release IP addresses before fire EV_SESSION_FINISHED (fixes segfault when using IPoE)

6 files changed, 11 insertions, 25 deletions

diff --git a/accel-pppd/ctrl/ipoe/ipoe.c b/accel-pppd/ctrl/ipoe/ipoe.c
index a4809b00..cdb8fb09 100644
--- a/accel-pppd/ctrl/ipoe/ipoe.c
+++ b/accel-pppd/ctrl/ipoe/ipoe.c
@@ -1095,11 +1095,6 @@ static void ipoe_session_finished(struct ap_session *s)
 	if (ses->relay_addr && ses->serv->dhcpv4_relay)
 		dhcpv4_relay_send_release(ses->serv->dhcpv4_relay, ses->hwaddr, ses->xid, ses->yiaddr, ses->client_id, ses->relay_agent, ses->serv->ifname, conf_agent_remote_id);
 
-	if (s->ipv4 && s->ipv4->owner) {
-		ipdb_put_ipv4(s, s->ipv4);
-		s->ipv4 = NULL;
-	}
-
 	if (ses->ifcfg)
 		ipoe_ifcfg_del(ses, 1);
 	
diff --git a/accel-pppd/ppp/ipcp_opt_ipaddr.c b/accel-pppd/ppp/ipcp_opt_ipaddr.c
index e5246d55..8a77848e 100644
--- a/accel-pppd/ppp/ipcp_opt_ipaddr.c
+++ b/accel-pppd/ppp/ipcp_opt_ipaddr.c
@@ -58,11 +58,6 @@ static void ipaddr_free(struct ppp_ipcp_t *ipcp, struct ipcp_option_t *opt)
 {
 	struct ipaddr_option_t *ipaddr_opt = container_of(opt, typeof(*ipaddr_opt), opt);
 
-	if (ipcp->ppp->ses.ipv4) {
-		ipdb_put_ipv4(&ipcp->ppp->ses, ipcp->ppp->ses.ipv4);
-		ipcp->ppp->ses.ipv4 = NULL;
-	}
-
 	_free(ipaddr_opt);
 }
 
diff --git a/accel-pppd/ppp/ipv6cp_opt_intfid.c b/accel-pppd/ppp/ipv6cp_opt_intfid.c
index 11b35ff7..d2b8127a 100644
--- a/accel-pppd/ppp/ipv6cp_opt_intfid.c
+++ b/accel-pppd/ppp/ipv6cp_opt_intfid.c
@@ -108,11 +108,6 @@ static void ipaddr_free(struct ppp_ipv6cp_t *ipv6cp, struct ipv6cp_option_t *opt
 {
 	struct ipaddr_option_t *ipaddr_opt=container_of(opt,typeof(*ipaddr_opt),opt);
 
-	if (ipv6cp->ppp->ses.ipv6) {
-		ipdb_put_ipv6(&ipv6cp->ppp->ses, ipv6cp->ppp->ses.ipv6);
-		ipv6cp->ppp->ses.ipv6 = NULL;
-	}
-
 	_free(ipaddr_opt);
 }
 
diff --git a/accel-pppd/ppp/ppp_ipcp.c b/accel-pppd/ppp/ppp_ipcp.c
index c05e20b1..6cb86a4b 100644
--- a/accel-pppd/ppp/ppp_ipcp.c
+++ b/accel-pppd/ppp/ppp_ipcp.c
@@ -209,11 +209,6 @@ static void ipcp_layer_finished(struct ppp_fsm_t *fsm)
 		ap_session_terminate(&ipcp->ppp->ses, TERM_USER_ERROR, 0);
 	
 	fsm->fsm_state = FSM_Closed;
-	
-	if (ipcp->ppp->ses.ipv4) {
-		ipdb_put_ipv4(&ipcp->ppp->ses, ipcp->ppp->ses.ipv4);
-		ipcp->ppp->ses.ipv4 = NULL;
-	}
 }
 
 static void ipcp_layer_down(struct ppp_fsm_t *fsm)
diff --git a/accel-pppd/ppp/ppp_ipv6cp.c b/accel-pppd/ppp/ppp_ipv6cp.c
index ee666267..9a879227 100644
--- a/accel-pppd/ppp/ppp_ipv6cp.c
+++ b/accel-pppd/ppp/ppp_ipv6cp.c
@@ -209,11 +209,6 @@ static void ipv6cp_layer_finished(struct ppp_fsm_t *fsm)
 		ap_session_terminate(&ipv6cp->ppp->ses, TERM_USER_ERROR, 0);
 	
 	fsm->fsm_state = FSM_Closed;
-
-	if (ipv6cp->ppp->ses.ipv6) {
-		ipdb_put_ipv6(&ipv6cp->ppp->ses, ipv6cp->ppp->ses.ipv6);
-		ipv6cp->ppp->ses.ipv6 = NULL;
-	}
 }
 
 static void ipv6cp_layer_down(struct ppp_fsm_t *fsm)
diff --git a/accel-pppd/session.c b/accel-pppd/session.c
index b50686cd..8885cb22 100644
--- a/accel-pppd/session.c
+++ b/accel-pppd/session.c
@@ -19,6 +19,7 @@
 #include "log.h"
 #include "events.h"
 #include "ap_session.h"
+#include "ipdb.h"
 #include "backup.h"
 #include "iputils.h"
 #include "spinlock.h"
@@ -159,6 +160,16 @@ void __export ap_session_finished(struct ap_session *ses)
 			break;
 	}
 
+	if (ses->ipv4 && ses->ipv4->owner) {
+		ipdb_put_ipv4(ses, ses->ipv4);
+		ses->ipv4 = NULL;
+	}
+
+	if (ses->ipv6 && ses->ipv6->owner) {
+		ipdb_put_ipv6(ses, ses->ipv6);
+		ses->ipv6 = NULL;
+	}
+
 	triton_event_fire(EV_SES_FINISHED, ses);
 	ses->ctrl->finished(ses);