4552. [bug] Named could trigger a assertion when sending notify

                        messages. [RT #44019]

diff --git a/CHANGES b/CHANGES
index 253611ab7efa0b9b7a1c8ace9b2ac52831e43b1e..49e3f0b6bee7c62c16e0efa392b2fd4772cad21a 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4552.  [bug]           Named could trigger a assertion when sending notify
+                       messages. [RT #44019]
+
 4551.  [test]          Add system tests for integrity checks of MX and
                        SRV records. [RT #43953]
 

diff --git a/lib/isc/include/isc/event.h b/lib/isc/include/isc/event.h
index 5ddc1ea1aca1430996943a9992a12470addf1eb3..8e40b4eebda524f8836f1a3b4f08bd032b928add 100644 (file)
--- a/lib/isc/include/isc/event.h
+++ b/lib/isc/include/isc/event.h
@@ -32,7 +32,8 @@ typedef void (*isc_eventdestructor_t)(isc_event_t *);
        void *                          ev_sender; \
        isc_eventdestructor_t           ev_destroy; \
        void *                          ev_destroy_arg; \
-       ISC_LINK(ltype)                 ev_link
+       ISC_LINK(ltype)                 ev_link; \
+       ISC_LINK(ltype)                 ev_ratelink;
 
 /*%
  * Attributes matching a mask of 0x000000ff are reserved for the task library's
@@ -62,6 +63,7 @@ do { \
        (event)->ev_destroy = (df); \
        (event)->ev_destroy_arg = (da); \
        ISC_LINK_INIT((event), ev_link); \
+       ISC_LINK_INIT((event), ev_ratelink); \
 } while (0)
 
 /*%

diff --git a/lib/isc/ratelimiter.c b/lib/isc/ratelimiter.c
index f78b93018fa677be0fec4b573289260df6a285c1..350bec0cdec4a79846c5d7ad62583b4b803260a5 100644 (file)
--- a/lib/isc/ratelimiter.c
+++ b/lib/isc/ratelimiter.c
@@ -157,9 +157,9 @@ isc_ratelimiter_enqueue(isc_ratelimiter_t *rl, isc_task_t *task,
                ev->ev_sender = task;
                *eventp = NULL;
                if (rl->pushpop)
-                       ISC_LIST_PREPEND(rl->pending, ev, ev_link);
+                       ISC_LIST_PREPEND(rl->pending, ev, ev_ratelink);
                else
-                       ISC_LIST_APPEND(rl->pending, ev, ev_link);
+                       ISC_LIST_APPEND(rl->pending, ev, ev_ratelink);
        } else if (rl->state == isc_ratelimiter_idle) {
                result = isc_timer_reset(rl->timer, isc_timertype_ticker, NULL,
                                         &rl->interval, ISC_FALSE);
@@ -185,8 +185,8 @@ isc_ratelimiter_dequeue(isc_ratelimiter_t *rl, isc_event_t *event) {
        REQUIRE(event != NULL);
 
        LOCK(&rl->lock);
-       if (ISC_LINK_LINKED(event, ev_link)) {
-               ISC_LIST_UNLINK(rl->pending, event, ev_link);
+       if (ISC_LINK_LINKED(event, ev_ratelink)) {
+               ISC_LIST_UNLINK(rl->pending, event, ev_ratelink);
                event->ev_sender = NULL;
        } else
                result = ISC_R_NOTFOUND;
@@ -214,7 +214,7 @@ ratelimiter_tick(isc_task_t *task, isc_event_t *event) {
                        /*
                         * There is work to do.  Let's do it after unlocking.
                         */
-                       ISC_LIST_UNLINK(rl->pending, p, ev_link);
+                       ISC_LIST_UNLINK(rl->pending, p, ev_ratelink);
                } else {
                        /*
                         * No work left to do.  Stop the timer so that we don't
@@ -248,7 +248,7 @@ isc_ratelimiter_shutdown(isc_ratelimiter_t *rl) {
        (void)isc_timer_reset(rl->timer, isc_timertype_inactive,
                              NULL, NULL, ISC_FALSE);
        while ((ev = ISC_LIST_HEAD(rl->pending)) != NULL) {
-               ISC_LIST_UNLINK(rl->pending, ev, ev_link);
+               ISC_LIST_UNLINK(rl->pending, ev, ev_ratelink);
                ev->ev_attributes |= ISC_EVENTATTR_CANCELED;
                task = ev->ev_sender;
                isc_task_send(task, &ev);

diff --git a/lib/isc/task.c b/lib/isc/task.c
index 1c0828e8234a3765c48a20145971a6f28ddfaaae..49a5f26e77ace3dc1c201aaeb5c3c0037fbf1fbe 100644 (file)
--- a/lib/isc/task.c
+++ b/lib/isc/task.c
@@ -546,6 +546,7 @@ task_send(isc__task_t *task, isc_event_t **eventp) {
        REQUIRE(event != NULL);
        REQUIRE(event->ev_type > 0);
        REQUIRE(task->state != task_state_done);
+       REQUIRE(!ISC_LINK_LINKED(event, ev_ratelink));
 
        XTRACE("task_send");