From e018281d3b176134033ada813ea4a050c89cbfbc Mon Sep 17 00:00:00 2001 From: Robert Lubos Date: Wed, 19 Jun 2024 14:10:55 +0200 Subject: [PATCH] net: lib: dns: Fix DNS dispatcher double net buf unref The `dns_data` buffer, allocated by the DNS dispatcher was dereferenced twice - once in registered DNS handler, second time in the dispatcher itself. Since the buffer was allocated by the dispatcher, and it's not really guaranteed that the buffer will be freed in the registered handler (this depends on the processing outcome, the function may return early w/o freeing the net buf in case of errors), it makes most sense for the dispatcher to keep ownership of the buffer. Hence, the registered handlers will no longer release the buffer provided in any case, and the dispatcher will free it on exit. Signed-off-by: Robert Lubos --- subsys/net/lib/dns/mdns_responder.c | 2 -- subsys/net/lib/dns/resolve.c | 4 ---- 2 files changed, 6 deletions(-) diff --git a/subsys/net/lib/dns/mdns_responder.c b/subsys/net/lib/dns/mdns_responder.c index 568899cc588..043878a4fe4 100644 --- a/subsys/net/lib/dns/mdns_responder.c +++ b/subsys/net/lib/dns/mdns_responder.c @@ -659,8 +659,6 @@ static int dispatcher_cb(void *my_ctx, int sock, NET_DBG("%s read failed (%d)", "mDNS", ret); } - net_buf_unref(dns_data); - return ret; } diff --git a/subsys/net/lib/dns/resolve.c b/subsys/net/lib/dns/resolve.c index ec25773b9f0..f8d7a2cb1a8 100644 --- a/subsys/net/lib/dns/resolve.c +++ b/subsys/net/lib/dns/resolve.c @@ -275,10 +275,6 @@ quit: release_query(&ctx->queries[i]); free_buf: - if (dns_data) { - net_buf_unref(dns_data); - } - if (dns_cname) { net_buf_unref(dns_cname); }