From 32d248107a5bc92b4bf9fc77deaa55b3da969ba2 Mon Sep 17 00:00:00 2001
From: Andreas Gustafsson <source@isc.org>
Date: Fri, 19 Oct 2001 21:00:12 +0000
Subject: [PATCH] 1062.   [bug]           If the control channel listener
 socket was shut                         down before server exit, the listener
 object could                         be freed twice. [RT #1916]

---
 CHANGES                 |  4 ++++
 bin/named/controlconf.c | 32 +++++++++++++++-----------------
 2 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/CHANGES b/CHANGES
index 507f7bac95..0b47907e52 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,7 @@
+1062.	[bug]		If the control channel listener socket was shut
+			down before server exit, the listener object could
+			be freed twice. [RT #1916]
+
 1061.	[bug]		If periodic cache cleaning happened to start
 			while cleaning due to reaching the configured
 			maximum cache size was in progress, the server
diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
index b252a98b49..feab0078a2 100644
--- a/bin/named/controlconf.c
+++ b/bin/named/controlconf.c
@@ -15,7 +15,7 @@
  * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  */
 
-/* $Id: controlconf.c,v 1.33 2001/10/19 19:05:42 gson Exp $ */
+/* $Id: controlconf.c,v 1.34 2001/10/19 21:00:12 gson Exp $ */
 
 #include <config.h>
 
@@ -171,11 +171,14 @@ maybe_free_connection(controlconnection_t *conn) {
 
 static void
 shutdown_listener(controllistener_t *listener) {
-	isc_boolean_t destroy = ISC_TRUE;
+	controlconnection_t *conn;
+	controlconnection_t *next;
 
 	if (!listener->exiting) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
 
+		ISC_LIST_UNLINK(listener->controls->listeners, listener, link);
+
 		isc_sockaddr_format(&listener->address, socktext,
 				    sizeof(socktext));
 		isc_log_write(ns_g_lctx, NS_LOGCATEGORY_GENERAL,
@@ -184,23 +187,19 @@ shutdown_listener(controllistener_t *listener) {
 		listener->exiting = ISC_TRUE;
 	}
 
-	if (!ISC_LIST_EMPTY(listener->connections)) {
-		controlconnection_t *conn;
-		for (conn = ISC_LIST_HEAD(listener->connections);
-		     conn != NULL;
-		     conn = ISC_LIST_NEXT(conn, link))
-			maybe_free_connection(conn);
-		destroy = ISC_FALSE;
+	for (conn = ISC_LIST_HEAD(listener->connections);
+	     conn != NULL;
+	     conn = next)
+	{
+		next = ISC_LIST_NEXT(conn, link);
+		maybe_free_connection(conn);
 	}
 
-	if (listener->sock != NULL) {
+	if (listener->listening)
 		isc_socket_cancel(listener->sock, listener->task,
 				  ISC_SOCKCANCEL_ACCEPT);
-		destroy = ISC_FALSE;
-	}
 
-	if (destroy)
-		free_listener(listener);
+	maybe_free_listener(listener);
 }
 
 static isc_boolean_t
@@ -513,10 +512,10 @@ control_newconn(isc_task_t *task, isc_event_t *event) {
 
 	UNUSED(task);
 
+	listener->listening = ISC_FALSE;
+
 	if (nevent->result != ISC_R_SUCCESS) {
 		if (nevent->result == ISC_R_CANCELED) {
-			isc_socket_detach(&listener->sock);
-			listener->listening = ISC_FALSE;
 			shutdown_listener(listener);
 			goto cleanup;
 		}
@@ -566,7 +565,6 @@ controls_shutdown(ns_controls_t *controls) {
 		 * call their callbacks.
 		 */
 		next = ISC_LIST_NEXT(listener, link);
-		ISC_LIST_UNLINK(controls->listeners, listener, link);
 		shutdown_listener(listener);
 	}
 }