From 4121af8f7e2910ef443cc6c15cf9397989184db8 Mon Sep 17 00:00:00 2001 From: Aram Sargsyan Date: Thu, 5 Jan 2023 15:01:35 +0000 Subject: [PATCH 1/2] Fix a use-after-free bug in dns_zonemgr_releasezone() The dns_zonemgr_releasezone() function makes a decision to destroy 'zmgr' (based on its references count, after decreasing it) inside a lock, and then destroys the object outside of the lock. This causes a race with dns_zonemgr_detach(), which could destroy the object in the meantime. Change dns_zonemgr_releasezone() to detach from 'zmgr' and destroy the object (if needed) using dns_zonemgr_detach(), outside of the lock. (cherry picked from commit c1fc2122531bdd27ca38434a2632e8dac532bc13) --- lib/dns/zone.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/lib/dns/zone.c b/lib/dns/zone.c index c4814e4b1a..5634f5efdc 100644 --- a/lib/dns/zone.c +++ b/lib/dns/zone.c @@ -18927,8 +18927,6 @@ unlock: void dns_zonemgr_releasezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) { - bool free_now = false; - REQUIRE(DNS_ZONE_VALID(zone)); REQUIRE(DNS_ZONEMGR_VALID(zmgr)); REQUIRE(zone->zmgr == zmgr); @@ -18943,19 +18941,13 @@ dns_zonemgr_releasezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) { ENSURE(zone->kfio == NULL); } + /* Detach below, outside of the write lock. */ zone->zmgr = NULL; - if (isc_refcount_decrement(&zmgr->refs) == 1) { - free_now = true; - } - UNLOCK_ZONE(zone); RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_write); - if (free_now) { - zonemgr_free(zmgr); - } - ENSURE(zone->zmgr == NULL); + dns_zonemgr_detach(&zmgr); } void From 7643e0b60aea08072642ba73aa316c7bdde3acdb Mon Sep 17 00:00:00 2001 From: Aram Sargsyan Date: Thu, 5 Jan 2023 15:07:42 +0000 Subject: [PATCH 2/2] Add a CHANGES note for [GL #3768] (cherry picked from commit d50cb1d45dde4914227dfc1cccebaab1d460298d) --- CHANGES | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/CHANGES b/CHANGES index 3162a8fd0e..2740d65822 100644 --- a/CHANGES +++ b/CHANGES @@ -11,6 +11,10 @@ 6061. [bug] Fix unexpected "Prohibited" extended DNS error on allow-recursion. [GL #3743] +6060. [bug] Fix a use-after-free bug in dns_zonemgr_releasezone() + by detaching from the zone manager outside of the write + lock. [GL #3768] + 6059. [bug] In some serve stale scenarios, like when following an expired CNAME record, named could return SERVFAIL if the previous request wasn't successful. Consider non-stale