From 9ddf7d6c4cb5a99ef21f606cf865fd500d04da87 Mon Sep 17 00:00:00 2001
From: Mark Andrews <marka@isc.org>
Date: Thu, 30 Nov 2017 10:31:44 +1100
Subject: [PATCH] 4833.   [bug]           isc_event_free should check that the
 event is not                         linked when called. [RT #46725]

4832.   [bug]           Events were not being removed from zone->rss_events.
                        [RT #46725]
---
 CHANGES         | 6 ++++++
 lib/dns/rpz.c   | 7 ++++++-
 lib/dns/zone.c  | 1 +
 lib/isc/event.c | 3 +++
 lib/isc/task.c  | 1 +
 5 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/CHANGES b/CHANGES
index db8a6d56ca..c7cdff34d0 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,9 @@
+4833.	[bug]		isc_event_free should check that the event is not
+			linked when called. [RT #46725]
+
+4832.	[bug]		Events were not being removed from zone->rss_events.
+			[RT #46725]
+
 4831.	[bug]		Convert the RRSIG expirytime to 64 bits for
 			comparisions in diff.c:resign. [RT #46710]
 
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 800cfc6a4d..2f98e67021 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -1555,6 +1555,8 @@ dns_rpz_new_zone(dns_rpz_zones_t *rpzs, dns_rpz_zone_t **rpzp) {
 	zone->updbit = NULL;
 	zone->rpzs = rpzs;
 	zone->db_registered = ISC_FALSE;
+	ISC_EVENT_INIT(&zone->updateevent, sizeof(zone->updateevent),
+		       0, NULL, 0, NULL, NULL, NULL, NULL, NULL);
 
 	zone->num = rpzs->p.num_zones++;
 	rpzs->zones[zone->num] = zone;
@@ -1633,6 +1635,7 @@ dns_rpz_dbupdate_callback(dns_db_t *db, void *fn_arg) {
 			isc_event_t *event;
 
 			dns_db_currentversion(zone->db, &zone->dbversion);
+			INSIST(!ISC_LINK_LINKED(&zone->updateevent, ev_link));
 			ISC_EVENT_INIT(&zone->updateevent,
 				       sizeof(zone->updateevent), 0, NULL,
 				       DNS_EVENT_RPZUPDATED,
@@ -1669,6 +1672,7 @@ dns_rpz_update_taskaction(isc_task_t *task, isc_event_t *event) {
 
 	UNUSED(task);
 	zone = (dns_rpz_zone_t *) event->ev_arg;
+	isc_event_free(&event);
 	LOCK(&zone->rpzs->maint_lock);
 	zone->updatepending = ISC_FALSE;
 	zone->updaterunning = ISC_TRUE;
@@ -1679,7 +1683,6 @@ dns_rpz_update_taskaction(isc_task_t *task, isc_event_t *event) {
 	result = isc_time_now(&zone->lastupdated);
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	UNLOCK(&zone->rpzs->maint_lock);
-	isc_event_free(&event);
 }
 
 static isc_result_t
@@ -1943,6 +1946,7 @@ update_quantum(isc_task_t *task, isc_event_t *event) {
 		/*
 		 * We finished a quantum; trigger the next one and return
 		 */
+		INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
 		ISC_EVENT_INIT(&rpz->updateevent,
 			       sizeof(rpz->updateevent), 0, NULL,
 			       DNS_EVENT_RPZUPDATED,
@@ -1995,6 +1999,7 @@ dns_rpz_update_from_db(dns_rpz_zone_t *rpz) {
 	}
 
 	event = &rpz->updateevent;
+	INSIST(!ISC_LINK_LINKED(&rpz->updateevent, ev_link));
 	ISC_EVENT_INIT(&rpz->updateevent, sizeof(rpz->updateevent),
 		       0, NULL, DNS_EVENT_RPZUPDATED,
 		       update_quantum, rpz, rpz, NULL, NULL);
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 1cb07feba1..45c1754695 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -14360,6 +14360,7 @@ receive_secure_serial(isc_task_t *task, isc_event_t *event) {
 		LOCK_ZONE(zone);
 		INSIST(zone->irefs > 1);
 		zone->irefs--;
+		ISC_LIST_UNLINK(zone->rss_events, event, ev_link);
 		goto nextevent;
 	}
 	dns_zone_idetach(&zone);
diff --git a/lib/isc/event.c b/lib/isc/event.c
index af02cfdb65..a369d7f6cb 100644
--- a/lib/isc/event.c
+++ b/lib/isc/event.c
@@ -91,6 +91,9 @@ isc_event_free(isc_event_t **eventp) {
 	event = *eventp;
 	REQUIRE(event != NULL);
 
+	REQUIRE(!ISC_LINK_LINKED(event, ev_link));
+	REQUIRE(!ISC_LINK_LINKED(event, ev_ratelink));
+
 	if (event->ev_destroy != NULL)
 		(event->ev_destroy)(event);
 
diff --git a/lib/isc/task.c b/lib/isc/task.c
index e534d732ed..3b73e595ed 100644
--- a/lib/isc/task.c
+++ b/lib/isc/task.c
@@ -703,6 +703,7 @@ isc__task_purgerange(isc_task_t *task0, void *sender, isc_eventtype_t first,
 
 	for (event = HEAD(events); event != NULL; event = next_event) {
 		next_event = NEXT(event, ev_link);
+		ISC_LIST_UNLINK(events, event, ev_link);
 		isc_event_free(&event);
 	}