diff --git a/CHANGES b/CHANGES index c2509400b7..c5f6fd79de 100644 --- a/CHANGES +++ b/CHANGES @@ -1,3 +1,7 @@ +5455. [bug] `named` could crash when cleaning dead nodes + in lib/dns/rbtdb.c that have been reused meanwhile. + [GL #1968] + 5454. [bug] Address a startup crash happening when server is under load and root zone is not yet loaded. [GL #1862] diff --git a/doc/notes/notes-current.rst b/doc/notes/notes-current.rst index bd030087bd..9ff620303a 100644 --- a/doc/notes/notes-current.rst +++ b/doc/notes/notes-current.rst @@ -68,3 +68,6 @@ Bug Fixes - Fix assertion failure when server is under load and root zone is not yet loaded. [GL #1862] + +- ``named`` could crash when cleaning dead nodes in ``lib/dns/rbtdb.c`` that + have been reused meanwhile. [GL #1968] diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c index 87fbdb317b..c0b3479684 100644 --- a/lib/dns/rbtdb.c +++ b/lib/dns/rbtdb.c @@ -1914,15 +1914,16 @@ cleanup_dead_nodes(dns_rbtdb_t *rbtdb, int bucketnum) { ISC_LIST_UNLINK(rbtdb->deadnodes[bucketnum], node, deadlink); /* - * Since we're holding a tree write lock, it should be - * impossible for this node to be referenced by others. - * - * decrement_reference may not have tested node->down, as - * the tree_lock was not held, before adding the node to - * deadnodes so we test it here. + * We might have reactivated this node without a tree write + * lock, so we couldn't remove this node from deadnodes then + * and we have to do it now. */ - INSIST(isc_refcount_current(&node->references) == 0 && - node->data == NULL); + if (isc_refcount_current(&node->references) != 0 || + node->data != NULL) { + node = ISC_LIST_HEAD(rbtdb->deadnodes[bucketnum]); + count--; + continue; + } if (is_leaf(node) && rbtdb->task != NULL) { send_to_prune_tree(rbtdb, node, isc_rwlocktype_write);