dns_client_destroyrestrans can be called on object in use
The dns_client_destroyrestrans()
function contains this snippet:
/*
* Wait for the lock in client_resfind to be released before
* destroying the lock.
*/
LOCK(&rctx->lock);
UNLOCK(&rctx->lock);
basically meaning that the object being destroyed might be still in use.
It seems to me that the dns_clientrestrans_t
(aka resctx_t
) is missing some basic reference counting.