Fix potential double free when unloading a module.

........

Merged revisions 378092 from http://svn.asterisk.org/svn/asterisk/branches/1.8

git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@378093 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/main/loader.c b/main/loader.c
index 9cbfaf72425d5e53bebbeee21901d614077a0b20..f4b68c2ef93f6ef949d53db6d62ae34883d83160 100644 (file)
--- a/main/loader.c
+++ b/main/loader.c
@@ -233,9 +233,18 @@ void __ast_module_user_remove(struct ast_module *mod, struct ast_module_user *u)
        if (!u) {
                return;
        }
+
        AST_LIST_LOCK(&mod->users);
-       AST_LIST_REMOVE(&mod->users, u, entry);
+       u = AST_LIST_REMOVE(&mod->users, u, entry);
        AST_LIST_UNLOCK(&mod->users);
+       if (!u) {
+               /*
+                * Was not in the list.  Either a bad pointer or
+                * __ast_module_user_hangup_all() has been called.
+                */
+               return;
+       }
+
        ast_atomic_fetchadd_int(&mod->usecount, -1);
        ast_free(u);
 
@@ -554,15 +563,26 @@ int ast_unload_resource(const char *resource_name, enum ast_module_unload_mode f
        }
 
        if (!error) {
+               /* Request any channels attached to the module to hangup. */
                __ast_module_user_hangup_all(mod);
-               res = mod->info->unload();
 
+               res = mod->info->unload();
                if (res) {
                        ast_log(LOG_WARNING, "Firm unload failed for %s\n", resource_name);
-                       if (force <= AST_FORCE_FIRM)
+                       if (force <= AST_FORCE_FIRM) {
                                error = 1;
-                       else
+                       } else {
                                ast_log(LOG_WARNING, "** Dangerous **: Unloading resource anyway, at user request\n");
+                       }
+               }
+
+               if (!error) {
+                       /*
+                        * Request hangup on any channels that managed to get attached
+                        * while we called the module unload function.
+                        */
+                       __ast_module_user_hangup_all(mod);
+                       sched_yield();
                }
        }