Skip to content

Attach to the dns_dispatchmgr in the dns_view object

Ondřej Surý requested to merge 4228-fix-heap-use-after-free-in-dns_dispatch_createtcp into main

The dns_dispatchmgr object was only set to the dns_view object making it prone to use-after-free in the dns_xfrin unit when shutting down named.

Remove dns_view_setdispatchmgr() and optionally pass the dispatchmgr directly to dns_view_create() when it is attached and not just assigned, so the dns_dispatchmgr doesn't cease to exist too early.

The dns_view_getdnsdispatchmgr() is now protected by the RCU lock, the dispatchmgr reference is incremented, so the caller needs to detach from it, and the function can return NULL in case the dns_view has been already shut down.

Closes #4228 (closed)

Merge request reports