937. [bug] A race when shutting down a zone could trigger a

                        INSIST() failure. [RT #1034]

diff --git a/CHANGES b/CHANGES
index e86a6ab7d14837ae02772488109170564d27ed94..cd6081b3d30f35b2b34a2b0b97e9e543a09372ae 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+ 937.  [bug]           A race when shutting down a zone could trigger a
+                       INSIST() failure. [RT #1034]
 
  936.  [func]          Warn about IPv4 addresses that are not complete
                        dotted quads. [RT #1084]

diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 0f5d1fa56223083cc2905dd3b7ef0263673b5017..119c36191260fdf8e50e6243ac5d3a198c4a9b2b 100644 (file)
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: zone.c,v 1.329 2001/07/11 23:15:14 marka Exp $ */
+/* $Id: zone.c,v 1.330 2001/07/17 02:49:44 marka Exp $ */
 
 #include <config.h>
 
@@ -560,12 +560,11 @@ zone_free(dns_zone_t *zone) {
        REQUIRE(isc_refcount_current(&zone->erefs) == 0);
        REQUIRE(zone->irefs == 0);
        REQUIRE(!LOCKED_ZONE(zone));
+       REQUIRE(zone->timer == NULL);
 
        /*
         * Managed objects.  Order is important.
         */
-       if (zone->timer != NULL)
-               isc_timer_detach(&zone->timer);
        if (zone->request != NULL)
                dns_request_destroy(&zone->request); /* XXXMPA */
        INSIST(zone->readio == NULL);
@@ -1545,6 +1544,7 @@ zone_iattach(dns_zone_t *source, dns_zone_t **target) {
        REQUIRE(LOCKED_ZONE(source));
        REQUIRE(DNS_ZONE_VALID(source));
        REQUIRE(target != NULL && *target == NULL);
+       INSIST(source->irefs + isc_refcount_current(&source->erefs) > 0);
        source->irefs++;
        INSIST(source->irefs != 0);
        *target = source;
@@ -3668,7 +3668,6 @@ ns_query(dns_zone_t *zone, dns_rdataset_t *soardataset, dns_stub_t *stub) {
 static void
 zone_shutdown(isc_task_t *task, isc_event_t *event) {
        dns_zone_t *zone = (dns_zone_t *) event->ev_arg;
-       isc_result_t result;
        isc_boolean_t free_needed;
 
        UNUSED(task);
@@ -3720,9 +3719,9 @@ zone_shutdown(isc_task_t *task, isc_event_t *event) {
        notify_cancel(zone);
 
        if (zone->timer != NULL) {
-               result = isc_timer_reset(zone->timer, isc_timertype_inactive,
-                                        NULL, NULL, ISC_TRUE);
-               RUNTIME_CHECK(result == ISC_R_SUCCESS);
+               isc_timer_detach(&zone->timer);
+               INSIST(zone->irefs > 0);
+               zone->irefs--;
        }
 
        if (zone->view != NULL)
@@ -5403,6 +5402,11 @@ dns_zonemgr_managezone(dns_zonemgr_t *zmgr, dns_zone_t *zone) {
                                  &zone->timer);
        if (result != ISC_R_SUCCESS)
                goto cleanup_task;
+       /*
+        * The timer "holds" a iref.
+        */
+       zone->irefs++;
+       INSIST(zone->irefs != 0);
 
        ISC_LIST_APPEND(zmgr->zones, zone, link);
        zone->zmgr = zmgr;