blob: fe8362d0c6f1a6c1eca90a5fa9543b3a18a0db3e (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
From aaa964a8f861d5cd68723adc27236548f3f05713 Mon Sep 17 00:00:00 2001
From: "Jorge Boncompte [DTI2]" <jorge@dti2.net>
Date: Mon, 7 May 2012 15:17:31 +0000
Subject: [PATCH 1/4] lib: fix thread_cancel_event()
ospfd was crashing some times on neighbour going down. The cause was that
ospf_nsm_event() was accessing already freed memory in ospf_nbr_delete()
call from ospf_nsm_event().
What happens is that since commit b5043aab (lib: fix incorrect thread
list...) now a thread can be on the event and ready lists but
thread_cancel_event() doesn't account for that.
* thread.c: (thread_cancel_event) loop on the ready list too to cancel
pending events.
Signed-off-by: Jorge Boncompte [DTI2] <jorge@dti2.net>
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
---
lib/thread.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/lib/thread.c b/lib/thread.c
index b36c43a..dd0413b 100644
--- a/lib/thread.c
+++ b/lib/thread.c
@@ -916,6 +916,24 @@ thread_cancel_event (struct thread_master *m, void *arg)
thread_add_unuse (m, t);
}
}
+
+ /* thread can be on the ready list too */
+ thread = m->ready.head;
+ while (thread)
+ {
+ struct thread *t;
+
+ t = thread;
+ thread = t->next;
+
+ if (t->arg == arg)
+ {
+ ret++;
+ thread_list_delete (&m->ready, t);
+ t->type = THREAD_UNUSED;
+ thread_add_unuse (m, t);
+ }
+ }
return ret;
}
--
1.8.0
|
