From: Oblivionsage <cookieandcream560@gmail.com>
Date: Sat, 21 Mar 2026 16:43:50 +0000 (+0100)
Subject: dns-packet: move p->more unref into the free path
X-Git-Tag: v261-rc1~774
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=494c65236b19e160ade48315edfa0f089f3d4154;p=thirdparty%2Fsystemd.git

dns-packet: move p->more unref into the free path

dns_packet_unref() unconditionally unrefs p->more on every call,
even when n_ref > 1. But dns_packet_ref() doesn't ref p->more.
This means if a packet with a ->more chain gets ref'd and unref'd
multiple times, the chain gets freed too early while the parent
still holds a dangling pointer.

Move the p->more unref into the n_ref == 1 block so the chain
only gets cleaned up when the packet is actually being freed.
---

diff --git a/src/shared/dns-packet.c b/src/shared/dns-packet.c
index 04178e5df2b..cdd56d513fa 100644
--- a/src/shared/dns-packet.c
+++ b/src/shared/dns-packet.c
@@ -284,11 +284,10 @@ DnsPacket *dns_packet_unref(DnsPacket *p) {
 
         assert(p->n_ref > 0);
 
-        dns_packet_unref(p->more);
-
-        if (p->n_ref == 1)
+        if (p->n_ref == 1) {
+                dns_packet_unref(p->more);
                 dns_packet_free(p);
-        else
+        } else
                 p->n_ref--;
 
         return NULL;