From 2da669490ca94b9617257a25d93a52ed67dfdd14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= Date: Fri, 6 Mar 2026 17:06:24 +0100 Subject: [PATCH] Fix resquery reference imbalance on TCP connect failure In fctx_query(), resquery_ref(query) is called before dns_dispatch_connect() in anticipation of the resquery_connected() callback consuming the reference. When dns_dispatch_connect() fails synchronously on TCP (e.g. from dns_transport_get_tlsctx() failing in tcp_dispatch_connect()), the connect callback is never scheduled, so the extra reference is never consumed. The error path then tears down the query via manual cleanup (isc_mem_put) without going through the refcount destructor, leaving the reference imbalanced. Fix by dropping the extra reference on the error path, just after dns_dispatch_done() which cleans up the dispatch entry. --- lib/dns/resolver.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c index e15243274c..20763e612c 100644 --- a/lib/dns/resolver.c +++ b/lib/dns/resolver.c @@ -2284,10 +2284,11 @@ fctx_query(fetchctx_t *fctx, dns_adbaddrinfo_t *addrinfo, isc_log_write( DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_RESOLVER, log_level, - "Unable to establish a connection to %s: %s\n", + "Unable to establish a connection to %s: %s", peerbuf, isc_result_totext(result)); } dns_dispatch_done(&query->dispentry); + resquery_unref(query); goto cleanup_fetch; } else { RUNTIME_CHECK(result == ISC_R_SUCCESS);