2377. [bug] Address race condition in dnssec-signzone. [RT #18142]

diff --git a/CHANGES b/CHANGES
index 4f2f341fc2efb2b65b5be32a3c1905c3ac75bf2b..1241d56c03d28ed0132ad6d1a66f362e8d055855 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+2377.  [bug]           Address race condition in dnssec-signzone. [RT #18142]
+
 2376.  [bug]           Change #2144 was not complete.
 
 2375.  [security]      Fully randomize UDP query ports to improve

diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c
index 10e1133660c415232a006f00891738e6a5c78007..4d35f98f8ff2fa314267a1b7e69e7431c4e1250b 100644 (file)
--- a/bin/dnssec/dnssec-signzone.c
+++ b/bin/dnssec/dnssec-signzone.c
@@ -16,7 +16,7 @@
  * IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: dnssec-signzone.c,v 1.139.2.2.4.29 2008/01/30 01:51:54 marka Exp $ */
+/* $Id: dnssec-signzone.c,v 1.139.2.2.4.30 2008/06/02 00:26:20 marka Exp $ */
 
 #include <config.h>
 
@@ -117,7 +117,6 @@ static dns_name_t *gorigin;         /* The database origin */
 static isc_task_t *master = NULL;
 static unsigned int ntasks = 0;
 static isc_boolean_t shuttingdown = ISC_FALSE, finished = ISC_FALSE;
-static unsigned int assigned = 0, completed = 0;
 static isc_boolean_t nokeys = ISC_FALSE;
 static isc_boolean_t removefile = ISC_FALSE;
 static isc_boolean_t generateds = ISC_FALSE;
@@ -1094,16 +1093,19 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
        dns_rdataset_t nsec;
        isc_boolean_t found;
        isc_result_t result;
+       static unsigned int ended = 0;          /* Protected by namelock. */
 
        if (shuttingdown)
                return;
 
+       LOCK(&namelock);
        if (finished) {
-               if (assigned == completed) {
+               ended++;
+               if (ended == ntasks) {
                        isc_task_detach(&task);
                        isc_app_shutdown();
                }
-               return;
+               goto unlock;
        }
 
        fname = isc_mem_get(mctx, sizeof(dns_fixedname_t));
@@ -1113,7 +1115,6 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
        name = dns_fixedname_name(fname);
        node = NULL;
        found = ISC_FALSE;
-       LOCK(&namelock);
        while (!found) {
                result = dns_dbiterator_current(gdbiter, &node, name);
                if (result != ISC_R_SUCCESS)
@@ -1140,14 +1141,14 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
                        fatal("failure iterating database: %s",
                              isc_result_totext(result));
        }
-       UNLOCK(&namelock);
        if (!found) {
-               if (assigned == completed) {
+               ended++;
+               if (ended == ntasks) {
                        isc_task_detach(&task);
                        isc_app_shutdown();
                }
                isc_mem_put(mctx, fname, sizeof(dns_fixedname_t));
-               return;
+               goto unlock;
        }
        sevent = (sevent_t *)
                 isc_event_allocate(mctx, task, SIGNER_EVENT_WORK,
@@ -1158,7 +1159,8 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
        sevent->node = node;
        sevent->fname = fname;
        isc_task_send(worker, ISC_EVENT_PTR(&sevent));
-       assigned++;
+ unlock:
+       UNLOCK(&namelock);
 }
 
 /*
@@ -1181,7 +1183,6 @@ writenode(isc_task_t *task, isc_event_t *event) {
        isc_task_t *worker;
        sevent_t *sevent = (sevent_t *)event;
 
-       completed++;
        worker = (isc_task_t *)event->ev_sender;
        dumpnode(dns_fixedname_name(sevent->fname), sevent->node);
        cleannode(gdb, gversion, sevent->node);