From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Tue, 30 Jun 2020 15:22:43 +0000 (+0200)
Subject: - Fix tcp req info drop due to size call into mesh accounting
X-Git-Tag: release-1.11.0~20
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=06d33f61c1f90aa551b644d12d9c70594f5377f7;p=thirdparty%2Funbound.git

- Fix tcp req info drop due to size call into mesh accounting
  removal of mesh state during mesh send reply.
---

diff --git a/doc/Changelog b/doc/Changelog
index a9c23bcab..f5aca5af6 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -9,6 +9,8 @@
 	  tcp stream waiting for it.
 	- Review fix for number of detached states due to use of variable
 	  after end of loop.
+	- Fix tcp req info drop due to size call into mesh accounting
+	  removal of mesh state during mesh send reply.
 
 24 June 2020: Wouter
 	- iana portlist updated.
diff --git a/services/mesh.c b/services/mesh.c
index 922e6b32e..4b0c5db41 100644
--- a/services/mesh.c
+++ b/services/mesh.c
@@ -1355,12 +1355,20 @@ void mesh_query_done(struct mesh_state* mstate)
 			mstate->reply_list = reply_list;
 		} else {
 			struct sldns_buffer* r_buffer = r->query_reply.c->buffer;
+			struct mesh_reply* rlist = mstate->reply_list;
 			if(r->query_reply.c->tcp_req_info) {
 				r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
 				prev_buffer = NULL;
 			}
+			/* briefly set the replylist to null in case the
+			 * meshsendreply calls tcpreqinfo sendreply that
+			 * comm_point_drops because of size, and then the
+			 * null stops the mesh state remove and thus
+			 * reply_list modification and accounting */
+			mstate->reply_list = NULL;
 			mesh_send_reply(mstate, mstate->s.return_rcode, rep,
 				r, r_buffer, prev, prev_buffer);
+			mstate->reply_list = rlist;
 			if(r->query_reply.c->tcp_req_info) {
 				tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
 				r_buffer = NULL;
@@ -1874,7 +1882,7 @@ mesh_serve_expired_callback(void* arg)
 {
 	struct mesh_state* mstate = (struct mesh_state*) arg;
 	struct module_qstate* qstate = &mstate->s;
-	struct mesh_reply* r;
+	struct mesh_reply* r, *rlist;
 	struct mesh_area* mesh = qstate->env->mesh;
 	struct dns_msg* msg;
 	struct mesh_cb* c;
@@ -1979,8 +1987,15 @@ mesh_serve_expired_callback(void* arg)
 		r_buffer = r->query_reply.c->buffer;
 		if(r->query_reply.c->tcp_req_info)
 			r_buffer = r->query_reply.c->tcp_req_info->spool_buffer;
+		/* briefly set the replylist to null in case the meshsendreply
+		 * calls tcpreqinfo sendreply that comm_point_drops because
+		 * of size, and then the null stops the mesh state remove and
+		 * thus reply_list modification and accounting */
+		rlist = mstate->reply_list;
+		mstate->reply_list = NULL;
 		mesh_send_reply(mstate, LDNS_RCODE_NOERROR, msg->rep,
 			r, r_buffer, prev, prev_buffer);
+		mstate->reply_list = rlist;
 		if(r->query_reply.c->tcp_req_info)
 			tcp_req_info_remove_mesh_state(r->query_reply.c->tcp_req_info, mstate);
 		prev = r;