From ec8ef5229ce5e1566821437905e92bf97720fbb7 Mon Sep 17 00:00:00 2001 From: Mark Michelson Date: Fri, 28 Mar 2008 00:17:17 +0000 Subject: [PATCH] Merged revisions 111533 via svnmerge from https://origsvn.digium.com/svn/asterisk/trunk ........ r111533 | mmichelson | 2008-03-27 19:12:52 -0500 (Thu, 27 Mar 2008) | 10 lines Fix a crash that would happen when attempting to unload the app_queue module. The problem was that when the refcount on the queue hit 0, the destructor was called, and inside the destructor, another function was called which would increase the refcount back to 1 again and then decrease it again back to 0 for every member in the queue. This meant that the destructor was being recursively called, leading to a double free of the queue. This is now fixed by making sure to unlink the queue from the queues container prior to the final unref of the queue. ........ git-svn-id: https://origsvn.digium.com/svn/asterisk/branches/1.6.0@111534 65c4cc65-6c06-0410-ace0-fbb531ad65f3 --- apps/app_queue.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/apps/app_queue.c b/apps/app_queue.c index b8a084491a..9a24cc37f8 100644 --- a/apps/app_queue.c +++ b/apps/app_queue.c @@ -1402,8 +1402,6 @@ static void destroy_queue(void *obj) struct call_queue *q = obj; int i; - ast_debug(0, "Queue destructor called for queue '%s'!\n", q->name); - free_members(q, 1); ast_string_field_free_memory(q); for (i = 0; i < MAX_PERIODIC_ANNOUNCEMENTS; i++) { @@ -6169,6 +6167,8 @@ static int unload_module(void) { int res; struct ast_context *con; + struct ao2_iterator q_iter; + struct call_queue *q = NULL; if (device_state.thread != AST_PTHREADT_NULL) { device_state.stop = 1; @@ -6211,6 +6211,11 @@ static int unload_module(void) clear_and_free_interfaces(); + q_iter = ao2_iterator_init(queues, 0); + while ((q = ao2_iterator_next(&q_iter))) { + ao2_unlink(queues, q); + queue_unref(q); + } ao2_ref(queues, -1); return res;