mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

Don't destroy a non-closed socket, wait for all the callbacks.

Browse Source 
We erroneously tried to destroy a socket after issuing
isc__nm_tcp{,dns}_close. Under some (race) circumstances we could get
nm_socket_cleanup to be called twice for the same socket, causing an
access to a dead memory.
This commit is contained in:
Evan Hunt
2020-07-01 00:49:12 -07:00
committed by Witold Kręcicki
parent 896db0f419
commit 233f134a4f
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
lib/isc/netmgr/netmgr.c
View File

@@ -877,10 +877,10 @@ isc__nmsocket_prep_destroy(isc_nmsocket_t *sock) {
switch (sock->type) {
case isc_nm_tcpsocket:
isc__nm_tcp_close(sock);
break;
return;
case isc_nm_tcpdnssocket:
isc__nm_tcpdns_close(sock);
break;
return;
default:
break;
}
@@ -1068,8 +1068,8 @@ isc__nmhandle_get(isc_nmsocket_t *sock, isc_sockaddr_t *peer,
if (handle == NULL) {
handle = alloc_handle(sock);
} else {
INSIST(VALID_NMHANDLE(handle));
isc_refcount_increment0(&handle->references);
INSIST(VALID_NMHANDLE(handle));
}
isc__nmsocket_attach(sock, &handle->sock);