3221. [bug] Fixed a potential coredump on shutdown due to

			referencing fetch context after it's been freed.
			[RT #26720]

diff --git a/CHANGES b/CHANGES
index 44312f7a96f49db0a82e62ca8f1ce02e66a233b0..3b2865226c388c1e2db9b1b5404ac12d8e6d82fa 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+3221.  [bug]           Fixed a potential coredump on shutdown due to
+                       referencing fetch context after it's been freed.
+                       [RT #26720]
+
        --- 9.6-ESV-R6b1 released ---
 
 3218.  [security]      Cache lookup could return RRSIG data associated with

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index c41a444ad4f4c4c46e303201abbdd72d264c90dc..c61108b64bc7412c141df0fa98c5f3d2011c5854 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -15,7 +15,7 @@
  * PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: resolver.c,v 1.384.14.36 2011/11/15 21:46:42 each Exp $ */
+/* $Id: resolver.c,v 1.384.14.37 2011/11/23 22:51:50 each Exp $ */
 
 /*! \file */
 
@@ -4002,8 +4002,10 @@ validated(isc_task_t *task, isc_event_t *event) {
         * so, destroy the fctx.
         */
        if (SHUTTINGDOWN(fctx) && !sentresponse) {
+               isc_mutex_t *bucketlock =
+                       &fctx->res->buckets[fctx->bucketnum].lock;
                maybe_destroy(fctx, ISC_TRUE);
-               UNLOCK(&fctx->res->buckets[fctx->bucketnum].lock);
+               UNLOCK(bucketlock);
                goto cleanup_event;
        }