Fix resquery reference imbalance on TCP connect failure

In fctx_query(), resquery_ref(query) is called before
dns_dispatch_connect() in anticipation of the resquery_connected()
callback consuming the reference.

When dns_dispatch_connect() fails synchronously on TCP (e.g. from
dns_transport_get_tlsctx() failing in tcp_dispatch_connect()), the
connect callback is never scheduled, so the extra reference is never
consumed.  The error path then tears down the query via manual cleanup
(isc_mem_put) without going through the refcount destructor, leaving
the reference imbalanced.

Fix by dropping the extra reference on the error path, just after
dns_dispatch_done() which cleans up the dispatch entry.

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index e15243274c27dde9276c3f1aae4539c9301c24cc..20763e612c41d349fce07c245cb99e110c6bda4e 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2284,10 +2284,11 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
                        isc_log_write(
                                DNS_LOGCATEGORY_RESOLVER,
                                DNS_LOGMODULE_RESOLVER, log_level,
-                               "Unable to establish a connection to %s: %s\n",
+                               "Unable to establish a connection to %s: %s",
                                peerbuf, isc_result_totext(result));
                }
                dns_dispatch_done(&query->dispentry);
+               resquery_unref(query);
                goto cleanup_fetch;
        } else {
                RUNTIME_CHECK(result == ISC_R_SUCCESS);