lib: fix thread_cancel_event()

  ospfd was crashing some times on neighbour going down. The cause was that
ospf_nsm_event() was accessing already freed memory in ospf_nbr_delete()
call from ospf_nsm_event().

  What happens is that since commit b5043aab (lib: fix incorrect thread
list...) now a thread can be on the event and ready lists but
thread_cancel_event() doesn't account for that.

* thread.c: (thread_cancel_event) loop on the ready list too to cancel
  pending events.

Signed-off-by: Jorge Boncompte [DTI2] <jorge@dti2.net>
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>

1 files changed, 18 insertions, 0 deletions

diff --git a/lib/thread.c b/lib/thread.c
index b36c43a9..dd0413b3 100644
--- a/lib/thread.c
+++ b/lib/thread.c
@@ -916,6 +916,24 @@ thread_cancel_event (struct thread_master *m, void *arg)
           thread_add_unuse (m, t);
         }
     }
+
+  /* thread can be on the ready list too */
+  thread = m->ready.head;
+  while (thread)
+    {
+      struct thread *t;
+
+      t = thread;
+      thread = t->next;
+
+      if (t->arg == arg)
+        {
+          ret++;
+          thread_list_delete (&m->ready, t);
+          t->type = THREAD_UNUSED;
+          thread_add_unuse (m, t);
+        }
+    }
   return ret;
 }