Add mutex guarding realm refcount.

NOTE: Only guarding writes.

3 files changed, 13 insertions, 3 deletions

diff --git a/ChangeLog b/ChangeLog
index 1e98db4..f654c37 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -22,6 +22,7 @@ Changes between 1.6.8 and the master branch
 	- Avoid a deadlock situation with dynamic servers (RADSECPROXY-73).
 	- Completely reload CAs and CRLs with cacheExpiry (RADSECPROXY-50).
 	- Tie Access-Request log lines to response log lines (RADSECPROXY-60).
+	- Take lock on realm refcount before updating it (RADSECPROXY-77).
 
 2016-09-21 1.6.8
 	Bug fixes:
diff --git a/radsecproxy.c b/radsecproxy.c
index 75f936e..dbb2576 100644
--- a/radsecproxy.c
+++ b/radsecproxy.c
@@ -673,8 +673,11 @@ static int msmppdecrypt(uint8_t *text, uint8_t len, uint8_t *shared, uint8_t sha
 }
 
 struct realm *newrealmref(struct realm *r) {
-    if (r)
+    if (r) {
+        pthread_mutex_lock(&r->refmutex);
 	r->refcount++;
+        pthread_mutex_unlock(&r->refmutex);
+    }
     return r;
 }
 
@@ -2022,12 +2025,16 @@ void freerealm(struct realm *realm) {
     if (!realm)
 	return;
     debug(DBG_DBG, "freerealm: called with refcount %d", realm->refcount);
-    if (--realm->refcount)
+    pthread_mutex_lock(&realm->refmutex);
+    --realm->refcount;
+    pthread_mutex_unlock(&realm->refmutex);
+    if (realm->refcount)
 	return;
 
     free(realm->name);
     free(realm->message);
     regfree(&realm->regex);
+    pthread_mutex_destroy(&realm->refmutex);
     pthread_mutex_destroy(&realm->mutex);
     /* if refcount == 0, all subrealms gone */
     list_destroy(realm->subrealms);
@@ -2083,7 +2090,8 @@ struct realm *addrealm(struct list *realmlist, char *value, char **servers, char
     }
     memset(realm, 0, sizeof(struct realm));
 
-    if (pthread_mutex_init(&realm->mutex, NULL)) {
+    if (pthread_mutex_init(&realm->mutex, NULL) ||
+        pthread_mutex_init(&realm->refmutex, NULL)) {
 	debugerrno(errno, DBG_ERR, "mutex init failed");
 	free(realm);
 	realm = NULL;
diff --git a/radsecproxy.h b/radsecproxy.h
index 244eb5c..c96cc69 100644
--- a/radsecproxy.h
+++ b/radsecproxy.h
@@ -185,6 +185,7 @@ struct realm {
     uint8_t accresp;
     regex_t regex;
     uint32_t refcount;
+    pthread_mutex_t refmutex;
     pthread_mutex_t mutex;
     struct realm *parent;
     struct list *subrealms;