From 0363303d1b67b47605971b313bc33a049e6a3209 Mon Sep 17 00:00:00 2001
From: Simon Rettberg
Date: Wed, 7 Aug 2019 14:28:53 +0200
Subject: [SERVER] Fix race condition and invalid lock order

---
 src/server/net.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

(limited to 'src/server/net.c')

diff --git a/src/server/net.c b/src/server/net.c
index 9abe221..c1fa6fa 100644
--- a/src/server/net.c
+++ b/src/server/net.c
@@ -609,6 +609,12 @@ void net_getStats(int *clientCount, int *serverCount, uint64_t *bytesSent)
 		}
 		bs += client->bytesSent;
 	}
+	// Do this before unlocking the list, otherwise we might
+	// account for a client twice if it would disconnect after
+	// unlocking but before we add the count here.
+	if ( bytesSent != NULL ) {
+		*bytesSent = totalBytesSent + bs;
+	}
 	mutex_unlock( &_clients_lock );
 	if ( clientCount != NULL ) {
 		*clientCount = cc;
@@ -616,9 +622,6 @@ void net_getStats(int *clientCount, int *serverCount, uint64_t *bytesSent)
 	if ( serverCount != NULL ) {
 		*serverCount = sc;
 	}
-	if ( bytesSent != NULL ) {
-		*bytesSent = totalBytesSent + bs;
-	}
 }
 
 void net_disconnectAll()
@@ -694,9 +697,9 @@ static dnbd3_client_t* freeClientStruct(dnbd3_client_t *client)
 		mutex_lock( &client->image->lock );
 		if ( client->image->uplink != NULL ) uplink_removeClient( client->image->uplink, client );
 		mutex_unlock( &client->image->lock );
-		client->image = image_release( client->image );
 	}
 	mutex_unlock( &client->lock );
+	client->image = image_release( client->image );
 	mutex_destroy( &client->lock );
 	mutex_destroy( &client->sendMutex );
 	free( client );
-- 
cgit v1.2.3-55-g7522