upstream/bind9
1
0
Fork 0
mirror of https://github.com/isc-projects/bind9.git synced 2026-06-11 00:40:00 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Merge branch '3768-dns_zonemgr-use-after-free-v9_18' into 'v9_18'

Browse source 
[9.18] Fix a use-after-free bug in dns_zonemgr_releasezone()

See merge request isc-projects/bind9!7351
This commit is contained in:
Arаm Sаrgsyаn 2023-01-11 12:53:01 +00:00
commit 6d3c38e381
2 changed files with 6 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
CHANGES
View file

@ -11,6 +11,10 @@
6061. [bug] Fix unexpected "Prohibited" extended DNS error
on allow-recursion. [GL #3743]
6060. [bug] Fix a use-after-free bug in dns_zonemgr_releasezone()
by detaching from the zone manager outside of the write
lock. [GL #3768]
6059. [bug] In some serve stale scenarios, like when following an
expired CNAME record, named could return SERVFAIL if the
previous request wasn't successful. Consider non-stale

12
lib/dns/zone.c
View file

@ -18927,8 +18927,6 @@ unlock:
void
dns_zonemgr_releasezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
bool free_now = false;
REQUIRE(DNS_ZONE_VALID(zone));
REQUIRE(DNS_ZONEMGR_VALID(zmgr));
REQUIRE(zone->zmgr == zmgr);
@ -18943,19 +18941,13 @@ dns_zonemgr_releasezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
ENSURE(zone->kfio == NULL);
}
/* Detach below, outside of the write lock. */
zone->zmgr = NULL;
if (isc_refcount_decrement(&zmgr->refs) == 1) {
free_now = true;
}
UNLOCK_ZONE(zone);
RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_write);
if (free_now) {
zonemgr_free(zmgr);
}
ENSURE(zone->zmgr == NULL);
dns_zonemgr_detach(&zmgr);
}
void