From 7b9e28f1a568ec217c570fdf15bb81e8068656e9 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 12 Jan 2017 14:12:05 +1100
Subject: [PATCH] 4552.   [bug]           Named could trigger a assertion when
 sending notify                         messages. [RT #44019]

---
 CHANGES                     |  3 +++
 lib/isc/include/isc/event.h |  4 +++-
 lib/isc/ratelimiter.c       | 12 ++++++------
 lib/isc/task.c              |  1 +
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/CHANGES b/CHANGES
index 253611ab7e..49e3f0b6be 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+4552.	[bug]		Named could trigger a assertion when sending notify
+			messages. [RT #44019]
+
 4551.	[test]		Add system tests for integrity checks of MX and
 			SRV records. [RT #43953]
 
diff --git a/lib/isc/include/isc/event.h b/lib/isc/include/isc/event.h
index 5ddc1ea1ac..8e40b4eebd 100644
--- a/lib/isc/include/isc/event.h
+++ b/lib/isc/include/isc/event.h
@@ -32,7 +32,8 @@ typedef void (*isc_eventdestructor_t)(isc_event_t *);
 	void *				ev_sender; \
 	isc_eventdestructor_t		ev_destroy; \
 	void *				ev_destroy_arg; \
-	ISC_LINK(ltype)			ev_link
+	ISC_LINK(ltype)			ev_link; \
+	ISC_LINK(ltype)			ev_ratelink;
 
 /*%
  * Attributes matching a mask of 0x000000ff are reserved for the task library's
@@ -62,6 +63,7 @@ do { \
 	(event)->ev_destroy = (df); \
 	(event)->ev_destroy_arg = (da); \
 	ISC_LINK_INIT((event), ev_link); \
+	ISC_LINK_INIT((event), ev_ratelink); \
 } while (0)
 
 /*%
diff --git a/lib/isc/ratelimiter.c b/lib/isc/ratelimiter.c
index f78b93018f..350bec0cde 100644
--- a/lib/isc/ratelimiter.c
+++ b/lib/isc/ratelimiter.c
@@ -157,9 +157,9 @@ isc_ratelimiter_enqueue(isc_ratelimiter_t *rl, isc_task_t *task,
 		ev->ev_sender = task;
 		*eventp = NULL;
 		if (rl->pushpop)
-			ISC_LIST_PREPEND(rl->pending, ev, ev_link);
+			ISC_LIST_PREPEND(rl->pending, ev, ev_ratelink);
 		else
-			ISC_LIST_APPEND(rl->pending, ev, ev_link);
+			ISC_LIST_APPEND(rl->pending, ev, ev_ratelink);
 	} else if (rl->state == isc_ratelimiter_idle) {
 		result = isc_timer_reset(rl->timer, isc_timertype_ticker, NULL,
 					 &rl->interval, ISC_FALSE);
@@ -185,8 +185,8 @@ isc_ratelimiter_dequeue(isc_ratelimiter_t *rl, isc_event_t *event) {
 	REQUIRE(event != NULL);
 
 	LOCK(&rl->lock);
-	if (ISC_LINK_LINKED(event, ev_link)) {
-		ISC_LIST_UNLINK(rl->pending, event, ev_link);
+	if (ISC_LINK_LINKED(event, ev_ratelink)) {
+		ISC_LIST_UNLINK(rl->pending, event, ev_ratelink);
 		event->ev_sender = NULL;
 	} else
 		result = ISC_R_NOTFOUND;
@@ -214,7 +214,7 @@ ratelimiter_tick(isc_task_t *task, isc_event_t *event) {
 			/*
 			 * There is work to do.  Let's do it after unlocking.
 			 */
-			ISC_LIST_UNLINK(rl->pending, p, ev_link);
+			ISC_LIST_UNLINK(rl->pending, p, ev_ratelink);
 		} else {
 			/*
 			 * No work left to do.  Stop the timer so that we don't
@@ -248,7 +248,7 @@ isc_ratelimiter_shutdown(isc_ratelimiter_t *rl) {
 	(void)isc_timer_reset(rl->timer, isc_timertype_inactive,
 			      NULL, NULL, ISC_FALSE);
 	while ((ev = ISC_LIST_HEAD(rl->pending)) != NULL) {
-		ISC_LIST_UNLINK(rl->pending, ev, ev_link);
+		ISC_LIST_UNLINK(rl->pending, ev, ev_ratelink);
 		ev->ev_attributes |= ISC_EVENTATTR_CANCELED;
 		task = ev->ev_sender;
 		isc_task_send(task, &ev);
diff --git a/lib/isc/task.c b/lib/isc/task.c
index 1c0828e823..49a5f26e77 100644
--- a/lib/isc/task.c
+++ b/lib/isc/task.c
@@ -546,6 +546,7 @@ task_send(isc__task_t *task, isc_event_t **eventp) {
 	REQUIRE(event != NULL);
 	REQUIRE(event->ev_type > 0);
 	REQUIRE(task->state != task_state_done);
+	REQUIRE(!ISC_LINK_LINKED(event, ev_ratelink));
 
 	XTRACE("task_send");