ComputerSurge/bind9
3
0
Fork 0
Code Pull Requests 1 Activity

Purge memory pool upon plugin destruction

Browse Source 
The typical sequence of events for AAAA queries which trigger recursion
for an A RRset at the same name is as follows:

 1. Original query context is created.
 2. An AAAA RRset is found in cache.
 3. Client-specific data is allocated from the filter-aaaa memory pool.
 4. Recursion is triggered for an A RRset.
 5. Original query context is torn down.

 6. Recursion for an A RRset completes.
 7. A second query context is created.
 8. Client-specific data is retrieved from the filter-aaaa memory pool.
 9. The response to be sent is processed according to configuration.
10. The response is sent.
11. Client-specific data is returned to the filter-aaaa memory pool.
12. The second query context is torn down.

However, steps 6-12 are not executed if recursion for an A RRset is
canceled.  Thus, if named is in the process of recursing for A RRsets
when a shutdown is requested, the filter-aaaa memory pool will have
outstanding allocations which will never get released.  This in turn
leads to a crash since every memory pool must not have any outstanding
allocations by the time isc_mempool_destroy() is called.

Fix by creating a stub query context whenever fetch_callback() is called,
including cancellation events. When the qctx is destroyed, it will ensure
the client is detached and the plugin memory is freed.
This commit is contained in:
Evan Hunt
2019-05-22 10:58:41 +02:00
parent b2408003d4
commit 86eddebc83
2 changed files with 36 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
lib/ns/tests/nstest.c
View File

@@ -818,7 +818,7 @@ ns_test_qctx_create(const ns_test_qctx_create_params_t *params,
result = attach_query_msg_to_client(client, params->qname,
params->qtype, params->qflags);
if (result != ISC_R_SUCCESS) {
goto detach_client;
goto detach_view;
}
/*
@@ -849,6 +849,8 @@ ns_test_qctx_create(const ns_test_qctx_create_params_t *params,
destroy_query:
dns_message_destroy(&client->message);
detach_view:
dns_view_detach(&client->view);
detach_client:
isc_nmhandle_detach(&client->handle);