[asterisk-commits] rmudgett: trunk r378095 - in /trunk: ./ main/loader.c

[SVN commits to the Asterisk project]

Author: rmudgett
Date: Mon Dec 17 17:10:42 2012
New Revision: 378095

URL: http://svnview.digium.com/svn/asterisk?view=rev&rev=378095
Log:
Fix potential double free when unloading a module.
........

Merged revisions 378092 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........

Merged revisions 378093 from http://svn.asterisk.org/svn/asterisk/branches/10
........

Merged revisions 378094 from http://svn.asterisk.org/svn/asterisk/branches/11

Modified:
    trunk/   (props changed)
    trunk/main/loader.c

Propchange: trunk/
------------------------------------------------------------------------------
Binary property 'branch-11-merged' - no diff available.

Modified: trunk/main/loader.c
URL: http://svnview.digium.com/svn/asterisk/trunk/main/loader.c?view=diff&rev=378095&r1=378094&r2=378095
==============================================================================
--- trunk/main/loader.c (original)
+++ trunk/main/loader.c Mon Dec 17 17:10:42 2012
@@ -237,9 +237,18 @@
 	if (!u) {
 		return;
 	}
+
 	AST_LIST_LOCK(&mod->users);
-	AST_LIST_REMOVE(&mod->users, u, entry);
+	u = AST_LIST_REMOVE(&mod->users, u, entry);
 	AST_LIST_UNLOCK(&mod->users);
+	if (!u) {
+		/*
+		 * Was not in the list.  Either a bad pointer or
+		 * __ast_module_user_hangup_all() has been called.
+		 */
+		return;
+	}
+
 	ast_atomic_fetchadd_int(&mod->usecount, -1);
 	ast_free(u);
 
@@ -559,15 +568,26 @@
 	}
 
 	if (!error) {
+		/* Request any channels attached to the module to hangup. */
 		__ast_module_user_hangup_all(mod);
+
 		res = mod->info->unload();
-
 		if (res) {
 			ast_log(LOG_WARNING, "Firm unload failed for %s\n", resource_name);
-			if (force <= AST_FORCE_FIRM)
+			if (force <= AST_FORCE_FIRM) {
 				error = 1;
-			else
+			} else {
 				ast_log(LOG_WARNING, "** Dangerous **: Unloading resource anyway, at user request\n");
+			}
+		}
+
+		if (!error) {
+			/*
+			 * Request hangup on any channels that managed to get attached
+			 * while we called the module unload function.
+			 */
+			__ast_module_user_hangup_all(mod);
+			sched_yield();
 		}
 	}