radius: fixed bug of double packet free when second DM request received in time when radius sends Accounting-Request Stop

5 files changed, 30 insertions, 3 deletions

diff --git a/accel-pptpd/radius/dm_coa.c b/accel-pptpd/radius/dm_coa.c
index 4b89449d..5edbdd93 100644
--- a/accel-pptpd/radius/dm_coa.c
+++ b/accel-pptpd/radius/dm_coa.c
@@ -134,7 +134,10 @@ static void disconnect_request(struct radius_pd_t *rpd)
 	dm_coa_send_ack(serv.hnd.fd, rpd->dm_coa_req, &rpd->dm_coa_addr);
 
 	rad_packet_free(rpd->dm_coa_req);
+	
+	pthread_mutex_lock(&rpd->lock);
 	rpd->dm_coa_req = NULL;
+	pthread_mutex_unlock(&rpd->lock);
 
 	ppp_terminate(rpd->ppp, TERM_ADMIN_RESET, 0);
 }
@@ -165,6 +168,13 @@ static void coa_request(struct radius_pd_t *rpd)
 	pthread_mutex_unlock(&rpd->lock);
 }
 
+void dm_coa_cancel(struct radius_pd_t *rpd)
+{
+	triton_cancel_call(rpd->ppp->ctrl->ctx, (triton_event_func)disconnect_request);
+	triton_cancel_call(rpd->ppp->ctrl->ctx, (triton_event_func)coa_request);
+	rad_packet_free(rpd->dm_coa_req);
+}
+
 static int dm_coa_read(struct triton_md_handler_t *h)
 {
 	struct rad_packet_t *pack;
@@ -216,9 +226,9 @@ static int dm_coa_read(struct triton_md_handler_t *h)
 		memcpy(&rpd->dm_coa_addr, &addr, sizeof(addr));
 
 		if (pack->code == CODE_DISCONNECT_REQUEST)
-			triton_context_call(rpd->ppp->ctrl->ctx, (void (*)(void *))disconnect_request, rpd);
+			triton_context_call(rpd->ppp->ctrl->ctx, (triton_event_func)disconnect_request, rpd);
 		else
-			triton_context_call(rpd->ppp->ctrl->ctx, (void (*)(void *))coa_request, rpd);
+			triton_context_call(rpd->ppp->ctrl->ctx, (triton_event_func)coa_request, rpd);
 
 		pthread_mutex_unlock(&rpd->lock);
 
diff --git a/accel-pptpd/radius/radius.c b/accel-pptpd/radius/radius.c
index fd3cd1e1..eff1e349 100644
--- a/accel-pptpd/radius/radius.c
+++ b/accel-pptpd/radius/radius.c
@@ -216,7 +216,7 @@ static void ppp_finished(struct ppp_t *ppp)
 		rad_req_free(rpd->acct_req);
 
 	if (rpd->dm_coa_req)
-		rad_packet_free(rpd->dm_coa_req);
+		dm_coa_cancel(rpd);
 
 	if (rpd->session_timeout.tpd)
 		triton_timer_del(&rpd->session_timeout);
diff --git a/accel-pptpd/radius/radius_p.h b/accel-pptpd/radius/radius_p.h
index 978431a7..570c496b 100644
--- a/accel-pptpd/radius/radius_p.h
+++ b/accel-pptpd/radius/radius_p.h
@@ -107,6 +107,7 @@ void rad_packet_free(struct rad_packet_t *);
 void rad_packet_print(struct rad_packet_t *pack, void (*print)(const char *fmt, ...));
 int rad_packet_send(struct rad_packet_t *pck, int fd, struct sockaddr_in *addr);
 
+void dm_coa_cancel(struct radius_pd_t *pd);
 
 #endif
 
diff --git a/accel-pptpd/triton/triton.c b/accel-pptpd/triton/triton.c
index b62d04f1..a628fe16 100644
--- a/accel-pptpd/triton/triton.c
+++ b/accel-pptpd/triton/triton.c
@@ -416,6 +416,21 @@ int __export triton_context_call(struct triton_context_t *ud, void (*func)(void
 	return 0;
 }
 
+void __export triton_cancel_call(struct triton_context_t *ud, void (*func)(void *))
+{
+	struct _triton_context_t *ctx = (struct _triton_context_t *)ud->tpd;
+	struct list_head *pos, *n;
+	struct _triton_ctx_call_t *call;
+
+	list_for_each_safe(pos, n, &ctx->pending_calls) {
+		call = list_entry(pos, typeof(*call), entry);
+		if (call->func != func)
+			continue;
+		list_del(&call->entry);
+		mempool_free(call);
+	}
+}
+
 int __export triton_init(const char *conf_file)
 {
 	ctx_pool = mempool_create2(sizeof(struct _triton_context_t));
diff --git a/accel-pptpd/triton/triton.h b/accel-pptpd/triton/triton.h
index 94254288..0fd450cc 100644
--- a/accel-pptpd/triton/triton.h
+++ b/accel-pptpd/triton/triton.h
@@ -72,6 +72,7 @@ void triton_context_set_priority(struct triton_context_t *, int);
 void triton_context_schedule(struct triton_context_t *);
 int triton_context_wakeup(struct triton_context_t *);
 int triton_context_call(struct triton_context_t *, void (*func)(void *), void *arg);
+void triton_cancel_call(struct triton_context_t *, void (*func)(void *));
 
 #define MD_MODE_READ 1
 #define MD_MODE_WRITE 2