qrouting: Improve GW stats list management

    * fix double free crash due to list being circular
    * avoid shm leak on OOM condition

modules/qrouting/qr_stats.c

@@ -41,21 +41,26 @@ qr_rule_t **qr_rules_start;
 
 /* create the samples for a gateway's history */
 qr_sample_t * create_history(void) {
-	qr_sample_t * history, *tmp;
+	qr_sample_t *history, *tmp;
 	int i;
 
-	history = (qr_sample_t*)shm_malloc(sizeof(qr_sample_t));
-	if(history == NULL) {
-		LM_ERR("no more shm_memory\n");
+	history = shm_malloc(sizeof *history);
+	if (!history) {
+		LM_ERR("oom\n");
 		return NULL;
 	}
-	for(tmp = history, i = 0; i < qr_n-1; tmp = tmp->next, ++i) {
-		tmp->next = (qr_sample_t*)shm_malloc(sizeof(qr_sample_t));
-		if(tmp->next == NULL)
-			return NULL;
+
+	for (tmp = history, i = 0; i < qr_n-1; tmp = tmp->next, ++i) {
+		tmp->next = shm_malloc(sizeof *tmp->next);
+		if (!tmp->next)
+			goto error;
 	}
+
 	tmp->next = history;
 	return history;
+error:
+	shm_free_all(history);
+	return NULL;
 }
 
 qr_gw_t *qr_create_gw(void *dst)

ut.h

@@ -134,28 +134,28 @@ struct sip_msg;
 	_add_last(what, where, next)
 
 /**
- * pkg_free_all() - pkg_free() each element of the given list.
+ * pkg_free_all() - pkg_free() each element of the given (circular) list.
  * @things: Pointer to the list that is to be freed in succession.
  *
  * The list is walked using "->next".
  */
 #define pkg_free_all(things) \
 	do { \
-		typeof(things) pos; \
-		while (things) \
+		typeof(things) pos = NULL, head = things; \
+		while (things && (!pos || things != head)) \
 			{ pos = (things); (things) = (things)->next; pkg_free(pos); } \
 	} while (0)
 
 /**
- * shm_free_all() - shm_free() each element of the given list.
+ * shm_free_all() - shm_free() each element of the given (circular) list.
  * @things: Pointer to the list that is to be freed in succession.
  *
  * The list is walked using "->next".
  */
 #define shm_free_all(things) \
 	do { \
-		typeof(things) pos; \
-		while (things) \
+		typeof(things) pos = NULL, head = things; \
+		while (things && (!pos || things != head)) \
 			{ pos = (things); (things) = (things)->next; shm_free(pos); } \
 	} while (0)