From: Ondřej Surý <ondrej@isc.org>
Date: Wed, 29 Oct 2025 06:18:55 +0000 (+0100)
Subject: Only unlink from SIEVE LRU if it is still linked
X-Git-Tag: v9.21.15~5^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=0d8dedf73b09943101ae8a412194276499eb402e;p=thirdparty%2Fbind9.git

Only unlink from SIEVE LRU if it is still linked

Under the overmem conditions, the header could get unlinked from the
SIEVE LRU using a different path.  This could lead to double-unlink
which causes assertion failure.  Add a guard to ISC_SIEVE_UNLINK() to
unlink only still linked headers.
---

diff --git a/lib/dns/qpcache.c b/lib/dns/qpcache.c
index 4702ff05d86..476559396f0 100644
--- a/lib/dns/qpcache.c
+++ b/lib/dns/qpcache.c
@@ -504,7 +504,9 @@ expire_lru_headers(qpcache_t *qpdb, uint32_t idx, size_t requested,
 
 		dns_slabtop_t *related = top->related;
 
-		ISC_SIEVE_UNLINK(qpdb->buckets[idx].sieve, top, link);
+		if (ISC_SIEVE_LINKED(top, link)) {
+			ISC_SIEVE_UNLINK(qpdb->buckets[idx].sieve, top, link);
+		}
 
 		dns_slabheader_t *header = first_header(top);
 		expired += expireheader(header, nlocktypep, tlocktypep,
@@ -615,7 +617,7 @@ clean_cache_node(qpcache_t *qpdb, qpcnode_t *node) {
 
 			cds_list_del(&top->types_link);
 
-			if (ISC_LINK_LINKED(top, link)) {
+			if (ISC_SIEVE_LINKED(top, link)) {
 				ISC_SIEVE_UNLINK(
 					qpdb->buckets[node->locknum].sieve, top,
 					link);
@@ -2901,8 +2903,10 @@ add(qpcache_t *qpdb, qpcnode_t *qpnode, dns_slabheader_t *newheader,
 		cds_list_add(&newheader->headers_link,
 			     &oldheader->top->headers);
 
-		ISC_SIEVE_UNLINK(qpdb->buckets[qpnode->locknum].sieve,
-				 oldheader->top, link);
+		if (ISC_SIEVE_LINKED(oldheader->top, link)) {
+			ISC_SIEVE_UNLINK(qpdb->buckets[qpnode->locknum].sieve,
+					 oldheader->top, link);
+		}
 
 		qpcache_miss(qpdb, newheader, &nlocktype,
 			     &tlocktype DNS__DB_FLARG_PASS);
@@ -3889,7 +3893,7 @@ qpcnode_destroy(qpcnode_t *qpnode) {
 			dns_slabheader_destroy(&header);
 		}
 
-		if (ISC_LINK_LINKED(top, link)) {
+		if (ISC_SIEVE_LINKED(top, link)) {
 			ISC_SIEVE_UNLINK(qpdb->buckets[qpnode->locknum].sieve,
 					 top, link);
 		}
diff --git a/lib/isc/include/isc/sieve.h b/lib/isc/include/isc/sieve.h
index f14a1de3bff..bd7a29792b3 100644
--- a/lib/isc/include/isc/sieve.h
+++ b/lib/isc/include/isc/sieve.h
@@ -143,6 +143,8 @@
 		__hand;                                                       \
 	})
 
+#define ISC_SIEVE_LINKED(entry, link) ISC_LINK_LINKED(entry, link)
+
 #define ISC_SIEVE_UNLINK(sieve, entry, link)                                 \
 	({                                                                   \
 		__typeof__((sieve).hand) __hand = (sieve).hand;              \