commit acde4b861333d799b50d6e8a53214abc0d17ede3
author Steve Hill <quagga@cheesy.sackheads.org> Tue Jun 02 14:28:16 2009 +0100
committer Paul Jakma <paul@quagga.net> Tue Jun 02 14:28:16 2009 +0100
tree e6fa104c7bfb45043aec82c9cab3941cb09459bd
parent 5012bc3d217f4fff5759745ee689869fb5224b41

[bgp] Fix crash on SIGHUP, deref of freed workqueues

* lib/workqueue.c: free-ing workqueues had never been tested obviously,
  queue's thread was not being stopped
* bgpd/bgpd.c: null out freed workqueues, to prevent acting on freed
  workqueues

bgpd/bgpd.c

diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index cebde0a..1712c71 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -5150,9 +5150,15 @@
                            BGP_NOTIFY_CEASE_PEER_UNCONFIG);
   
   bgp_cleanup_routes ();
+  
   if (bm->process_main_queue)
-    work_queue_free (bm->process_main_queue);
+    {
+      work_queue_free (bm->process_main_queue);
+      bm->process_main_queue = NULL;
+    }
   if (bm->process_rsclient_queue)
-    work_queue_free (bm->process_rsclient_queue);
+    {
+      work_queue_free (bm->process_rsclient_queue);
+      bm->process_rsclient_queue = NULL;
+    }
 }
-

lib/workqueue.c

diff --git a/lib/workqueue.c b/lib/workqueue.c
index 1d32d24..7c811ed 100644
--- a/lib/workqueue.c
+++ b/lib/workqueue.c
@@ -91,6 +91,9 @@
 void
 work_queue_free (struct work_queue *wq)
 {
+  if (wq->thread != NULL)
+    thread_cancel(wq->thread);
+  
   /* list_delete frees items via callback */
   list_delete (wq->items);
   listnode_delete (&work_queues, wq);