[tor-commits] [tor/master] Correctly clear cmux policies and free cmux in channel_free() and channel_force_free()

[andrea at torproject.org]

commit 9ef286ec8f10f88a5b30f48efd502b9c87933762
Author: Andrea Shepard <andrea at torproject.org>
Date:   Mon Oct 15 06:32:44 2012 -0700

    Correctly clear cmux policies and free cmux in channel_free() and channel_force_free()
---
 src/or/channel.c |   23 +++++++++++++++++++++++
 1 files changed, 23 insertions(+), 0 deletions(-)

diff --git a/src/or/channel.c b/src/or/channel.c
index 6527288..56e15b4 100644
--- a/src/or/channel.c
+++ b/src/or/channel.c
@@ -808,11 +808,20 @@ channel_free(channel_t *chan)
   /* It must be deregistered */
   tor_assert(!(chan->registered));
 
+  /*
+   * Get rid of cmux policy before we do anything, so cmux policies don't
+   * see channels in weird half-freed states.
+   */
+  if (chan->cmux) {
+    circuitmux_set_policy(chan->cmux, NULL);
+  }
+
   /* Call a free method if there is one */
   if (chan->free) chan->free(chan);
 
   channel_clear_remote_end(chan);
 
+  /* Get rid of cmux */
   if (chan->cmux) {
     circuitmux_detach_all_circuits(chan->cmux);
     circuitmux_free(chan->cmux);
@@ -863,11 +872,25 @@ channel_force_free(channel_t *chan)
 {
   tor_assert(chan);
 
+  /*
+   * Get rid of cmux policy before we do anything, so cmux policies don't
+   * see channels in weird half-freed states.
+   */
+  if (chan->cmux) {
+    circuitmux_set_policy(chan->cmux, NULL);
+  }
+
   /* Call a free method if there is one */
   if (chan->free) chan->free(chan);
 
   channel_clear_remote_end(chan);
 
+  /* Get rid of cmux */
+  if (chan->cmux) {
+    circuitmux_free(chan->cmux);
+    chan->cmux = NULL;
+  }
+
   /* We might still have a cell queue; kill it */
   if (chan->incoming_queue) {
     SMARTLIST_FOREACH_BEGIN(chan->incoming_queue,