Fix unprotected access to thread->epoll_events[fd] in unwatch_fd()

diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index 7c53ec2325a15c43941fa71a3594e20165dcf053..50636198800b83fbd5b543a388f4248b6f2c1080 100644 (file)
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -881,17 +881,15 @@ wakeup_socket(isc__socketthread_t *thread, int fd, int msg) {
                LOCK(&thread->fdlock[lockid]);
                INSIST(thread->fdstate[fd] == CLOSE_PENDING);
                thread->fdstate[fd] = CLOSED;
-               UNLOCK(&thread->fdlock[lockid]);
                (void)unwatch_fd(thread, fd, SELECT_POKE_READ);
                (void)unwatch_fd(thread, fd, SELECT_POKE_WRITE);
                (void)close(fd);
+               UNLOCK(&thread->fdlock[lockid]);
                return;
        }
 
        LOCK(&thread->fdlock[lockid]);
        if (thread->fdstate[fd] == CLOSE_PENDING) {
-               UNLOCK(&thread->fdlock[lockid]);
-
                /*
                 * We accept (and ignore) any error from unwatch_fd() as we are
                 * closing the socket, hoping it doesn't leave dangling state in
@@ -902,6 +900,7 @@ wakeup_socket(isc__socketthread_t *thread, int fd, int msg) {
                 */
                (void)unwatch_fd(thread, fd, SELECT_POKE_READ);
                (void)unwatch_fd(thread, fd, SELECT_POKE_WRITE);
+               UNLOCK(&thread->fdlock[lockid]);
                return;
        }
        if (thread->fdstate[fd] != MANAGED) {