Always call set_resigntime with the zone lock held

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 52e2b8a767adff995a31ffe3e456f30ffe752bd8..c07dfb129810d9d28ad8b3e071f47104ebb7849e 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -3854,6 +3854,8 @@ set_resigntime(dns_zone_t *zone) {
        uint32_t nanosecs;
        dns_db_t *db = NULL;
 
+       INSIST(LOCKED_ZONE(zone));
+
        /* We only re-sign zones that can be dynamically updated */
        if (zone->update_disabled) {
                return;
@@ -7166,8 +7168,8 @@ failure:
                dns_db_detach(&db);
        }
        if (result == ISC_R_SUCCESS) {
-               set_resigntime(zone);
                LOCK_ZONE(zone);
+               set_resigntime(zone);
                zone_needdump(zone, DNS_DUMP_DELAY);
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
                UNLOCK_ZONE(zone);
@@ -8884,7 +8886,9 @@ done:
                nsec3chain = ISC_LIST_HEAD(cleanup);
        }
 
+       LOCK_ZONE(zone);
        set_resigntime(zone);
+       UNLOCK_ZONE(zone);
 
 failure:
        if (result != ISC_R_SUCCESS) {
@@ -9622,14 +9626,13 @@ pauseall:
                signing = ISC_LIST_HEAD(cleanup);
        }
 
+       LOCK_ZONE(zone);
        set_resigntime(zone);
-
        if (commit) {
-               LOCK_ZONE(zone);
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
                zone_needdump(zone, DNS_DUMP_DELAY);
-               UNLOCK_ZONE(zone);
        }
+       UNLOCK_ZONE(zone);
 
 failure:
        if (result != ISC_R_SUCCESS) {