mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-22 18:19:42 +00:00
Code Issues Releases Wiki Activity

Fix an interfacemgr use-after-free error in zoneconf.c:isself()

Browse Source 
The 'named_g_server->interfacemgr' pointer is saved in the zone
structure using dns_zone_setisself(), as a void* argument to be
passed to the isself() callback, so there is no attach/detach,
and when shutting down, the interface manager can be destroyed
by the shutdown_server(), running in exclusive mode, and causing
isself() to crash when trying to use the pointer.

Instead of keeping the interface manager pointer in the zone
structure, just check and use the 'named_g_server->interfacemgr'
itself, as it was implemented originally in the
3aca8e5bf3740bbcc3bb13dde242d7cc369abb27 commit. Later, in the
8eb88aafee951859264e36c315b1289cd8c2088b commit, the code was
changed to pass the interface manager pointer using the additional
void* argument, but the commit message doesn't mention if there
was any practical reason for that.

Additionally, don't pass the interfacemgr pointer to the
ns_interfacemgr_getaclenv() function before it is checked
against NULL.
This commit is contained in:
Aram Sargsyan 2023-05-24 14:26:04 +00:00
parent 5f62932bb1
commit 64d69e4adc
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
bin/named/zoneconf.c
View File

@ -770,24 +770,27 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
*/
static bool
isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass, void *arg) {
ns_interfacemgr_t *interfacemgr = (ns_interfacemgr_t *)arg;
dns_aclenv_t *env = ns_interfacemgr_getaclenv(interfacemgr);
dns_view_t *view;
const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass,
void *arg ISC_ATTR_UNUSED) {
dns_aclenv_t *env = NULL;
dns_view_t *view = NULL;
dns_tsigkey_t *key = NULL;
isc_netaddr_t netsrc;
isc_netaddr_t netdst;
if (interfacemgr == NULL) {
/* interfacemgr can be destroyed only in exclusive mode. */
if (named_g_server->interfacemgr == NULL) {
return (true);
}
if (!ns_interfacemgr_listeningon(interfacemgr, dstaddr)) {
if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
{
return (false);
}
isc_netaddr_fromsockaddr(&netsrc, srcaddr);
isc_netaddr_fromsockaddr(&netdst, dstaddr);
env = ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL;
view = ISC_LIST_NEXT(view, link))
@ -1305,7 +1308,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
dns_zone_setoption(zone, DNS_ZONEOPT_NOTIFYTOSOA,
cfg_obj_asboolean(obj));
dns_zone_setisself(zone, isself, named_g_server->interfacemgr);
dns_zone_setisself(zone, isself, NULL);
CHECK(configure_zone_acl(
zconfig, vconfig, config, allow_transfer, ac, zone,