address deadlock introduced in cd2469d3cdbc211ecf8a82c76c1a0a1c4a545fec

(cherry picked from commit fd52417f712dedc6caec64c43969450fdd41b352)

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 2886c64c3323f26b2c82b22b94f4dadb2e3de7bd..68e6a89c0aae81cfb9a0a95f2a7e86efdc335aca 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -7158,9 +7158,10 @@ subtractrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
         * this is deferred until closeversion() is called.
         */
        if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
-               RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
-               iszonesecure(db, rbtdb->current_version, rbtdb->origin_node);
-               RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+               RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+               version = rbtdb->current_version;
+               RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+               iszonesecure(db, version, rbtdb->origin_node);
        }
 
        return (result);
@@ -7218,9 +7219,10 @@ deleterdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
         * this is deferred until closeversion() is called.
         */
        if (result == ISC_R_SUCCESS && version == NULL && !IS_CACHE(rbtdb)) {
-               RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_write);
-               iszonesecure(db, rbtdb->current_version, rbtdb->origin_node);
-               RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+               RBTDB_LOCK(&rbtdb->lock, isc_rwlocktype_read);
+               version = rbtdb->current_version;
+               RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_read);
+               iszonesecure(db, version, rbtdb->origin_node);
        }
 
        return (result);
@@ -7708,9 +7710,12 @@ endload(dns_db_t *db, dns_rdatacallbacks_t *callbacks) {
         * zone key, we consider the zone secure.
         */
        if (! IS_CACHE(rbtdb) && rbtdb->origin_node != NULL) {
-               iszonesecure(db, rbtdb->current_version, rbtdb->origin_node);
+               dns_dbversion_t *version = rbtdb->current_version;
+               RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
+               iszonesecure(db, version, rbtdb->origin_node);
+       } else {
+               RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
        }
-       RBTDB_UNLOCK(&rbtdb->lock, isc_rwlocktype_write);
 
        callbacks->add = NULL;
        callbacks->add_private = NULL;