fctx_finddone: call fctx_destroy within the bucket lock

Conflicts:

	CHANGES

diff --git a/CHANGES b/CHANGES
index 9ab17d0aa0f84ae618cc302cc692dad8f64b2416..cd330a0859ec00f7ba99f81f707e76662e08847d 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+3309.  [bug]           resolver.c:fctx_finddone() was not threadsafe.
+                       [RT #27995]
+
 3307.  [bug]           Add missing ISC_LANG_BEGINDECLS and ISC_LANG_ENDDECLS.
                        [RT #28956]
 
@@ -5,7 +8,8 @@
 
 3305.  [func]          Add wire format lookup method to sdb. [RT #28563]
 
-3304.  [bug]           Use hmctx, not mctx when freeing rbtdb->heaps. [RT #28571]
+3304.  [bug]           Use hmctx, not mctx when freeing rbtdb->heaps.
+                       [RT #28571]
 
 3303.  [bug]           named could die when reloading. [RT #28606]
 

diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 0e7df29af998a353916dd5a822e2df8a7915cdb0..69b88c1259d33e688845d42c1fdb2b8a06840828 100644 (file)
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2166,7 +2166,6 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {
        isc_boolean_t want_try = ISC_FALSE;
        isc_boolean_t want_done = ISC_FALSE;
        isc_boolean_t bucket_empty = ISC_FALSE;
-       isc_boolean_t destroy = ISC_FALSE;
        unsigned int bucketnum;
 
        find = event->ev_sender;
@@ -2205,17 +2204,12 @@ fctx_finddone(isc_task_t *task, isc_event_t *event) {
                }
        } else if (SHUTTINGDOWN(fctx) && fctx->pending == 0 &&
                   fctx->nqueries == 0 && ISC_LIST_EMPTY(fctx->validators)) {
-               /*
-                * Note that we had to wait until we had the lock before
-                * looking at fctx->references.
-                */
+
                if (fctx->references == 0)
-                       destroy = ISC_TRUE;
+                       bucket_empty = fctx_destroy(fctx);
        }
        UNLOCK(&res->buckets[bucketnum].lock);
 
-       if (destroy)
-               bucket_empty = fctx_destroy(fctx);
        isc_event_free(&event);
        dns_adb_destroyfind(&find);