Merge pull request #2771 from qlyoung/fix-zserv-shutdown-crash-3

zebra: don't close client socket from I/O pthread mc crasherson mc crashy crash bandicoot

lib/thread.c

@@ -782,6 +782,7 @@ struct thread *funcname_thread_add_read_write(int dir, struct thread_master *m,
 {
 	struct thread *thread = NULL;
 
+	assert(fd >= 0 && fd < m->fd_limit);
 	pthread_mutex_lock(&m->mtx);
 	{
 		if (t_ptr

zebra/zserv.c

@@ -163,6 +163,9 @@ static void zserv_log_message(const char *errmsg, struct stream *msg,
  * Cancel any pending tasks for the client's thread. Then schedule a task on
  * the main thread to shut down the calling thread.
  *
+ * It is not safe to close the client socket in this function. The socket is
+ * owned by the main thread.
+ *
  * Must be called from the client pthread, never the main thread.
  */
 static void zserv_client_fail(struct zserv *client)
@@ -172,10 +175,7 @@ static void zserv_client_fail(struct zserv *client)
 
 	atomic_store_explicit(&client->pthread->running, false,
 			      memory_order_relaxed);
-	if (client->sock > 0) {
-		close(client->sock);
-		client->sock = -1;
-	}
+
 	THREAD_OFF(client->t_read);
 	THREAD_OFF(client->t_write);
 	zserv_event(client, ZSERV_HANDLE_CLIENT_FAIL);
@@ -576,6 +576,7 @@ static void zserv_client_free(struct zserv *client)
 		unsigned long nroutes;
 
 		close(client->sock);
+
 		nroutes = rib_score_proto(client->proto, client->instance);
 		zlog_notice(
 			"client %d disconnected. %lu %s routes removed from the rib",
@@ -621,12 +622,6 @@ void zserv_close_client(struct zserv *client)
 		zlog_debug("Closing client '%s'",
 			   zebra_route_string(client->proto));
 
-	/* if file descriptor is still open, close it */
-	if (client->sock > 0) {
-		close(client->sock);
-		client->sock = -1;
-	}
-
 	thread_cancel_event(zebrad.master, client);
 	THREAD_OFF(client->t_cleanup);