diff --git a/debian/changelog b/debian/changelog index 051027b..3e72fba 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,3 +1,11 @@ +bind9 (1:9.10.3.dfsg.P4-8ubuntu1.15) xenial; urgency=medium + + * d/p/ubuntu//lp-1833400*: fix race on shutdown (LP: #1833400) + * d/p/fix-shutdown-race.diff: dig/host/nslookup could crash when interrupted + close to a query timeout (LP: #1797926) + + -- Christian Ehrhardt Mon, 05 Aug 2019 07:30:49 +0200 + bind9 (1:9.10.3.dfsg.P4-8ubuntu1.14) xenial-security; urgency=medium * SECURITY UPDATE: limiting simultaneous TCP clients is ineffective diff --git a/debian/patches/fix-shutdown-race.diff b/debian/patches/fix-shutdown-race.diff new file mode 100644 index 0000000..ae72e03 --- /dev/null +++ b/debian/patches/fix-shutdown-race.diff @@ -0,0 +1,41 @@ +From f2ca287330110993609fa0443d3bdb17629bd979 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= +Date: Tue, 13 Nov 2018 13:50:47 +0100 +Subject: [PATCH 1/2] Fix a shutdown race in bin/dig/dighost.c + +If a tool using the routines defined in bin/dig/dighost.c is sent an +interruption signal around the time a connection timeout is scheduled to +fire, connect_timeout() may be executed after destroy_libs() detaches +from the global task (setting 'global_task' to NULL), which results in a +crash upon a UDP retry due to bringup_timer() attempting to create a +timer with 'task' set to NULL. Fix by preventing connect_timeout() from +attempting a retry when shutdown is in progress. + +(cherry picked from commit 462175659674a10c0d39c7c328f1a5324ce2e38b) + +Origin: backport, https://gitlab.isc.org/isc-projects/bind9/merge_requests/1040/diffs +Bug: https://gitlab.isc.org/isc-projects/bind9/issues/599 +Bug-Ubuntu: https://bugs.launchpad.net/ubuntu/+source/bind9/+bug/1797926 +Last-Update: 2018-12-06 + +--- + bin/dig/dighost.c | 5 +++++ + 1 file changed, 5 insertions(+) +diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c +index 39abb9d0fd..17e0328228 100644 +--- a/bin/dig/dighost.c ++++ b/bin/dig/dighost.c +@@ -3240,6 +3240,11 @@ connect_timeout(isc_task_t *task, isc_event_t *event) { + + INSIST(!free_now); + ++ if (cancel_now) { ++ UNLOCK_LOOKUP; ++ return; ++ } ++ + if ((query != NULL) && (query->lookup->current_query != NULL) && + (ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) { + debug("trying next server..."); +--- +2.18.1 diff --git a/debian/patches/series b/debian/patches/series index bdcff1c..ef34d45 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -31,3 +31,6 @@ CVE-2018-5745.patch CVE-2019-6465.patch CVE-2018-5743.patch CVE-2018-5743-atomic-fix.patch +ubuntu/lp-1833400-master-fix-dispatch.c-shutdown-race.patch +ubuntu/lp-1833400-master-Remove-REQUIRE-preventing-change-4592-from-wo.patch +fix-shutdown-race.diff diff --git a/debian/patches/ubuntu/lp-1833400-master-Remove-REQUIRE-preventing-change-4592-from-wo.patch b/debian/patches/ubuntu/lp-1833400-master-Remove-REQUIRE-preventing-change-4592-from-wo.patch new file mode 100644 index 0000000..a2f22b8 --- /dev/null +++ b/debian/patches/ubuntu/lp-1833400-master-Remove-REQUIRE-preventing-change-4592-from-wo.patch @@ -0,0 +1,33 @@ +From a94d68ce432b9e11c4ae91d48ee257b1675f86d7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= +Date: Tue, 24 Oct 2017 21:02:05 +0200 +Subject: [PATCH] [master] Remove REQUIRE preventing change 4592 from working + +Change 4592 was supposed to replace a REQUIRE with a conditional return. +While the latter was added, the former was not removed. Remove the +relevant REQUIRE to fix RT #43822 for good. + +Origin: upstream, https://gitlab.isc.org/isc-projects/bind9/commit/dadca599daec203a24dd6beee0590c038f9301c3 +Bug-Ubuntu: https://bugs.launchpad.net/bugs/1833400 +Bug: https://bugs.isc.org/Public/Bug/Display.html?id=43822 +Last-Update: 2019-08-07 + +--- + lib/dns/dispatch.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c +index 4f668a102d..607a730395 100644 +--- a/lib/dns/dispatch.c ++++ b/lib/dns/dispatch.c +@@ -3718,7 +3718,6 @@ dns_dispatch_importrecv(dns_dispatch_t *disp, isc_event_t *event) { + isc_socketevent_t *sevent, *newsevent; + + REQUIRE(VALID_DISPATCH(disp)); +- REQUIRE((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0); + REQUIRE(event != NULL); + + if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0) +-- +2.22.0 + diff --git a/debian/patches/ubuntu/lp-1833400-master-fix-dispatch.c-shutdown-race.patch b/debian/patches/ubuntu/lp-1833400-master-fix-dispatch.c-shutdown-race.patch new file mode 100644 index 0000000..c009ca7 --- /dev/null +++ b/debian/patches/ubuntu/lp-1833400-master-fix-dispatch.c-shutdown-race.patch @@ -0,0 +1,47 @@ +From 019132b70c368bc9abca0034d07b324bb7cb6eb2 Mon Sep 17 00:00:00 2001 +From: Evan Hunt +Date: Thu, 20 Apr 2017 17:41:37 -0700 +Subject: [PATCH] [master] fix dispatch.c shutdown race + +4952. [bug] A race condition on shutdown could trigger an + assertion failure in dispatch.c. [RT #43822] + +Origin: backport, https://gitlab.isc.org/isc-projects/bind9/commit/70590c691b410303ac44f879e0a3b2b58711a3de +Bug-Ubuntu: https://bugs.launchpad.net/bugs/1833400 +Bug: https://bugs.isc.org/Public/Bug/Display.html?id=43822 +Last-Update: 2019-08-07 + +--- + CHANGES | 3 +++ + lib/dns/dispatch.c | 5 ++++- + lib/dns/include/dns/dispatch.h | 3 +++ + 3 files changed, 10 insertions(+), 1 deletion(-) + +--- a/lib/dns/dispatch.c ++++ b/lib/dns/dispatch.c +@@ -3691,9 +3691,12 @@ dns_dispatch_importrecv(dns_dispatch_t * + REQUIRE((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) != 0); + REQUIRE(event != NULL); + +- sevent = (isc_socketevent_t *)event; ++ if ((disp->attributes & DNS_DISPATCHATTR_NOLISTEN) == 0) ++ return; + ++ sevent = (isc_socketevent_t *)event; + INSIST(sevent->n <= disp->mgr->buffersize); ++ + newsevent = (isc_socketevent_t *) + isc_event_allocate(disp->mgr->mctx, NULL, + DNS_EVENT_IMPORTRECVDONE, udp_shrecv, +--- a/lib/dns/include/dns/dispatch.h ++++ b/lib/dns/include/dns/dispatch.h +@@ -524,6 +524,9 @@ dns_dispatch_importrecv(dns_dispatch_t * + * shared between dispatchers and clients. If the dispatcher fails to copy + * or send the event, nothing happens. + * ++ * If the attribute DNS_DISPATCHATTR_NOLISTEN is not set, then ++ * the dispatch is already handling a recv; return immediately. ++ * + * Requires: + *\li disp is valid, and the attribute DNS_DISPATCHATTR_NOLISTEN is set. + * event != NULL