bugfix: proper handling of nsec3 tree created during incremental update

src/knot/updates/apply.c

@@ -363,9 +363,12 @@ void apply_rollback(apply_ctx_t *ctx)
 
 	trie_cow_rollback(ctx->contents->nodes->cow, NULL, NULL);
 	ctx->contents->nodes->cow = NULL;
-	if (ctx->contents->nsec3_nodes != NULL) {
+	if (ctx->contents->nsec3_nodes != NULL && ctx->contents->nsec3_nodes->cow != NULL) {
 		trie_cow_rollback(ctx->contents->nsec3_nodes->cow, NULL, NULL);
 		ctx->contents->nsec3_nodes->cow = NULL;
+	} else if (ctx->contents->nsec3_nodes != NULL) {
+		zone_tree_free(&ctx->contents->nsec3_nodes);
+		ctx->contents->nsec3_nodes = NULL;
 	}
 
 	free(ctx->contents->nodes);
@@ -388,7 +391,7 @@ void update_free_zone(zone_contents_t *contents)
 
 	trie_cow_commit(contents->nodes->cow, NULL, NULL);
 	contents->nodes->cow = NULL;
-	if (contents->nsec3_nodes != NULL) {
+	if (contents->nsec3_nodes != NULL && contents->nsec3_nodes->cow != NULL) {
 		trie_cow_commit(contents->nsec3_nodes->cow, NULL, NULL);
 		contents->nsec3_nodes->cow = NULL;
 	}

tests-extra/tests/dnssec/nsec3_revert/test.py

+#!/usr/bin/env python3
+
+'''Test for unsiccessful creation of NSEC3 tree'''
+
+from dnstest.test import Test
+
+t = Test()
+
+master = t.server("knot")
+zone = t.zone_rnd(1, records=200)
+
+t.link(zone, master)
+
+master.journal_max_usage = 51200 # the creation of NSEC3 tree fails on ESPACE
+
+t.start()
+master.zone_wait(zone)
+
+master.dnssec(zone).enable = True
+master.dnssec(zone).nsec3 = True
+master.gen_confile()
+master.reload()
+
+t.sleep(8) # unfixed knotd will crash upon update reversal
+master.ctl("zone-flush")
+
+t.end()