Recent version of c-ares can cause use-after free in dns.cc #2640
Assignees
Comments
elcallio
pushed a commit
to elcallio/seastar
that referenced
this issue
Feb 18, 2025
Fixes scylladb#2640 Recent c-ares (fedora 41 version), will do checks, including closing broken connections etc during FD processing, not only for the fd(s) involved in the processing, unless explicitly disabled. This can break our dns.cc state machine, as we might process a fd, but get a recursive callback which will modify the collection we are iterating over (_sockets) such that our next iterator entry becomes invalid/points to free:d data. Fix is relatively simple, use the now encouraged (newish) API, and turn off this background processing until we are out of the iteration loop. v2: * ifdef:ed old impl back for builds on c-ares older than 1.34
elcallio
pushed a commit
to elcallio/seastar
that referenced
this issue
Feb 18, 2025
Fixes scylladb#2640 Recent c-ares (fedora 41 version), will do checks, including closing broken connections etc during FD processing, not only for the fd(s) involved in the processing, unless explicitly disabled. This can break our dns.cc state machine, as we might process a fd, but get a recursive callback which will modify the collection we are iterating over (_sockets) such that our next iterator entry becomes invalid/points to free:d data. Fix is relatively simple, use the now encouraged (newish) API, and turn off this background processing until we are out of the iteration loop. v2: * ifdef:ed old impl back for builds on c-ares older than 1.34 v3: * Change both implementations to use batch mode processing, bypassing the need to maintain iterability of the socket set while processing.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Recent c-ares (fedora 41 version), will do checks, including closing broken connections etc during FD processing,
not only for the fd(s) involved in the processing, unless explicitly disabled.
This can break our dns.cc state machine, as we might process a fd, but get a recursive callback which will modify the
collection we are iterating over (_sockets) such that our next iterator entry becomes invalid/points to free:d data.
Fix is relatively simple, use the now encouraged (newish) API, and turn off this background processing until we are out of the iteration loop.
The text was updated successfully, but these errors were encountered: