fctx_finddone: call fctx_destroy within the bucket lock

diff --git a/CHANGES b/CHANGES
index 98abcf1eb685e23d18e0152b41fa760107b12207..3c8b7c04cdd8566014d3acb26fefb596e29e7b46 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3309.  [bug]           resolver.c:fctx_finddone() was not threadsafe.
+                       [RT #27995]
+
 3308.  [placeholder]
 
 3307.  [bug]           Add missing ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS.
@@ -7,7 +10,8 @@
 
 3305.  [func]          Add wire format lookup method to sdb. [RT #28563]
 
-3304.  [bug]           Use hmctx, not mctx when freeing rbtdb->heaps. [RT #28571]
+3304.  [bug]           Use hmctx, not mctx when freeing rbtdb->heaps.
+                       [RT #28571]
 
 3303.  [bug]           named could die when reloading. [RT #28606]
 

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index c14af9440a29a079ebbfc311ed5a26e0f29e40e8..097c9fb0187810cde66bf5303f6e49b43843e4eb 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2166,7 +2166,6 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {
        isc_boolean_t want_try = ISC_FALSE;
        isc_boolean_t want_done = ISC_FALSE;
        isc_boolean_t bucket_empty = ISC_FALSE;
-       isc_boolean_t destroy = ISC_FALSE;
        unsigned int bucketnum;
 
        find = event->ev_sender;
@@ -2205,17 +2204,12 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {
                }
        } else if (SHUTTINGDOWN(fctx) && fctx->pending == 0 &&
                   fctx->nqueries == 0 && ISC_LIST_EMPTY(fctx->validators)) {
-               /*
-                * Note that we had to wait until we had the lock before
-                * looking at fctx->references.
-                */
+
                if (fctx->references == 0)
-                       destroy = ISC_TRUE;
+                       bucket_empty = fctx_destroy(fctx);
        }
        UNLOCK(&res->buckets[bucketnum].lock);
 
-       if (destroy)
-               bucket_empty = fctx_destroy(fctx);
        isc_event_free(&event);
        dns_adb_destroyfind(&find);