diff options
| author | Mark Michelson <mmichelson@digium.com> | 2012-08-30 20:54:51 +0000 |
|---|---|---|
| committer | Mark Michelson <mmichelson@digium.com> | 2012-08-30 20:54:51 +0000 |
| commit | 1ab2639cf2d5e8df3aa2c5b7d7c41896fd8846d6 (patch) | |
| tree | 77490ea836d0e583d7bae5c3eda2537cbd075906 /apps | |
| parent | c3b5ec70acf3e953f747473b033adfdbc6511f5c (diff) | |
Prevent crash on shutdown due to refcount error on queues container.
When app_queue is unloaded, the queues container has its refcount
decremented, potentially to 0. Then the taskprocessor responsible
for handling device state changes is unreferenced. If the
taskprocessor happens to be just about to run its task, then it
will create and destroy an iterator on the queues container.
This can cause the refcount on the queues container to increase to
1 and then back to 0. Going back to 0 a second time results in
double frees.
This failure was seen periodically in the testsuite when Asterisk
would shut down.
........
Merged revisions 372089 from http://svn.asterisk.org/svn/asterisk/branches/1.8
........
Merged revisions 372090 from http://svn.asterisk.org/svn/asterisk/branches/10
........
Merged revisions 372091 from http://svn.asterisk.org/svn/asterisk/branches/11
git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@372092 65c4cc65-6c06-0410-ace0-fbb531ad65f3
Diffstat (limited to 'apps')
| -rw-r--r-- | apps/app_queue.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/apps/app_queue.c b/apps/app_queue.c index 1ca8dc5bd..8cc6cc1a5 100644 --- a/apps/app_queue.c +++ b/apps/app_queue.c @@ -9484,8 +9484,8 @@ static int unload_module(void) queue_t_unref(q, "Done with iterator"); } ao2_iterator_destroy(&q_iter); - ao2_ref(queues, -1); devicestate_tps = ast_taskprocessor_unreference(devicestate_tps); + ao2_ref(queues, -1); ast_unload_realtime("queue_members"); return res; } |