From 5f28dfbb64689e1250b009653e21d671c2dee03e Mon Sep 17 00:00:00 2001 From: Aram Sargsyan Date: Fri, 22 May 2026 11:31:37 +0000 Subject: [PATCH] Fix a bug in xfrin.c:xfrin_connect_done() When the connect callback's result is ISC_R_SUCCESS and the callback changes the result because of some condition, the 'xfr' should not be detached, because it now belongs to the receive callback. Detach the reference only if the callback's result is non-success. (cherry picked from commit fb27599b58d8d3fcf89dc05a4f23708831eb88e8) --- lib/dns/xfrin.c | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c index 2cec78b28c..8ee2cda9d7 100644 --- a/lib/dns/xfrin.c +++ b/lib/dns/xfrin.c @@ -243,7 +243,7 @@ static isc_result_t xfrin_start(dns_xfrin_t *xfr); static void -xfrin_connect_done(isc_result_t result, isc_region_t *region, void *arg); +xfrin_connect_done(isc_result_t eresult, isc_region_t *region, void *arg); static isc_result_t xfrin_send_request(dns_xfrin_t *xfr); static void @@ -1437,19 +1437,18 @@ cleanup: * A connection has been established. */ static void -xfrin_connect_done(isc_result_t result, isc_region_t *region ISC_ATTR_UNUSED, +xfrin_connect_done(isc_result_t eresult, isc_region_t *region ISC_ATTR_UNUSED, void *arg) { dns_xfrin_t *xfr = (dns_xfrin_t *)arg; char addrtext[ISC_SOCKADDR_FORMATSIZE]; char signerbuf[DNS_NAME_FORMATSIZE]; const char *signer = "", *sep = ""; dns_zonemgr_t *zmgr = NULL; + isc_result_t result; REQUIRE(VALID_XFRIN(xfr)); - if (atomic_load(&xfr->shuttingdown)) { - result = ISC_R_SHUTTINGDOWN; - } + result = atomic_load(&xfr->shuttingdown) ? ISC_R_SHUTTINGDOWN : eresult; LIBDNS_XFRIN_CONNECTED(xfr, xfr->info, result); @@ -1516,7 +1515,13 @@ cleanup: } detach: - dns_xfrin_detach(&xfr); + /* + * If the connection was successful, then the reference now belongs to + * the receive callback. Otherwise, detach it. + */ + if (eresult != ISC_R_SUCCESS) { + dns_xfrin_detach(&xfr); + } } /*