From d571d53fa4057f30f62dec978a7e022b79c0deca Mon Sep 17 00:00:00 2001 From: Richard Mudgett Date: Mon, 17 Dec 2012 23:09:45 +0000 Subject: [PATCH] Fix potential double free when unloading a module. ........ Merged revisions 378092 from http://svn.asterisk.org/svn/asterisk/branches/1.8 ........ Merged revisions 378093 from http://svn.asterisk.org/svn/asterisk/branches/10 git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/11@378094 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- main/loader.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/main/loader.c b/main/loader.c index 2af9d2006d..7ad515f8aa 100644 --- a/main/loader.c +++ b/main/loader.c @@ -237,9 +237,18 @@ void __ast_module_user_remove(struct ast_module *mod, struct ast_module_user *u) if (!u) { return; } + AST_LIST_LOCK(&mod->users); - AST_LIST_REMOVE(&mod->users, u, entry); + u = AST_LIST_REMOVE(&mod->users, u, entry); AST_LIST_UNLOCK(&mod->users); + if (!u) { + /* + * Was not in the list. Either a bad pointer or + * __ast_module_user_hangup_all() has been called. + */ + return; + } + ast_atomic_fetchadd_int(&mod->usecount, -1); ast_free(u); @@ -559,15 +568,26 @@ int ast_unload_resource(const char *resource_name, enum ast_module_unload_mode f } if (!error) { + /* Request any channels attached to the module to hangup. */ __ast_module_user_hangup_all(mod); - res = mod->info->unload(); + res = mod->info->unload(); if (res) { ast_log(LOG_WARNING, "Firm unload failed for %s\n", resource_name); - if (force <= AST_FORCE_FIRM) + if (force <= AST_FORCE_FIRM) { error = 1; - else + } else { ast_log(LOG_WARNING, "** Dangerous **: Unloading resource anyway, at user request\n"); + } + } + + if (!error) { + /* + * Request hangup on any channels that managed to get attached + * while we called the module unload function. + */ + __ast_module_user_hangup_all(mod); + sched_yield(); } }