Always call set_resigntime with the zone lock held

(cherry picked from commit 7212961849510f97146f815fa03f1e90de9d3201)

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 332f18f0b877e4edd4b69eb4e8d15736e3707224..b9b873697b7f4b1b8747478d8baf283527444b7a 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -3685,6 +3685,8 @@ set_resigntime(dns_zone_t *zone) {
        uint32_t nanosecs;
        dns_db_t *db = NULL;
 
+       INSIST(LOCKED_ZONE(zone));
+
        /* We only re-sign zones that can be dynamically updated */
        if (zone->update_disabled)
                return;
@@ -6883,8 +6885,8 @@ zone_resigninc(dns_zone_t *zone) {
        } else if (db != NULL)
                dns_db_detach(&db);
        if (result == ISC_R_SUCCESS) {
-               set_resigntime(zone);
                LOCK_ZONE(zone);
+               set_resigntime(zone);
                zone_needdump(zone, DNS_DUMP_DELAY);
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
                UNLOCK_ZONE(zone);
@@ -8530,7 +8532,9 @@ zone_nsec3chain(dns_zone_t *zone) {
                nsec3chain = ISC_LIST_HEAD(cleanup);
        }
 
+       LOCK_ZONE(zone);
        set_resigntime(zone);
+       UNLOCK_ZONE(zone);
 
  failure:
        if (result != ISC_R_SUCCESS) {
@@ -9233,14 +9237,13 @@ zone_sign(dns_zone_t *zone) {
                signing = ISC_LIST_HEAD(cleanup);
        }
 
+       LOCK_ZONE(zone);
        set_resigntime(zone);
-
        if (commit) {
-               LOCK_ZONE(zone);
                DNS_ZONE_SETFLAG(zone, DNS_ZONEFLG_NEEDNOTIFY);
                zone_needdump(zone, DNS_DUMP_DELAY);
-               UNLOCK_ZONE(zone);
        }
+       UNLOCK_ZONE(zone);
 
  failure:
        if (result != ISC_R_SUCCESS) {