- fixed segfault during sending notifies (#400461)bind-9_5_0-25_b1_fc9

- rebuild with gcc 4.3 series

2 files changed, 204 insertions, 1 deletions

diff --git a/bind-9.5-transfer-segv.patch b/bind-9.5-transfer-segv.patch
new file mode 100644
index 0000000..656e0ff
--- /dev/null
+++ b/bind-9.5-transfer-segv.patch
@@ -0,0 +1,197 @@
+diff -up bind-9.5.0b1/lib/dns/rbtdb.c.segv bind-9.5.0b1/lib/dns/rbtdb.c
+--- bind-9.5.0b1/lib/dns/rbtdb.c.segv	2008-02-04 12:30:36.000000000 +0100
++++ bind-9.5.0b1/lib/dns/rbtdb.c	2008-02-04 13:46:48.000000000 +0100
+@@ -763,23 +763,17 @@ free_rbtdb(dns_rbtdb_t *rbtdb, isc_boole
+                 isc_mem_put(rbtdb->common.mctx, rbtdb->current_version,
+                             sizeof(rbtdb_version_t));
+         }
+-        if (IS_CACHE(rbtdb)) {
+-                /*
+-                 * We assume the number of remaining dead nodes is reasonably
+-                 * small; the overhead of unlinking all nodes here should be
+-                 * negligible.
+-                 */
+-                for (i = 0; i < rbtdb->node_lock_count; i++) {
+-                        dns_rbtnode_t *node;
+-
+-                        node = ISC_LIST_HEAD(rbtdb->deadnodes[i]);
+-                        while (node != NULL) {
+-                                ISC_LIST_UNLINK(rbtdb->deadnodes[i], node,
+-                                    deadlink);
+-                                node = ISC_LIST_HEAD(rbtdb->deadnodes[i]);
+-                        }
++
++        for (i = 0; i < rbtdb->node_lock_count; i++) {
++                dns_rbtnode_t *node;
++
++                node = ISC_LIST_HEAD(rbtdb->deadnodes[i]);
++                while (node != NULL) {
++                        ISC_LIST_UNLINK(rbtdb->deadnodes[i], node, deadlink);
++                         node = ISC_LIST_HEAD(rbtdb->deadnodes[i]);
+                 }
+         }
++
+         if (event == NULL)
+                 rbtdb->quantum = (rbtdb->task != NULL) ? 100 : 0;
+  again:
+@@ -1912,6 +1906,7 @@ closeversion(dns_db_t *db, dns_dbversion
+         }
+ 
+         if (!EMPTY(cleanup_list)) {
++		RWLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
+                 for (changed = HEAD(cleanup_list);
+                      changed != NULL;
+                      changed = next_changed) {
+@@ -1922,16 +1917,18 @@ closeversion(dns_db_t *db, dns_dbversion
+                         lock = &rbtdb->node_locks[rbtnode->locknum].lock;
+ 
+                         NODE_LOCK(lock, isc_rwlocktype_write);
++			cleanup_dead_nodes(rbtdb, rbtnode->locknum);
+                         if (rollback)
+                                 rollback_node(rbtnode, serial);
+                         decrement_reference(rbtdb, rbtnode, least_serial,
+                                             isc_rwlocktype_write,
+-                                            isc_rwlocktype_none);
++					    isc_rwlocktype_write);
+                         NODE_UNLOCK(lock, isc_rwlocktype_write);
+ 
+                         isc_mem_put(rbtdb->common.mctx, changed,
+                                     sizeof(*changed));
+                 }
++		RWUNLOCK(&rbtdb->tree_lock, isc_rwlocktype_write);
+         }
+ 
+   end:
+@@ -2009,6 +2006,7 @@ findnode(dns_db_t *db, dns_name_t *name,
+         dns_name_t nodename;
+         isc_result_t result;
+         isc_rwlocktype_t locktype = isc_rwlocktype_read;
++	isc_boolean_t need_relock;
+ 
+         REQUIRE(VALID_RBTDB(rbtdb));
+ 
+@@ -2064,29 +2062,27 @@ findnode(dns_db_t *db, dns_name_t *name,
+          * happen to hold a write lock on the tree, it's a good chance to purge
+          * dead nodes.
+          */
+-        if (IS_CACHE(rbtdb)) {
+-                isc_boolean_t need_relock = ISC_FALSE;
++        need_relock = ISC_FALSE;
++        NODE_WEAKLOCK(&rbtdb->node_locks[node->locknum].lock,
++                      isc_rwlocktype_read);
++        if (ISC_LINK_LINKED(node, deadlink) && isc_rwlocktype_write)
++                need_relock = ISC_TRUE;
++        else if (!ISC_LIST_EMPTY(rbtdb->deadnodes[node->locknum]) &&
++                 locktype == isc_rwlocktype_write)
++                need_relock = ISC_TRUE;
++        NODE_WEAKUNLOCK(&rbtdb->node_locks[node->locknum].lock,
++                        isc_rwlocktype_read);
++        if (need_relock) {
+ 
+                 NODE_WEAKLOCK(&rbtdb->node_locks[node->locknum].lock,
+-                              isc_rwlocktype_read);
+-                if (ISC_LINK_LINKED(node, deadlink) && isc_rwlocktype_write)
+-                        need_relock = ISC_TRUE;
+-                else if (!ISC_LIST_EMPTY(rbtdb->deadnodes[node->locknum]) &&
+-                         locktype == isc_rwlocktype_write)
+-                        need_relock = ISC_TRUE;
++                              isc_rwlocktype_write);
++                if (ISC_LINK_LINKED(node, deadlink))
++                        ISC_LIST_UNLINK(rbtdb->deadnodes[node->locknum],
++                                        node, deadlink);
++                if (locktype == isc_rwlocktype_write)
++                        cleanup_dead_nodes(rbtdb, node->locknum);
+                 NODE_WEAKUNLOCK(&rbtdb->node_locks[node->locknum].lock,
+-                                isc_rwlocktype_read);
+-                if (need_relock) {
+-                        NODE_WEAKLOCK(&rbtdb->node_locks[node->locknum].lock,
+-                                      isc_rwlocktype_write);
+-                        if (ISC_LINK_LINKED(node, deadlink))
+-                                ISC_LIST_UNLINK(rbtdb->deadnodes[node->locknum],
+-                                                node, deadlink);
+-                        if (locktype == isc_rwlocktype_write)
+-                                cleanup_dead_nodes(rbtdb, node->locknum);
+-                        NODE_WEAKUNLOCK(&rbtdb->node_locks[node->locknum].lock,
+-                                        isc_rwlocktype_write);
+-                }
++				isc_rwlocktype_write);
+         }
+ 
+         NODE_STRONGUNLOCK(&rbtdb->node_locks[node->locknum].lock);
+@@ -6149,15 +6145,6 @@ dns_rbtdb_create
+                 for (i = 0; i < (int)rbtdb->node_lock_count; i++)
+                         ISC_LIST_INIT(rbtdb->rdatasets[i]);
+ 
+-                rbtdb->deadnodes = isc_mem_get(mctx, rbtdb->node_lock_count *
+-                                               sizeof(rbtnodelist_t));
+-                if (rbtdb->deadnodes == NULL) {
+-                        result = ISC_R_NOMEMORY;
+-                        goto cleanup_rdatasets;
+-                }
+-                for (i = 0; i < (int)rbtdb->node_lock_count; i++)
+-                        ISC_LIST_INIT(rbtdb->deadnodes[i]);
+-
+                 /*
+                  * Create the heaps.
+                  */
+@@ -6165,7 +6152,7 @@ dns_rbtdb_create
+                                            sizeof(isc_heap_t *));
+                 if (rbtdb->heaps == NULL) {
+                         result = ISC_R_NOMEMORY;
+-                        goto cleanup_deadnodes;
++                        goto cleanup_rdatasets;
+                 }
+                 for (i = 0; i < (int)rbtdb->node_lock_count; i++)
+                         rbtdb->heaps[i] = NULL;
+@@ -6178,10 +6165,18 @@ dns_rbtdb_create
+                 }
+         } else {
+                 rbtdb->rdatasets = NULL;
+-                rbtdb->deadnodes = NULL;
+                 rbtdb->heaps = NULL;
+         }
+ 
++        rbtdb->deadnodes = isc_mem_get(mctx, rbtdb->node_lock_count *
++                                       sizeof(rbtnodelist_t));
++        if (rbtdb->deadnodes == NULL) {
++                result = ISC_R_NOMEMORY;
++                goto cleanup_heaps;
++        }
++        for (i = 0; i < (int)rbtdb->node_lock_count; i++)
++                ISC_LIST_INIT(rbtdb->deadnodes[i]);
++
+         rbtdb->active = rbtdb->node_lock_count;
+ 
+         for (i = 0; i < (int)(rbtdb->node_lock_count); i++) {
+@@ -6197,7 +6192,7 @@ dns_rbtdb_create
+                                 isc_refcount_decrement(&rbtdb->node_locks[i].references, NULL);
+                                 isc_refcount_destroy(&rbtdb->node_locks[i].references);
+                         }
+-                        goto cleanup_heaps;
++                        goto cleanup_deadnodes;
+                 }
+                 rbtdb->node_locks[i].exiting = ISC_FALSE;
+         }
+@@ -6310,6 +6305,10 @@ dns_rbtdb_create
+ 
+         return (ISC_R_SUCCESS);
+ 
++ cleanup_deadnodes:
++        isc_mem_put(mctx, rbtdb->deadnodes,
++                    rbtdb->node_lock_count * sizeof(rbtnodelist_t));
++
+  cleanup_heaps:
+         if (rbtdb->heaps != NULL) {
+                 for (i = 0 ; i < (int)rbtdb->node_lock_count ; i++)
+@@ -6319,11 +6318,6 @@ dns_rbtdb_create
+                             rbtdb->node_lock_count * sizeof(isc_heap_t *));
+         }
+ 
+- cleanup_deadnodes:
+-        if (rbtdb->deadnodes != NULL)
+-                isc_mem_put(mctx, rbtdb->deadnodes,
+-                            rbtdb->node_lock_count * sizeof(rbtnodelist_t));
+-
+  cleanup_rdatasets:
+         if (rbtdb->rdatasets != NULL)
+                 isc_mem_put(mctx, rbtdb->rdatasets, rbtdb->node_lock_count *
diff --git a/bind.spec b/bind.spec
index 650555d..7be1c20 100644
--- a/bind.spec
+++ b/bind.spec
@@ -20,7 +20,7 @@ Summary: 	The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name: 		bind
 License: 	ISC
 Version: 	9.5.0
-Release: 	24.%{RELEASEVER}%{?dist}
+Release: 	25.%{RELEASEVER}%{?dist}
 Epoch:   	32
 Url: 		http://www.isc.org/products/BIND/
 Buildroot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -63,6 +63,7 @@ Patch72:	bind-9.5-dlz-64bit.patch
 Patch84:	bind-9.5-gssapi-header.patch
 Patch86:	bind-9.5-CVE-2008-0122.patch
 Patch87:	bind-9.5-parallel-build.patch
+Patch88:	bind-9.5-transfer-segv.patch
 
 # SDB patches
 Patch11: 	bind-9.3.2b2-sdbsrc.patch
@@ -252,6 +253,7 @@ cp -fp contrib/dbus/{dbus_mgr.h,dbus_service.h} bin/named/include/named
 %patch85 -p1 -b .libidn3
 %patch86 -p0 -b .CVE-2008-0122
 %patch87 -p1 -b .parallel
+%patch88 -p1 -b .transfer-segv
 :;
 
 
@@ -652,6 +654,10 @@ rm -rf ${RPM_BUILD_ROOT}
 %{_sbindir}/bind-chroot-admin
 
 %changelog
+* Mon Feb 04 2008 Adam Tkac <atkac redhat com> 32:9.5.0-25.b1
+- fixed segfault during sending notifies (#400461)
+- rebuild with gcc 4.3 series
+
 * Tue Jan 22 2008 Adam Tkac <atkac redhat com> 32:9.5.0-24.b1
 - removed bind-9.3.2-prctl_set_dumpable.patch (upstream)
 - allow parallel building of libdns library