[bgp] Fix crash on SIGHUP, deref of freed workqueues

* lib/workqueue.c: free-ing workqueues had never been tested obviously,
  queue's thread was not being stopped
* bgpd/bgpd.c: null out freed workqueues, to prevent acting on freed
  workqueues

2 files changed, 12 insertions, 3 deletions

diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index cebde0a4..1712c719 100644
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -5150,9 +5150,15 @@ bgp_terminate ()
                            BGP_NOTIFY_CEASE_PEER_UNCONFIG);
   
   bgp_cleanup_routes ();
+  
   if (bm->process_main_queue)
-    work_queue_free (bm->process_main_queue);
+    {
+      work_queue_free (bm->process_main_queue);
+      bm->process_main_queue = NULL;
+    }
   if (bm->process_rsclient_queue)
-    work_queue_free (bm->process_rsclient_queue);
+    {
+      work_queue_free (bm->process_rsclient_queue);
+      bm->process_rsclient_queue = NULL;
+    }
 }
-
diff --git a/lib/workqueue.c b/lib/workqueue.c
index 1d32d241..7c811edd 100644
--- a/lib/workqueue.c
+++ b/lib/workqueue.c
@@ -91,6 +91,9 @@ work_queue_new (struct thread_master *m, const char *queue_name)
 void
 work_queue_free (struct work_queue *wq)
 {
+  if (wq->thread != NULL)
+    thread_cancel(wq->thread);
+  
   /* list_delete frees items via callback */
   list_delete (wq->items);
   listnode_delete (&work_queues, wq);