1.8: consomme: fix deadlock and UAF in Windows DNS resolver (#4032) - #4122
Merged
Steven Malis (smalis-msft) merged 1 commit intoAug 4, 2026
Conversation
We had a DNS vmm test flake by timing out. The lock on pending_requests is being held inside cancel_all while a completion called the callback, which tries to take the same mutex, resulting in a deadlock. Fix this by not holding the lock over the calls to DnsCancelQueryRaw, but also narrow the lock windows everywhere else too. Then wrap the handle in an Arc to ensure that it stays alive across all possible asynchronous flows, fixing a potential UAF. (cherry picked from commit ed36005)
Steven Malis (smalis-msft)
added
the
release_1.8.2607
|
This PR modifies files containing For more on why we check whole files, instead of just diffs, check out the Rustonomicon |
Steven Malis (smalis-msft)
enabled auto-merge (squash)
July 31, 2026 17:20
Contributor
There was a problem hiding this comment.
Pull request overview
Backports the Windows DnsQueryRaw-based resolver fix from #4032 to the release/1.8.2607 branch, addressing a deadlock during cancellation and a potential use-after-free by ensuring the DNS cancel handle remains alive across async callback/cancel flows.
Changes:
- Avoid holding the
pending_requestsmutex while callingDnsCancelQueryRaw(prevents self-deadlock when callbacks re-enter). - Store cancel handles as
Arc<RawCancelHandle>to keep the underlyingDNS_QUERY_RAW_CANCELallocation alive across async paths. - Narrow
pending_requestslock windows inquery()andcancel_all().
Suppressed comments (1)
vm/devices/net/net_consomme/consomme/src/dns_resolver/windows/mod.rs:282
Slab::removewill panic if the key is already absent. Because this is invoked from an OS callback (and entries can be removed via other paths), prefertry_removehere to avoid turning unexpected callback ordering into a process panic.
let _cancel_handle = context.pending_requests.lock().remove(context.slab_key);
| // Remove placeholder since callback won't fire on error | ||
| if result != DNS_REQUEST_PENDING { | ||
| // Remove the cancel handle since the callback won't fire on error. | ||
| self.pending_requests.lock().remove(slab_key); |
Matt LaFayette (Kurjanowicz) (mattkur)
approved these changes
Aug 4, 2026
Steven Malis (smalis-msft)
merged commit Aug 4, 2026
0850d01
into
microsoft:release/1.8.2607
124 of 126 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #4032 to
release/1.8.2607.The cherry-pick of ed36005 applied cleanly onto
release/1.8.2607with no conflicts and no manual edits.Original PR: #4032
This backport PR was created by an AI agent (GitHub Copilot) on behalf of Steven Malis (@smalis-msft).