Fix code to avoid HostDBContinuation use after free #5952
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This stack as been showing up in our environment intermittently for a while.
In this case, the HostDBContinuation->mutex is NULL this causing the crash in do_dns. The handler is set to probeEvent(). I see no place were the hostDBContinuation is created but init() is not called (which sets the mutex). However when the HostDBContinuation is freed, the mutex is nulled.
Ultimately, I think the use-after-free issue is caused by the combination of these two lines.
remove_trigger_pending_dns, walks the pending list and sends a schedule_imm so it can process the result on the invoking thread. However, based on my search of the code, particularly set_check_pending_dns, the current object (this) is on the list. So we just scheduled an event to process that object and then delete the object before the immediate event can be processed (most likely).
The code change removes the extra host_db_cont_free and schedule.