Merge remote-tracking branch 'public/bug12985_024' into bug12984_025

4 files changed, 30 insertions, 6 deletions

diff --git a/changes/bug12985 b/changes/bug12985
new file mode 100644
index 0000000000..dc14cdd375
--- /dev/null
+++ b/changes/bug12985
@@ -0,0 +1,4 @@
+  o Minor bugfixes (shutdown):
+    - When shutting down, always call event_del() on lingering read or
+      write events before freeing them. Fixes bug 12985; bugfix on
+      0.1.0.2-rc.
diff --git a/src/common/compat_libevent.c b/src/common/compat_libevent.c
index 74b54bb855..5d9846cca4 100644
--- a/src/common/compat_libevent.c
+++ b/src/common/compat_libevent.c
@@ -146,13 +146,25 @@ tor_evsignal_new(struct event_base * base, int sig,
 {
   return tor_event_new(base, sig, EV_SIGNAL|EV_PERSIST, cb, arg);
 }
-/** Work-alike replacement for event_free() on pre-Libevent-2.0 systems. */
+/** Work-alike replacement for event_free() on pre-Libevent-2.0 systems,
+ * except tolerate tor_event_free(NULL). */
 void
 tor_event_free(struct event *ev)
 {
+  if (ev == NULL)
+    return;
   event_del(ev);
   tor_free(ev);
 }
+#else
+/* Wrapper for event_free() that tolerates tor_event_free(NULL) */
+void
+tor_event_free(struct event *ev)
+{
+  if (ev == NULL)
+    return;
+  event_free(ev);
+}
 #endif
 
 /** Global event base for use by the main thread. */
diff --git a/src/common/compat_libevent.h b/src/common/compat_libevent.h
index 9ee7b49cfb..b2f60cd65a 100644
--- a/src/common/compat_libevent.h
+++ b/src/common/compat_libevent.h
@@ -28,11 +28,9 @@ void suppress_libevent_log_msg(const char *msg);
 #define tor_event_new     event_new
 #define tor_evtimer_new   evtimer_new
 #define tor_evsignal_new  evsignal_new
-#define tor_event_free    event_free
 #define tor_evdns_add_server_port(sock, tcp, cb, data) \
   evdns_add_server_port_with_base(tor_libevent_get_base(), \
   (sock),(tcp),(cb),(data));
-
 #else
 struct event *tor_event_new(struct event_base * base, evutil_socket_t sock,
            short what, void (*cb)(evutil_socket_t, short, void *), void *arg);
@@ -40,10 +38,11 @@ struct event *tor_evtimer_new(struct event_base * base,
             void (*cb)(evutil_socket_t, short, void *), void *arg);
 struct event *tor_evsignal_new(struct event_base * base, int sig,
             void (*cb)(evutil_socket_t, short, void *), void *arg);
-void tor_event_free(struct event *ev);
 #define tor_evdns_add_server_port evdns_add_server_port
 #endif
 
+void tor_event_free(struct event *ev);
+
 typedef struct periodic_timer_t periodic_timer_t;
 
 periodic_timer_t *periodic_timer_new(struct event_base *base,
diff --git a/src/or/connection.c b/src/or/connection.c
index 4788bdf950..bcb17376c0 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -575,8 +575,17 @@ connection_free_(connection_t *conn)
     tor_free(control_conn->incoming_cmd);
   }
 
-  tor_free(conn->read_event); /* Probably already freed by connection_free. */
-  tor_free(conn->write_event); /* Probably already freed by connection_free. */
+#ifdef TOR_IS_MULTITHREADED
+  /* Probably already freed by connection_free. */
+  /* We don't do these frees on the multiprocess case, since in that case we
+   * don't want to call event_del() postfork or it's likely to mess up.
+   * Multiprocess builds are deprecated, so let's just have a one-time memory
+   * leak here.
+   */
+  tor_event_free(conn->read_event);
+  tor_event_free(conn->write_event);
+  conn->read_event = conn->write_event = NULL;
+#endif
   IF_HAS_BUFFEREVENT(conn, {
       /* This was a workaround to handle bugs in some old versions of libevent
        * where callbacks can occur after calling bufferevent_free().  Setting