UAF in req_senddone on shutdown
From https://gitlab.isc.org/isc-projects/bind9/-/jobs/2793682
D:inline:Core was generated by `/builds/isc-projects/bind9/bin/named/.libs/named -D inline-ns2 -X named.lock -m'.
D:inline:Program terminated with signal SIGABRT, Aborted.
D:inline:Sent by thr_kill() from pid 27679 and user 1001.
D:inline:#0 0x000000080151369a in thr_kill () from /lib/libc.so.7
D:inline:[Current thread is 1 (LWP 100288)]
D:inline:#0 0x000000080151369a in thr_kill () from /lib/libc.so.7
D:inline:#1 0x0000000801511af4 in raise () from /lib/libc.so.7
D:inline:#2 0x0000000801487719 in abort () from /lib/libc.so.7
D:inline:#3 0x000000000024013d in library_fatal_error (file=0x8008aeb37 "request.c", line=979, format=0x8008a1b5c "%s(): %s() failed with error %d (%s)", args=0x7fffdfffdb30) at main.c:278
D:inline:#4 0x00000008003194a5 in isc_error_fatal (file=0x187c0 <error: Cannot access memory at address 0x187c0>, line=6, format=0x0) at error.c:68
D:inline:#5 0x00000008009c7cf0 in req_senddone (eresult=<optimized out>, region=<optimized out>, arg=<optimized out>) at request.c:993
D:inline:#6 0x0000000800913a75 in send_done (handle=0x801949780, result=ISC_R_SHUTTINGDOWN, cbarg=0x0) at dispatch.c:1920
D:inline:#7 0x0000000800314d88 in isc__nm_udp_send (handle=0x187c0, region=0x7fffdfffdce8, cb=0x800913a40 <send_done>, cbarg=0x0) at netmgr/udp.c:715
D:inline:#8 0x0000000800307a5c in isc_nm_send (handle=0x187c0, region=0x6, cb=0x0, cbarg=0x8015136ba <thr_self+10>) at netmgr/netmgr.c:1984
D:inline:#9 0x0000000800913a10 in dns_dispatch_send (resp=0x805230a00, r=0x7fffdfffdce8, dscp=<optimized out>) at dispatch.c:1971
D:inline:#10 0x00000008009c806c in req_send (request=0x80530db40) at request.c:295
D:inline:#11 0x00000008009c7a96 in req_connected (eresult=ISC_R_SUCCESS, region=<optimized out>, arg=0x80530db40) at request.c:957
D:inline:#12 0x000000080091391e in udp_connected (handle=0x801949780, eresult=ISC_R_SUCCESS, arg=0x805230a00) at dispatch.c:1804
D:inline:#13 0x0000000800307d75 in isc__nm_async_connectcb (worker=<optimized out>, ev0=<optimized out>) at netmgr/netmgr.c:2143
D:inline:#14 0x0000000800305300 in process_netievent (arg=0x80533ad80) at netmgr/netmgr.c:488
D:inline:#15 0x00000008003207a7 in isc__job_cb (idle=0x802f6d548) at job.c:75
D:inline:#16 0x000000080111d5cd in ?? () from /usr/local/lib/libuv.so.1
D:inline:#17 0x0000000801117026 in uv_run () from /usr/local/lib/libuv.so.1
D:inline:#18 0x000000080032792e in loop_run (loop=0x801940530) at loop.c:266
D:inline:#19 0x0000000800326b1c in loop_thread (arg=0x801940530) at loop.c:293
D:inline:#20 0x000000080033d446 in isc__trampoline_run (arg=0x8019f5330) at trampoline.c:198
D:inline:#21 0x000000080133d08c in ?? () from /lib/libthr.so.3
D:inline:#22 0x0000000000000000 in ?? ()
D:inline:Backtrace stopped: Cannot access memory at address 0x7fffdfffe000
@each, can you take a look at this?