/socket.c
+++ b/lib/isc/win32/socket.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: socket.c,v 1.87 2010/12/09 06:08:05 marka Exp $ */
+/* $Id: socket.c,v 1.87.22.1 2011/07/28 04:30:55 marka Exp $ */
 
 /* This code uses functions which are only available on Server 2003 and
  * higher, and Windows XP and higher.
@@ -3314,6 +3314,7 @@ isc__socket_accept(isc_socket_t *sock,
         */
        isc_task_attach(task, &ntask);
        if (isc_task_exiting(ntask)) {
+               free_socket(&nsock, __LINE__);
                isc_task_detach(&ntask);
                isc_event_free(ISC_EVENT_PTR(&adev));
                UNLOCK(&sock->lock);