Fix potential double free when unloading a module.
authorRichard Mudgett <rmudgett@digium.com>
Mon, 17 Dec 2012 23:10:42 +0000 (23:10 +0000)
committerRichard Mudgett <rmudgett@digium.com>
Mon, 17 Dec 2012 23:10:42 +0000 (23:10 +0000)
........

Merged revisions 378092 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 378093 from http://svn.asterisk.org/svn/asterisk/branches/10
........

Merged revisions 378094 from http://svn.asterisk.org/svn/asterisk/branches/11

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@378095 65c4cc65-6c06-0410-ace0-fbb531ad65f3

main/loader.c

index 2af9d20..7ad515f 100644 (file)
@@ -237,9 +237,18 @@ void __ast_module_user_remove(struct ast_module *mod, struct ast_module_user *u)
        if (!u) {
                return;
        }
+
        AST_LIST_LOCK(&mod->users);
-       AST_LIST_REMOVE(&mod->users, u, entry);
+       u = AST_LIST_REMOVE(&mod->users, u, entry);
        AST_LIST_UNLOCK(&mod->users);
+       if (!u) {
+               /*
+                * Was not in the list.  Either a bad pointer or
+                * __ast_module_user_hangup_all() has been called.
+                */
+               return;
+       }
+
        ast_atomic_fetchadd_int(&mod->usecount, -1);
        ast_free(u);
 
@@ -559,15 +568,26 @@ int ast_unload_resource(const char *resource_name, enum ast_module_unload_mode f
        }
 
        if (!error) {
+               /* Request any channels attached to the module to hangup. */
                __ast_module_user_hangup_all(mod);
-               res = mod->info->unload();
 
+               res = mod->info->unload();
                if (res) {
                        ast_log(LOG_WARNING, "Firm unload failed for %s\n", resource_name);
-                       if (force <= AST_FORCE_FIRM)
+                       if (force <= AST_FORCE_FIRM) {
                                error = 1;
-                       else
+                       } else {
                                ast_log(LOG_WARNING, "** Dangerous **: Unloading resource anyway, at user request\n");
+                       }
+               }
+
+               if (!error) {
+                       /*
+                        * Request hangup on any channels that managed to get attached
+                        * while we called the module unload function.
+                        */
+                       __ast_module_user_hangup_all(mod);
+                       sched_yield();
                }
        }