From fa24bad0f7f82b4718cc2f13f60fcdd9b0cf86fe Mon Sep 17 00:00:00 2001
From: Garrett D'Amore <garrett@damore.org>
Date: Wed, 19 Jul 2017 17:20:51 -0700
Subject: Crash on close again.

This one is caused by us deallocating the msg queue before we
stop all asynchronous I/O operations; consequently we can wind
up with a thread trying to access a msg queue after it has been
destroyed.

A lesson here is that nni_aio_fini() needs to be treated much like
nni_thr_fini() - you should do this *before* deallocating anything
that callback functions might be referencing.
---
 src/protocol/bus/bus.c        | 2 +-
 src/protocol/pubsub/pub.c     | 2 +-
 src/protocol/reqrep/rep.c     | 4 ++--
 src/protocol/survey/respond.c | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

(limited to 'src')

diff --git a/src/protocol/bus/bus.c b/src/protocol/bus/bus.c
index 167c342d..17ef03bb 100644
--- a/src/protocol/bus/bus.c
+++ b/src/protocol/bus/bus.c
@@ -108,12 +108,12 @@ nni_bus_pipe_fini(void *arg)
 	nni_bus_pipe *ppipe = arg;
 
 	if (ppipe != NULL) {
-		nni_msgq_fini(ppipe->sendq);
 		nni_mtx_fini(&ppipe->mtx);
 		nni_aio_fini(&ppipe->aio_getq);
 		nni_aio_fini(&ppipe->aio_send);
 		nni_aio_fini(&ppipe->aio_recv);
 		nni_aio_fini(&ppipe->aio_putq);
+		nni_msgq_fini(ppipe->sendq);
 		NNI_FREE_STRUCT(ppipe);
 	}
 }
diff --git a/src/protocol/pubsub/pub.c b/src/protocol/pubsub/pub.c
index 508ab7ce..316cbf50 100644
--- a/src/protocol/pubsub/pub.c
+++ b/src/protocol/pubsub/pub.c
@@ -101,10 +101,10 @@ nni_pub_pipe_fini(void *arg)
 {
 	nni_pub_pipe *pp = arg;
 
-	nni_msgq_fini(pp->sendq);
 	nni_aio_fini(&pp->aio_getq);
 	nni_aio_fini(&pp->aio_send);
 	nni_aio_fini(&pp->aio_recv);
+	nni_msgq_fini(pp->sendq);
 	NNI_FREE_STRUCT(pp);
 }
 
diff --git a/src/protocol/reqrep/rep.c b/src/protocol/reqrep/rep.c
index 1e4ee4ef..013b02fb 100644
--- a/src/protocol/reqrep/rep.c
+++ b/src/protocol/reqrep/rep.c
@@ -160,11 +160,11 @@ nni_rep_pipe_fini(void *arg)
 {
 	nni_rep_pipe *rp = arg;
 
-	nni_msgq_fini(rp->sendq);
 	nni_aio_fini(&rp->aio_getq);
 	nni_aio_fini(&rp->aio_send);
 	nni_aio_fini(&rp->aio_recv);
 	nni_aio_fini(&rp->aio_putq);
+	nni_msgq_fini(rp->sendq);
 	NNI_FREE_STRUCT(rp);
 }
 
@@ -191,11 +191,11 @@ nni_rep_pipe_stop(void *arg)
 	nni_rep_pipe *rp  = arg;
 	nni_rep_sock *rep = rp->rep;
 
+	nni_msgq_close(rp->sendq);
 	nni_aio_cancel(&rp->aio_getq, NNG_ECANCELED);
 	nni_aio_cancel(&rp->aio_putq, NNG_ECANCELED);
 	nni_aio_cancel(&rp->aio_send, NNG_ECANCELED);
 	nni_aio_cancel(&rp->aio_recv, NNG_ECANCELED);
-	nni_msgq_close(rp->sendq);
 
 	nni_idhash_remove(rep->pipes, nni_pipe_id(rp->pipe));
 }
diff --git a/src/protocol/survey/respond.c b/src/protocol/survey/respond.c
index 685f39fd..4a4c8741 100644
--- a/src/protocol/survey/respond.c
+++ b/src/protocol/survey/respond.c
@@ -160,11 +160,11 @@ nni_resp_pipe_fini(void *arg)
 {
 	nni_resp_pipe *ppipe = arg;
 
-	nni_msgq_fini(ppipe->sendq);
 	nni_aio_fini(&ppipe->aio_putq);
 	nni_aio_fini(&ppipe->aio_getq);
 	nni_aio_fini(&ppipe->aio_send);
 	nni_aio_fini(&ppipe->aio_recv);
+	nni_msgq_fini(ppipe->sendq);
 	NNI_FREE_STRUCT(ppipe);
 }
 
-- 
cgit v1.2.3-70-g09d2