Do not use header_prev in expire_lru_headers

dns__cacherbt_expireheader can unlink / free header_prev underneath
it.  Use ISC_LIST_TAIL after calling dns__cacherbt_expireheader
instead to get the next pointer to be processed.

(cherry picked from commit 7ce2e86024f022decb2678963538515ca39ab4ab)

diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 723d169532d331d277b5f40094c17938cbbeb130..00ec78b8dee83d9eef45a151494c0b69d7dd2e39 100644 (file)
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -10618,19 +10618,19 @@ update_header(dns_rbtdb_t *rbtdb, rdatasetheader_t *header, isc_stdtime_t now) {
 static size_t
 expire_lru_headers(dns_rbtdb_t *rbtdb, unsigned int locknum, size_t purgesize,
                   bool tree_locked) {
-       rdatasetheader_t *header, *header_prev;
+       rdatasetheader_t *header;
        size_t purged = 0;
 
        for (header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]);
-            header != NULL && purged <= purgesize; header = header_prev)
+            header != NULL && purged <= purgesize;
+            header = ISC_LIST_TAIL(rbtdb->rdatasets[locknum]))
        {
-               header_prev = ISC_LIST_PREV(header, link);
                /*
                 * Unlink the entry at this point to avoid checking it
                 * again even if it's currently used someone else and
                 * cannot be purged at this moment.  This entry won't be
                 * referenced any more (so unlinking is safe) since the
-                * TTL was reset to 0.
+                * TTL will be reset to 0.
                 */
                ISC_LIST_UNLINK(rbtdb->rdatasets[locknum], header, link);
                size_t header_size = rdataset_size(header);