Fix a crash due to use-after-free (#38495)

diff --git a/CHANGES b/CHANGES
index b458bced4fa379845de847d167ae4c33e52b5a26..d915355e45bcc40d85f7153c93407de7a656f56e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4087.  [bug]           Fix a crash due to use-after-free due to sequencing
+                       of tasks actions. [RT #38495]
+
 4086.  [bug]           Fix out-of-srcdir build with native pkcs11. [RT #38831]
 
 4085.  [bug]           ISC_PLATFORM_HAVEXADDQ could be inconsistently set.

diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index f235879b5cede83242a73d7a07ef706490d3a4bf..4e8785d696b05981a31c7ca8c1ed00e3f8779233 100644 (file)
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -1519,6 +1519,7 @@ clean_finds_at_name(dns_adbname_t *name, isc_eventtype_t evtype,
                           ev, task, find);
 
                        isc_task_sendanddetach(&task, (isc_event_t **)&ev);
+                       find->flags |= FIND_EVENT_SENT;
                } else {
                        DP(DEF_LEVEL, "cfan: skipping find %p", find);
                }

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 57ced0c541f9131875855ebade475ea64d4eac0c..e2419cc639d8e7acf1d90f1a16e5abbe1dbcaa79 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -10206,9 +10206,6 @@ static void
 notify_destroy(dns_notify_t *notify, isc_boolean_t locked) {
        isc_mem_t *mctx;
 
-       /*
-        * Caller holds zone lock.
-        */
        REQUIRE(DNS_NOTIFY_VALID(notify));
 
        if (notify->zone != NULL) {