Skip to content

Fix data races in the cupsEnumDests DNS-SD callbacks - #1780

Merged
michaelrsweet merged 1 commit into
OpenPrinting:masterfrom
anabobillo3:fix-dest-dnssd-locking
Oct 22, 2026
Merged

michaelrsweet merged 1 commit into
OpenPrinting:masterfrom
anabobillo3:fix-dest-dnssd-locking

Conversation

@anabobillo3

Copy link
Copy Markdown
Contributor

This is the CUPS side of OpenPrinting/libcups#186, which makes the same change to libcups's cups/dest.c.

cups_dnssd_get_device and cups_dest_query_cb run on the DNS-SD monitor thread and change the device records that cups_enum_dests reads on the caller's thread: the device state and type, the full name and query, and the options array (cupsAddOption reallocates it while the enumeration loop and the destination callback read it with cupsGetOption). The callbacks only held data->rwlock for reading (or not at all) while doing so, and cupsArrayFind/cupsArrayIndex also update the array's current element under the read lock.

Simply taking the write lock in the callbacks would deadlock: the Avahi monitor thread holds the DNS-SD context mutex while it runs the callbacks, and cups_enum_dests held data.rwlock while calling cupsDNSSDQueryNew, which takes that mutex.

This change:

  • holds the write lock in cups_dnssd_get_device and cups_dest_query_cb for the whole lookup and update, and in the cups_enum_dests polling loop;
  • starts new TXT queries in cups_enum_dests after releasing the lock (devices waiting for one are marked with the existing, previously unused _CUPS_DNSSD_QUERY state), and deletes old queries in cups_dnssd_get_device after releasing it, so data.rwlock is never held across a DNS-SD call;
  • queries a device again when its service changes to IPPS or the local domain while its query is running or its result is not yet reported (before, a device whose TXT record had arrived but was not yet reported was never reported).

Released 2.4.x runs DNS-SD discovery in cupsEnumDests on the caller's thread, so this only affects master.

Testing: a ThreadSanitizer build of libcups.a (Avahi, 4 IPP+IPPS printers published on a private avahi-daemon, 3 cupsEnumDests passes per run) reported 27 warnings per run on current master: data races in cups_enum_dests, cupsGetOption, cups_compare_options and cupsArrayGetElement, and lock-order inversions between data.rwlock and the DNS-SD mutex. With this change none of them remain, over 2 runs each, and every pass still finds all 4 printers with their ipps URIs. ./configure && make builds without warnings and make test in cups/ passes.

ThreadSanitizer still reports the lock-order inversion in dnssd.c at teardown (cupsDNSSDDelete takes dnssd->rwlock and then the Avahi mutex, while avahi_domain_cb takes them in the other order). That one is separate and not changed here.

cups_dnssd_get_device and cups_dest_query_cb run on the DNS-SD monitor
thread and change the device records (state, type, full name, query, and
the options array via cupsAddOption) that cups_enum_dests reads on the
caller's thread, but they only held the read lock (or no lock) while doing
so.  cups_enum_dests also held the lock while calling cupsDNSSDQueryNew,
which takes the DNS-SD context lock the monitor thread holds while running
the callbacks.

- Hold the write lock in cups_dnssd_get_device and cups_dest_query_cb for
  the whole lookup and update, and in the cups_enum_dests polling loop.
- Start new TXT queries in cups_enum_dests after releasing the lock
  (devices waiting for one are marked _CUPS_DNSSD_QUERY) and delete old
  queries in cups_dnssd_get_device after releasing it, so the lock is never
  held across a DNS-SD call.
- Query a device again when its service changes to IPPS or the local
  domain while its query is running or its result is not yet reported.
@michaelrsweet michaelrsweet self-assigned this Oct 22, 2026

@michaelrsweet michaelrsweet left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM, thanks!

@michaelrsweet michaelrsweet added the bug Something isn't working label Oct 22, 2026
@michaelrsweet michaelrsweet added this to the v2.5 milestone Oct 22, 2026
@michaelrsweet
michaelrsweet merged commit 7a1882a into OpenPrinting:master Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants