bus: break reference cycle between bus and messages

Previously (6ee4f99 bus: break reference cycle between bus and
messages) I committed the test code, but not the actual fix :)

2 files changed, 25 insertions, 2 deletions

diff --git a/Makefile.am b/Makefile.am
index 4fc909787..677de0cf0 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -2096,6 +2096,7 @@ tests += \
 	test-bus-marshal \
 	test-bus-signature \
 	test-bus-chat \
+	test-bus-cleanup \
 	test-bus-server \
 	test-bus-match \
 	test-bus-kernel \
@@ -2157,6 +2158,15 @@ test_bus_chat_LDADD = \
 	libsystemd-daemon-internal.la \
 	libsystemd-shared.la
 
+test_bus_cleanup_SOURCES = \
+	src/libsystemd/test-bus-cleanup.c
+
+test_bus_cleanup_LDADD = \
+	libsystemd-internal.la \
+	libsystemd-id128-internal.la \
+	libsystemd-daemon-internal.la \
+	libsystemd-shared.la
+
 test_bus_server_SOURCES = \
 	src/libsystemd/test-bus-server.c
 
diff --git a/src/libsystemd/sd-bus.c b/src/libsystemd/sd-bus.c
index 6bd1eaa81..b76221ef9 100644
--- a/src/libsystemd/sd-bus.c
+++ b/src/libsystemd/sd-bus.c
@@ -1259,12 +1259,25 @@ _public_ sd_bus *sd_bus_ref(sd_bus *bus) {
 }
 
 _public_ sd_bus *sd_bus_unref(sd_bus *bus) {
+        unsigned i;
 
         if (!bus)
                 return NULL;
 
-        if (REFCNT_DEC(bus->n_ref) <= 0)
-                bus_free(bus);
+        i = REFCNT_DEC(bus->n_ref);
+        if (i != bus->rqueue_size + bus->wqueue_size)
+                return NULL;
+
+        for (i = 0; i < bus->rqueue_size; i++)
+                if (bus->rqueue[i]->n_ref > 1)
+                        return NULL;
+
+        for (i = 0; i < bus->wqueue_size; i++)
+                if (bus->wqueue[i]->n_ref > 1)
+                        return NULL;
+
+        /* we are the only holders on the messages */
+        bus_free(bus);
 
         return NULL;
 }