Mercurial > hg > nginx
annotate src/os/unix/ngx_sunpro_atomic_sparc64.h @ 7048:80224192163c
Resolver: fixed possible use-after-free while resolving SRV.
Resolving an SRV record includes resolving its host names in subrequests.
Previously, if memory allocation failed while reporting a subrequest result
after receiving a response from a DNS server, the SRV resolve handler was
called immediately with the NGX_ERROR state. However, if the SRV record
included another copy of the resolved name, it was reported once again.
This could trigger the use-after-free memory access after SRV resolve
handler freed the resolve context by calling ngx_resolve_name_done().
Now the SRV resolve handler is called only when all its subrequests are
completed.
author | Roman Arutyunyan <arut@nginx.com> |
---|---|
date | Tue, 04 Jul 2017 18:07:29 +0300 |
parents | d620f497c50f |
children |
rev | line source |
---|---|
561 | 1 |
2 /* | |
3 * Copyright (C) Igor Sysoev | |
4412 | 4 * Copyright (C) Nginx, Inc. |
561 | 5 */ |
6 | |
7 | |
8 #if (NGX_PTR_SIZE == 4) | |
9 #define NGX_CASA ngx_casa | |
10 #else | |
11 #define NGX_CASA ngx_casxa | |
12 #endif | |
13 | |
14 | |
15 ngx_atomic_uint_t | |
16 ngx_casa(ngx_atomic_uint_t set, ngx_atomic_uint_t old, ngx_atomic_t *lock); | |
17 | |
18 ngx_atomic_uint_t | |
19 ngx_casxa(ngx_atomic_uint_t set, ngx_atomic_uint_t old, ngx_atomic_t *lock); | |
20 | |
21 /* the code in src/os/unix/ngx_sunpro_sparc64.il */ | |
22 | |
23 | |
24 static ngx_inline ngx_atomic_uint_t | |
25 ngx_atomic_cmp_set(ngx_atomic_t *lock, ngx_atomic_uint_t old, | |
26 ngx_atomic_uint_t set) | |
27 { | |
1186
c114defa4518
fix atomic operations on sparc64 built by SunPro C
Igor Sysoev <igor@sysoev.ru>
parents:
611
diff
changeset
|
28 set = NGX_CASA(set, old, lock); |
561 | 29 |
30 return (set == old); | |
577 | 31 } |
561 | 32 |
33 | |
34 static ngx_inline ngx_atomic_int_t | |
35 ngx_atomic_fetch_add(ngx_atomic_t *value, ngx_atomic_int_t add) | |
36 { | |
37 ngx_atomic_uint_t old, res; | |
38 | |
39 old = *value; | |
40 | |
41 for ( ;; ) { | |
42 | |
43 res = old + add; | |
44 | |
1186
c114defa4518
fix atomic operations on sparc64 built by SunPro C
Igor Sysoev <igor@sysoev.ru>
parents:
611
diff
changeset
|
45 res = NGX_CASA(res, old, value); |
561 | 46 |
47 if (res == old) { | |
48 return res; | |
49 } | |
50 | |
51 old = res; | |
52 } | |
53 } | |
563 | 54 |
55 | |
56 #define ngx_memory_barrier() \ | |
57 __asm (".volatile"); \ | |
58 __asm ("membar #LoadLoad | #LoadStore | #StoreStore | #StoreLoad"); \ | |
59 __asm (".nonvolatile") | |
611 | 60 |
61 #define ngx_cpu_pause() |