From: Richard Mudgett <rmudgett@digium.com>
Date: Mon, 17 Dec 2012 23:08:40 +0000 (+0000)
Subject: Fix potential double free when unloading a module.
X-Git-Tag: 10.12.0-rc2~3^2~6
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cb54dcfea759634fcf71bef67396a4ab1f206f26;p=thirdparty%2Fasterisk.git

Fix potential double free when unloading a module.
........

Merged revisions 378092 from http://svn.asterisk.org/svn/asterisk/branches/1.8


git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/10@378093 65c4cc65-6c06-0410-ace0-fbb531ad65f3
---

diff --git a/main/loader.c b/main/loader.c
index 9cbfaf7242..f4b68c2ef9 100644
--- a/main/loader.c
+++ b/main/loader.c
@@ -233,9 +233,18 @@ void __ast_module_user_remove(struct ast_module *mod, struct ast_module_user *u)
 	if (!u) {
 		return;
 	}
+
 	AST_LIST_LOCK(&mod->users);
-	AST_LIST_REMOVE(&mod->users, u, entry);
+	u = AST_LIST_REMOVE(&mod->users, u, entry);
 	AST_LIST_UNLOCK(&mod->users);
+	if (!u) {
+		/*
+		 * Was not in the list.  Either a bad pointer or
+		 * __ast_module_user_hangup_all() has been called.
+		 */
+		return;
+	}
+
 	ast_atomic_fetchadd_int(&mod->usecount, -1);
 	ast_free(u);
 
@@ -554,15 +563,26 @@ int ast_unload_resource(const char *resource_name, enum ast_module_unload_mode f
 	}
 
 	if (!error) {
+		/* Request any channels attached to the module to hangup. */
 		__ast_module_user_hangup_all(mod);
-		res = mod->info->unload();
 
+		res = mod->info->unload();
 		if (res) {
 			ast_log(LOG_WARNING, "Firm unload failed for %s\n", resource_name);
-			if (force <= AST_FORCE_FIRM)
+			if (force <= AST_FORCE_FIRM) {
 				error = 1;
-			else
+			} else {
 				ast_log(LOG_WARNING, "** Dangerous **: Unloading resource anyway, at user request\n");
+			}
+		}
+
+		if (!error) {
+			/*
+			 * Request hangup on any channels that managed to get attached
+			 * while we called the module unload function.
+			 */
+			__ast_module_user_hangup_all(mod);
+			sched_yield();
 		}
 	}