Use-after-free in xfrin
The logging is trying to lookup the name from already freed object. I thought we already fixed this, but apparently not.
https://gitlab.isc.org/isc-projects/bind9/-/jobs/1623383
D:inline:Core was generated by `/builds/isc-projects/bind9/bin/named/.libs/named -D inline-ns3 -X named.lock -m'.
D:inline:Program terminated with signal SIGABRT, Aborted.
D:inline:#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
D:inline:[Current thread is 1 (Thread 0x7fa0e386d700 (LWP 23301))]
D:inline:#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:50
D:inline:#1 0x00007fa0eb21b535 in __GI_abort () at abort.c:79
D:inline:#2 0x0000000000443a9e in abort ()
D:inline:#3 0x00000000004d6dfe in assertion_failed (file=<optimized out>, line=<optimized out>, type=<optimized out>, cond=<optimized out>) at main.c:259
D:inline:#4 0x00007fa0ec14484e in isc_assertion_failed (file=0x2 <error: Cannot access memory at address 0x2>, line=-477983568, line@entry=15631, type=type@entry=isc_assertiontype_require, cond=0x7fa0eb2307bb <__GI_raise+267> "H\213\214$\b\001") at assertions.c:46
D:inline:#5 0x00007fa0ec0155cc in dns_zone_name (zone=0x7b7800050410, buf=buf@entry=0x7fa0e38293f0 "\001", length=length@entry=1055) at zone.c:15631
D:inline:#6 0x00007fa0ec0012fa in xfrin_log (xfr=xfr@entry=0x7b6800060010, level=level@entry=-1, fmt=0x7fa0ec096271 "Transfer status: %s") at xfrin.c:1650
D:inline:#7 0x00007fa0ec000e40 in xfrin_destroy (xfr=xfr@entry=0x7b6800060010) at xfrin.c:1518
D:inline:#8 0x00007fa0ec0009d9 in dns_xfrin_detach (xfrp=0x7fa0e3829b20) at xfrin.c:748
D:inline:#9 0x00007fa0ec002806 in xfrin_recv_done (handle=<optimized out>, handle@entry=0x7b4800072490, result=<optimized out>, result@entry=0, region=<optimized out>, region@entry=0x7fa0e3829b60, cbarg=<optimized out>) at xfrin.c:1492
D:inline:#10 0x00007fa0ec112571 in isc__nm_async_readcb (worker=<optimized out>, ev0=<optimized out>, ev0@entry=0x7fa0e3829bb0) at netmgr/netmgr.c:2411
D:inline:#11 0x00007fa0ec1123a5 in isc__nm_readcb (sock=sock@entry=0x7b74000e0610, uvreq=uvreq@entry=0x7b7000014800, eresult=eresult@entry=0) at netmgr/netmgr.c:2386
D:inline:#12 0x00007fa0ec11b0c6 in isc__nm_tcpdns_processbuffer (sock=sock@entry=0x7b74000e0610) at netmgr/tcpdns.c:795
D:inline:#13 0x00007fa0ec111510 in processbuffer (sock=sock@entry=0x7b74000e0610) at netmgr/netmgr.c:1962
D:inline:#14 0x00007fa0ec11142e in isc__nm_process_sock_buffer (sock=sock@entry=0x7b74000e0610) at netmgr/netmgr.c:1987
D:inline:#15 0x00007fa0ec11b369 in isc__nm_tcpdns_read_cb (stream=<optimized out>, nread=<optimized out>, buf=0x7fa0e3829d30) at netmgr/tcpdns.c:858
D:inline:#16 0x00007fa0eb9bace7 in ?? () from /usr/lib/x86_64-linux-gnu/libuv.so.1
D:inline:#17 0x00007fa0eb9bb908 in ?? () from /usr/lib/x86_64-linux-gnu/libuv.so.1
D:inline:#18 0x00007fa0eb9c04b0 in uv.io_poll () from /usr/lib/x86_64-linux-gnu/libuv.so.1
D:inline:#19 0x00007fa0eb9b1f85 in uv_run () from /usr/lib/x86_64-linux-gnu/libuv.so.1
D:inline:#20 0x00007fa0ec10a39b in nm_thread (worker0=0x7b9c00001690) at netmgr/netmgr.c:558
D:inline:#21 0x00007fa0ec17470a in isc__trampoline_run (arg=0x7b0800020220) at trampoline.c:184
D:inline:#22 0x000000000043e29d in __tsan_thread_start_func ()
D:inline:#23 0x00007fa0eb97dfa3 in start_thread (arg=<optimized out>) at pthread_create.c:486
D:inline:#24 0x00007fa0eb2f24cf in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:95