dnsdist: Prevent race between the DoH handling threads #9278
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- clean up the pointer in pool memory when releasing a DOHUnit so that we don't try to access it later when the memory pool is destroyed ; - clean up the 'self' pointer when the memory pool is destroyed so we don't try to access it when the DOHUnit is released.
|
I've tested this version and dnsdist now seems to be stable even under heavy DoH load. Thanks for the prompt fix! |
Member
Author
|
Thanks a lot for the initial report, your wonderful help to reproduce the issue and testing the fix, that's very much appreciated! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Short description
This PR fixes a race between the different threads involved in DoH handling, leading to use-after-free and a crash in some cases. This is done by making sure that the h2o req object is only accessed from the main DoH thread, where it can't be altered by h2o in the meantime, and by preventing any access to it once the request has been canceled by h2o. It also makes sure that the pointer to our internal DOHUnit object is cleared from the h2o request pool before releasing that DOHUnit object.
This change involves a penalty cost because we now need to copy the HTTP headers, if any, because we need to access them from a different thread than the main DoH one and the internal memory handled by h2o could be gone then, or even be altered under our feet.
This issue was discovered by Tomas Krizek from CZ.NIC while using the DNS Shotgun tool, and reported to us. Many thanks for that!
Checklist
I have: