Use after detach of task object in rndc
Reported to us via Support Ticket #21126
Reported against BIND 9.16.23
rndc could use a task object after detach when it is being shutdown. Though the crash doesn't cause any issues, it leaves cores on our appliances due to the abort (which support and QA teams don't like)
The following patch is used to fix it:
diff --git a/bind9.16/bin/rndc/rndc.c b/bind9.16/bin/rndc/rndc.c
index 13bb3f4c72a..a56cfede60e 100644
--- a/bind9.16/bin/rndc/rndc.c
+++ b/bind9.16/bin/rndc/rndc.c
@@ -301,6 +301,14 @@ rndc_senddone(isc_task_t *task, isc_event_t *event) {
{
isc_socket_detach(&sock);
isc_task_shutdown(task);
+#ifdef ORIGINAL_ISC_CODE
+#else
+ /*
+ * Detach from the task here. See the corresponding
+ * comment in main().
+ */
+ isc_task_detach(&task);
+#endif
isc_app_shutdown();
}
}
@@ -377,6 +385,14 @@ rndc_recvdone(isc_task_t *task, isc_event_t *event) {
atomic_load_acquire(&recvs) == 0) {
isc_socket_detach(&sock);
isc_task_shutdown(task);
+#ifdef ORIGINAL_ISC_CODE
+#else
+ /*
+ * Detach from the task here. See the corresponding
+ * comment in main().
+ */
+ isc_task_detach(&task);
+#endif
isc_app_shutdown();
}
}
@@ -1069,7 +1085,18 @@ main(int argc, char **argv) {
isc_socket_cancel(sock, task, ISC_SOCKCANCEL_ALL);
}
+#ifdef ORIGINAL_ISC_CODE
isc_task_detach(&task);
+#else
+ /*
+ * Don't detach from the task here as it creates a race with
+ * rndc_start() if the app context exits due to a signal before
+ * rndc_start() is run. This causes a crash when the task object
+ * is used within rndc_start() thread. Instead, rndc_senddone()
+ * or rndc_recvdone() will detach from the task right before it
+ * shuts down the app.
+ */
+#endif
isc_managers_destroy(&netmgr, &taskmgr);
isc_socketmgr_destroy(&socketmgr);
isc_log_destroy(&log);
Edited by Ondřej Surý