From 5377d15c8496c71e0fa4829e9c5b5dc997118433 Mon Sep 17 00:00:00 2001
From: Otto Moerbeek <otto.moerbeek@open-xchange.com>
Date: Wed, 10 Aug 2022 13:30:24 +0200
Subject: [PATCH] Clear the caches *after* loading authzones.

(cherry picked from commit 799114529470923a5e633dadc47b59c4e2a7e220)
---
 pdns/reczones.cc | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pdns/reczones.cc b/pdns/reczones.cc
index c0770bfdb7..a9bd95e8cc 100644
--- a/pdns/reczones.cc
+++ b/pdns/reczones.cc
@@ -362,15 +362,18 @@ string reloadZoneConfiguration()
       }
     }
 
-    for (const auto& i : oldAndNewDomains) {
-      wipeCaches(i, true, 0xffff);
-    }
-
     // these explicitly-named captures should not be necessary, as lambda
     // capture of tuple-like structured bindings is permitted, but some
     // compilers still don't allow it
     broadcastFunction([dm = newDomainMap] { return pleaseUseNewSDomainsMap(dm); });
     broadcastFunction([ns = newNotifySet] { return pleaseSupplantAllowNotifyFor(ns); });
+
+    // Wipe the caches *after* the new auth domain info has been set
+    // up, as a query during setting up might fill the caches
+    // again. Old code did the clear before, exposing a race.
+    for (const auto& i : oldAndNewDomains) {
+      wipeCaches(i, true, 0xffff);
+    }
     return "ok\n";
   }
   catch (std::exception& e) {
-- 
2.47.2