lightningd: fix shutdown with unconfirmed channel.

We free the peers explicitly, but we don't free the unconfirmed channel:
the result is that it gets freed twice.

The workaround is to free the unconfirmed channel explicitly, but really
the peer should be tal_link'ed as it's basically a reference counted
structure.

1.974911451 lightningd(17906):INFO: 03b4bca72572889d4b44cd0f194f73d54972af367e1917579283122ee10fa05f54 chan #1: Owning subdaemon lightning_openingd died (62464)
1.980118094 lightningd(17906):BROKEN: FATAL SIGNAL 6
1.980150447 lightningd(17906):BROKEN: backtrace: common/daemon.c:42 (crashdump) 0x432ba0
1.980161268 lightningd(17906):BROKEN: backtrace: (null):0 ((null)) 0x7faeb18ff4af
1.980167045 lightningd(17906):BROKEN: backtrace: (null):0 ((null)) 0x7faeb18ff428
1.980171271 lightningd(17906):BROKEN: backtrace: (null):0 ((null)) 0x7faeb1901029
1.980175847 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:98 (call_error) 0x47543e
1.980181814 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:170 (check_bounds) 0x4755fb
1.980188065 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:180 (to_tal_hdr) 0x475649
1.980193756 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:504 (tal_free) 0x47600d
1.980199402 lightningd(17906):BROKEN: backtrace: lightningd/peer_control.c:118 (delete_peer) 0x423990
1.980205498 lightningd(17906):BROKEN: backtrace: lightningd/opening_control.c:574 (destroy_uncommitted_channel) 0x419df3
1.980212380 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:240 (notify) 0x4757b0
1.980218052 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:400 (del_tree) 0x475c61
1.980223398 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:511 (tal_free) 0x476093
1.980229174 lightningd(17906):BROKEN: backtrace: lightningd/opening_control.c:549 (opening_channel_errmsg) 0x419d1a
1.980236227 lightningd(17906):BROKEN: backtrace: lightningd/subd.c:590 (destroy_subd) 0x42cf43
1.980242348 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:240 (notify) 0x4757b0
1.980247771 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:400 (del_tree) 0x475c61
1.980252814 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:410 (del_tree) 0x475cb1
1.980258356 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:410 (del_tree) 0x475cb1
1.980263311 lightningd(17906):BROKEN: backtrace: ccan/ccan/tal/tal.c:511 (tal_free) 0x476093
1.980269189 lightningd(17906):BROKEN: backtrace: lightningd/lightningd.c:412 (main) 0x4144ed

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lightningd/lightningd.c

@@ -209,6 +209,10 @@ static void shutdown_subdaemons(struct lightningd *ld)
 			tal_free(c);
 		}
 
+		/* Freeing uncommitted channel will free peer. */
+		if (p->uncommitted_channel)
+			tal_free(p->uncommitted_channel);
+		else
 			/* Removes itself from list as we free it */
 			tal_free(p);
 	}