Commit 4051b881 authored by Ondřej Surý's avatar Ondřej Surý
Browse files

Merge branch '1968-cleanup-dead-nodes-fix-v9_11' into 'v9_11'

Resolve "Again: BIND | rbtdb.c:2162: INSIST with bind with 9.11.20  (see #1718)"

See merge request !3783
parents b9024e06 6d9919fb
Pipeline #45791 passed with stages
in 4 minutes and 43 seconds
5455. [bug] `named` could crash when cleaning dead nodes
in lib/dns/rbtdb.c that have been reused meanwhile.
[GL #1968]
5447. [bug] IPv6 addresses ending in "::" could break YAML
parsing. A "0" is now appended to such addresses
in YAML output from dnstap-read. [GL #1952]
......
......@@ -58,6 +58,12 @@
it detected a malformed public key. [GL #1689]
</para>
</listitem>
<listitem>
<para>
<command>named</command> could crash when cleaning dead nodes in
lib/dns/rbtdb.c that have been reused meanwhile. [GL #1968]
</para>
</listitem>
</itemizedlist>
</section>
......
......@@ -2151,15 +2151,16 @@ cleanup_dead_nodes(dns_rbtdb_t *rbtdb, int bucketnum) {
ISC_LIST_UNLINK(rbtdb->deadnodes[bucketnum], node, deadlink);
/*
* Since we're holding a tree write lock, it should be
* impossible for this node to be referenced by others.
*
* decrement_reference may not have tested node->down, as
* the tree_lock was not held, before adding the node to
* deadnodes so we test it here.
* We might have reactivated this node without a tree write
* lock, so we couldn't remove this node from deadnodes then
* and we have to do it now.
*/
INSIST(dns_rbtnode_refcurrent(node) == 0 &&
node->data == NULL);
if (dns_rbtnode_refcurrent(node) != 0 ||
node->data != NULL) {
node = ISC_LIST_HEAD(rbtdb->deadnodes[bucketnum]);
count--;
continue;
}
if (is_leaf(node) && rbtdb->task != NULL) {
send_to_prune_tree(rbtdb, node, isc_rwlocktype_write);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment