Merge branch 'bug7087' of git://git.torproject.org/user/andrea/tor

src/or/channel.c

@@ -808,11 +808,24 @@ channel_free(channel_t *chan)
   /* It must be deregistered */
   tor_assert(!(chan->registered));
 
+  log_debug(LD_CHANNEL,
+            "Freeing channel " U64_FORMAT " at %p",
+            U64_PRINTF_ARG(chan->global_identifier), chan);
+
+  /*
+   * Get rid of cmux policy before we do anything, so cmux policies don't
+   * see channels in weird half-freed states.
+   */
+  if (chan->cmux) {
+    circuitmux_set_policy(chan->cmux, NULL);
+  }
+
   /* Call a free method if there is one */
   if (chan->free) chan->free(chan);
 
   channel_clear_remote_end(chan);
 
+  /* Get rid of cmux */
   if (chan->cmux) {
     circuitmux_detach_all_circuits(chan->cmux);
     circuitmux_free(chan->cmux);
@@ -863,11 +876,29 @@ channel_force_free(channel_t *chan)
 {
   tor_assert(chan);
 
+  log_debug(LD_CHANNEL,
+            "Force-freeing channel " U64_FORMAT " at %p",
+            U64_PRINTF_ARG(chan->global_identifier), chan);
+
+  /*
+   * Get rid of cmux policy before we do anything, so cmux policies don't
+   * see channels in weird half-freed states.
+   */
+  if (chan->cmux) {
+    circuitmux_set_policy(chan->cmux, NULL);
+  }
+
   /* Call a free method if there is one */
   if (chan->free) chan->free(chan);
 
   channel_clear_remote_end(chan);
 
+  /* Get rid of cmux */
+  if (chan->cmux) {
+    circuitmux_free(chan->cmux);
+    chan->cmux = NULL;
+  }
+
   /* We might still have a cell queue; kill it */
   if (chan->incoming_queue) {
     SMARTLIST_FOREACH_BEGIN(chan->incoming_queue,