From: Ondřej Surý <ondrej@sury.org>
Date: Sat, 20 Jul 2019 20:10:49 +0000 (-0400)
Subject: Fix unprotected access to thread->epoll_events[fd] in unwatch_fd()
X-Git-Tag: v9.15.5~24^2
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=718a317dc7dbf836b604073e477ce4029272f321;p=thirdparty%2Fbind9.git

Fix unprotected access to thread->epoll_events[fd] in unwatch_fd()
---

diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index 7c53ec2325a..50636198800 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -881,17 +881,15 @@ wakeup_socket(isc__socketthread_t *thread, int fd, int msg) {
 		LOCK(&thread->fdlock[lockid]);
 		INSIST(thread->fdstate[fd] == CLOSE_PENDING);
 		thread->fdstate[fd] = CLOSED;
-		UNLOCK(&thread->fdlock[lockid]);
 		(void)unwatch_fd(thread, fd, SELECT_POKE_READ);
 		(void)unwatch_fd(thread, fd, SELECT_POKE_WRITE);
 		(void)close(fd);
+		UNLOCK(&thread->fdlock[lockid]);
 		return;
 	}
 
 	LOCK(&thread->fdlock[lockid]);
 	if (thread->fdstate[fd] == CLOSE_PENDING) {
-		UNLOCK(&thread->fdlock[lockid]);
-
 		/*
 		 * We accept (and ignore) any error from unwatch_fd() as we are
 		 * closing the socket, hoping it doesn't leave dangling state in
@@ -902,6 +900,7 @@ wakeup_socket(isc__socketthread_t *thread, int fd, int msg) {
 		 */
 		(void)unwatch_fd(thread, fd, SELECT_POKE_READ);
 		(void)unwatch_fd(thread, fd, SELECT_POKE_WRITE);
+		UNLOCK(&thread->fdlock[lockid]);
 		return;
 	}
 	if (thread->fdstate[fd] != MANAGED) {