irmd: Handle death of IPCP gracefully

If an IPCP SEGVs abruptly, the sanitizer in the IRMd would also cause
a SEGV because of looping over a registry linked list inside another
safe loop over the same list. A function is added to the registry to
avoid this.

3 files changed, 30 insertions, 12 deletions

diff --git a/src/irmd/main.c b/src/irmd/main.c
index 02ffb21b..98e79aa8 100644
--- a/src/irmd/main.c
+++ b/src/irmd/main.c
@@ -985,9 +985,9 @@ static struct irm_flow * flow_accept(pid_t api, char ** dst_ae_name,
 
         e = api_table_get(&irmd->api_table, api);
         if (e == NULL) {
-                LOG_DBG("Process gone while accepting flow.");
                 pthread_rwlock_unlock(&irmd->reg_lock);
                 pthread_rwlock_unlock(&irmd->state_lock);
+                LOG_DBG("Process gone while accepting flow.");
                 return NULL;
         }
 
@@ -1000,6 +1000,7 @@ static struct irm_flow * flow_accept(pid_t api, char ** dst_ae_name,
         if (reg_entry_get_state(re) != REG_NAME_FLOW_ARRIVED) {
                 pthread_rwlock_unlock(&irmd->reg_lock);
                 pthread_rwlock_unlock(&irmd->state_lock);
+                LOG_ERR("Entry in wrong state.");
                 return NULL;
         }
         pthread_rwlock_unlock(&irmd->reg_lock);
@@ -1671,7 +1672,7 @@ void * irm_sanitize(void * o)
                                         continue;
                                 LOG_DBG("Dead AP-I removed from: %d %s.",
                                         a->pid, e->name);
-                                reg_entry_del_api(e, a->pid);
+                                reg_entry_del_pid_el(e, a);
                         }
                 }
 
diff --git a/src/irmd/registry.c b/src/irmd/registry.c
index 7e21375e..fec69cfa 100644
--- a/src/irmd/registry.c
+++ b/src/irmd/registry.c
@@ -296,6 +296,29 @@ int reg_entry_add_api(struct reg_entry * e, pid_t api)
         return 0;
 }
 
+static void reg_entry_check_state(struct reg_entry * e)
+{
+        if (list_is_empty(&e->reg_apis)) {
+                if (!list_is_empty(&e->reg_apns))
+                        e->state = REG_NAME_AUTO_ACCEPT;
+                else
+                        e->state = REG_NAME_IDLE;
+        } else {
+                e->state = REG_NAME_FLOW_ACCEPT;
+        }
+
+        pthread_cond_broadcast(&e->state_cond);
+}
+
+void reg_entry_del_pid_el(struct reg_entry * e,
+                          struct pid_el *    p)
+{
+        list_del(&p->next);
+        free(p);
+
+        reg_entry_check_state(e);
+}
+
 void reg_entry_del_api(struct reg_entry * e, pid_t api)
 {
         struct list_head * p;
@@ -312,16 +335,7 @@ void reg_entry_del_api(struct reg_entry * e, pid_t api)
                 }
         }
 
-        if (list_is_empty(&e->reg_apis)) {
-                if (!list_is_empty(&e->reg_apns))
-                        e->state = REG_NAME_AUTO_ACCEPT;
-                else
-                        e->state = REG_NAME_IDLE;
-        } else {
-                e->state = REG_NAME_FLOW_ACCEPT;
-        }
-
-        pthread_cond_broadcast(&e->state_cond);
+        reg_entry_check_state(e);
 }
 
 pid_t reg_entry_get_api(struct reg_entry * e)
diff --git a/src/irmd/registry.h b/src/irmd/registry.h
index bdd5cad0..7713e278 100644
--- a/src/irmd/registry.h
+++ b/src/irmd/registry.h
@@ -84,6 +84,9 @@ int                 reg_entry_add_api(struct reg_entry * e,
 void                reg_entry_del_api(struct reg_entry * e,
                                       pid_t              api);
 
+void                reg_entry_del_pid_el(struct reg_entry * e,
+                                         struct pid_el *    a);
+
 pid_t               reg_entry_get_api(struct reg_entry * e);
 
 enum reg_name_state reg_entry_get_state(struct reg_entry * e);