From: Evan Hunt <each@isc.org>
Date: Wed, 19 Feb 2014 07:32:02 +0000 (-0800)
Subject: [master] fix dns_resolver_destroyfetch race
X-Git-Tag: v9.10.0b1~74
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=7f5bdf7f4063c2fefb18900468d2c851f8de7816;p=thirdparty%2Fbind9.git

[master] fix dns_resolver_destroyfetch race

3747.	[bug]		A race condition could lead to a core dump when
			destroying a resolver fetch object. [RT #35385]
---

diff --git a/CHANGES b/CHANGES
index 7dd836779a2..a2c409ff52e 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3747.	[bug]		A race condition could lead to a core dump when
+			destroying a resolver fetch object. [RT #35385]
+
 3746.	[func]		New "max-zone-ttl" option enforces maximum
 			TTLs for zones. If loading a zone containing a
 			higher TTL, the load fails. DDNS updates with
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index fa188c12871..66ab41fe523 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -357,6 +357,7 @@ typedef struct {
 
 struct dns_fetch {
 	unsigned int			magic;
+	isc_mem_t *			mctx;
 	fetchctx_t *			private;
 };
 
@@ -8561,6 +8562,8 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
 	fetch = isc_mem_get(res->mctx, sizeof(*fetch));
 	if (fetch == NULL)
 		return (ISC_R_NOMEMORY);
+	fetch->mctx = NULL;
+	isc_mem_attach(res->mctx, &fetch->mctx);
 
 	bucketnum = dns_name_fullhash(name, ISC_FALSE) % res->nbuckets;
 
@@ -8651,7 +8654,7 @@ dns_resolver_createfetch2(dns_resolver_t *res, dns_name_t *name,
 		FTRACE("created");
 		*fetchp = fetch;
 	} else
-		isc_mem_put(res->mctx, fetch, sizeof(*fetch));
+		isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
 
 	return (result);
 }
@@ -8742,7 +8745,7 @@ dns_resolver_destroyfetch(dns_fetch_t **fetchp) {
 
 	UNLOCK(&res->buckets[bucketnum].lock);
 
-	isc_mem_put(res->mctx, fetch, sizeof(*fetch));
+	isc_mem_putanddetach(&fetch->mctx, fetch, sizeof(*fetch));
 	*fetchp = NULL;
 
 	if (bucket_empty)