[bgp] Fix crash on SIGHUP, deref of freed workqueues

* lib/workqueue.c: free-ing workqueues had never been tested obviously,
  queue's thread was not being stopped
* bgpd/bgpd.c: null out freed workqueues, to prevent acting on freed
  workqueues

diff --git a/bgpd/bgpd.c b/bgpd/bgpd.c
index cebde0a416ad3878dbe2a0af62439972208cfc32..1712c7198d0cd6aa1e36f4881b77c6855e19f725 100644 (file)
--- a/bgpd/bgpd.c
+++ b/bgpd/bgpd.c
@@ -5150,9 +5150,15 @@ bgp_terminate ()
                            BGP_NOTIFY_CEASE_PEER_UNCONFIG);
   
   bgp_cleanup_routes ();
+  
   if (bm->process_main_queue)
-    work_queue_free (bm->process_main_queue);
+    {
+      work_queue_free (bm->process_main_queue);
+      bm->process_main_queue = NULL;
+    }
   if (bm->process_rsclient_queue)
-    work_queue_free (bm->process_rsclient_queue);
+    {
+      work_queue_free (bm->process_rsclient_queue);
+      bm->process_rsclient_queue = NULL;
+    }
 }
-

diff --git a/lib/workqueue.c b/lib/workqueue.c
index 1d32d24117853dc105d83861bb870d4a15327696..7c811edd14592922b565cba492a342c3adb5c43f 100644 (file)
--- a/lib/workqueue.c
+++ b/lib/workqueue.c
@@ -91,6 +91,9 @@ work_queue_new (struct thread_master *m, const char *queue_name)
 void
 work_queue_free (struct work_queue *wq)
 {
+  if (wq->thread != NULL)
+    thread_cancel(wq->thread);
+  
   /* list_delete frees items via callback */
   list_delete (wq->items);
   listnode_delete (&work_queues, wq);