4 files changed, 17 insertions, 7 deletions
diff --git a/kbx/backend-kbx.c b/kbx/backend-kbx.c
index 7674cdf2c..2d9685b3c 100644
--- a/kbx/backend-kbx.c
+++ b/kbx/backend-kbx.c
@@ -222,6 +222,7 @@ be_kbx_release_resource (ctrl_t ctrl, backend_handle_t hd)
 void
 be_kbx_release_kbx_hd (KEYBOX_HANDLE kbx_hd)
 {
+  keybox_fp_close (kbx_hd);
   keybox_release (kbx_hd);
 }
 
diff --git a/kbx/keybox-init.c b/kbx/keybox-init.c
index 53c716833..47b44909e 100644
--- a/kbx/keybox-init.c
+++ b/kbx/keybox-init.c
@@ -193,6 +193,18 @@ keybox_new_x509 (void *token, int secret)
 
 
 void
+keybox_fp_close (KEYBOX_HANDLE hd)
+{
+  if (!hd)
+    return;
+  if (hd->fp)
+    {
+      _keybox_ll_close (hd->fp);
+      hd->fp = NULL;
+    }
+}
+
+void
 keybox_release (KEYBOX_HANDLE hd)
 {
   if (!hd)
@@ -206,11 +218,6 @@ keybox_release (KEYBOX_HANDLE hd)
     }
   _keybox_release_blob (hd->found.blob);
   _keybox_release_blob (hd->saved_found.blob);
-  if (hd->fp)
-    {
-      _keybox_ll_close (hd->fp);
-      hd->fp = NULL;
-    }
   xfree (hd->word_match.name);
   xfree (hd->word_match.pattern);
   xfree (hd);
diff --git a/kbx/keybox-update.c b/kbx/keybox-update.c
index a712a6bf2..f037485da 100644
--- a/kbx/keybox-update.c
+++ b/kbx/keybox-update.c
@@ -654,12 +654,14 @@ keybox_compress_when_no_other_users (void *token, int for_openpgp)
   fname = hd->kb->fname;
   if (!fname)
     {
+      keybox_fp_close (hd);
       keybox_release (hd);
       return;
     }
 
   if (keybox_lock (hd, 1, 0))
     {
+      keybox_fp_close (hd);
       keybox_release (hd);
       return;
     }
@@ -828,8 +830,7 @@ keybox_compress_when_no_other_users (void *token, int for_openpgp)
                fname, gpg_strerror (err));
 
  leave:
-  /* Here, we unlock before the release of HD.  It's safe because
-     references to the resource are all closed.  */
+  keybox_fp_close (hd);
   keybox_lock (hd, 0, 0);
   keybox_release (hd);
   return;
diff --git a/kbx/keybox.h b/kbx/keybox.h
index 2812c06df..9746d4675 100644
--- a/kbx/keybox.h
+++ b/kbx/keybox.h
@@ -70,6 +70,7 @@ int keybox_is_writable (void *token);
 
 KEYBOX_HANDLE keybox_new_openpgp (void *token, int secret);
 KEYBOX_HANDLE keybox_new_x509 (void *token, int secret);
+void keybox_fp_close (KEYBOX_HANDLE hd);
 void keybox_release (KEYBOX_HANDLE hd);
 void keybox_push_found_state (KEYBOX_HANDLE hd);
 void keybox_pop_found_state (KEYBOX_HANDLE hd);