From: Ondřej Surý <ondrej@isc.org>
Date: Fri, 6 Mar 2026 16:06:24 +0000 (+0100)
Subject: Fix resquery reference imbalance on TCP connect failure
X-Git-Tag: v9.21.20~10^2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=2da669490ca94b9617257a25d93a52ed67dfdd14;p=thirdparty%2Fbind9.git

Fix resquery reference imbalance on TCP connect failure

In fctx_query(), resquery_ref(query) is called before
dns_dispatch_connect() in anticipation of the resquery_connected()
callback consuming the reference.

When dns_dispatch_connect() fails synchronously on TCP (e.g. from
dns_transport_get_tlsctx() failing in tcp_dispatch_connect()), the
connect callback is never scheduled, so the extra reference is never
consumed.  The error path then tears down the query via manual cleanup
(isc_mem_put) without going through the refcount destructor, leaving
the reference imbalanced.

Fix by dropping the extra reference on the error path, just after
dns_dispatch_done() which cleans up the dispatch entry.
---

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index e15243274c2..20763e612c4 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2284,10 +2284,11 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo,
 			isc_log_write(
 				DNS_LOGCATEGORY_RESOLVER,
 				DNS_LOGMODULE_RESOLVER, log_level,
-				"Unable to establish a connection to %s: %s\n",
+				"Unable to establish a connection to %s: %s",
 				peerbuf, isc_result_totext(result));
 		}
 		dns_dispatch_done(&query->dispentry);
+		resquery_unref(query);
 		goto cleanup_fetch;
 	} else {
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);