From 159dc8877c01ab3406f95b0e9b707db85c6d0546 Mon Sep 17 00:00:00 2001
From: Jonathan Hui <jonhui@google.com>
Date: Fri, 3 Apr 2020 13:35:48 -0700
Subject: [PATCH] [mesh-forwarder] fix bug in evicting from address resolver
 queue (#4786)

The existing MeshForwarder::RemoveMessage() implementation is specific
to evicting messages from mSendQueue. This commit generalizes the
method by retrieving the queue from the message itself.
---
 src/core/common/message.hpp        | 22 +++++++++++-----------
 src/core/thread/mesh_forwarder.cpp | 23 +++++++++++++++--------
 2 files changed, 26 insertions(+), 19 deletions(-)

diff --git a/src/core/common/message.hpp b/src/core/common/message.hpp
index 5780e3277..7b8b7372f 100644
--- a/src/core/common/message.hpp
+++ b/src/core/common/message.hpp
@@ -723,6 +723,17 @@ public:
         return (!mBuffer.mHead.mInfo.mInPriorityQ) ? mBuffer.mHead.mInfo.mQueue.mMessage : NULL;
     }
 
+    /**
+     * This method returns a pointer to the priority message queue (if any) where this message is queued.
+     *
+     * @returns A pointer to the priority queue or NULL if not in any priority queue.
+     *
+     */
+    PriorityQueue *GetPriorityQueue(void) const
+    {
+        return (mBuffer.mHead.mInfo.mInPriorityQ) ? mBuffer.mHead.mInfo.mQueue.mPriority : NULL;
+    }
+
 #if OPENTHREAD_CONFIG_TIME_SYNC_ENABLE
     /**
      * This method indicates whether or not the message is also used for time sync purpose.
@@ -810,17 +821,6 @@ private:
      */
     void SetMessageQueue(MessageQueue *aMessageQueue);
 
-    /**
-     * This method returns a pointer to the priority message queue (if any) where this message is queued.
-     *
-     * @returns A pointer to the priority queue or NULL if not in any priority queue.
-     *
-     */
-    PriorityQueue *GetPriorityQueue(void) const
-    {
-        return (mBuffer.mHead.mInfo.mInPriorityQ) ? mBuffer.mHead.mInfo.mQueue.mPriority : NULL;
-    }
-
     /**
      * This method sets the message queue information for the message.
      *
diff --git a/src/core/thread/mesh_forwarder.cpp b/src/core/thread/mesh_forwarder.cpp
index 188840ec5..fd5a39641 100644
--- a/src/core/thread/mesh_forwarder.cpp
+++ b/src/core/thread/mesh_forwarder.cpp
@@ -139,19 +139,26 @@ exit:
 
 void MeshForwarder::RemoveMessage(Message &aMessage)
 {
-#if OPENTHREAD_FTD
-    for (ChildTable::Iterator iter(GetInstance(), Child::kInStateAnyExceptInvalid); !iter.IsDone(); iter++)
+    PriorityQueue *queue = aMessage.GetPriorityQueue();
+
+    OT_ASSERT(queue != NULL);
+
+    if (queue == &mSendQueue)
     {
-        IgnoreReturnValue(mIndirectSender.RemoveMessageFromSleepyChild(aMessage, *iter.GetChild()));
-    }
+#if OPENTHREAD_FTD
+        for (ChildTable::Iterator iter(GetInstance(), Child::kInStateAnyExceptInvalid); !iter.IsDone(); iter++)
+        {
+            IgnoreReturnValue(mIndirectSender.RemoveMessageFromSleepyChild(aMessage, *iter.GetChild()));
+        }
 #endif
 
-    if (mSendMessage == &aMessage)
-    {
-        mSendMessage = NULL;
+        if (mSendMessage == &aMessage)
+        {
+            mSendMessage = NULL;
+        }
     }
 
-    mSendQueue.Dequeue(aMessage);
+    queue->Dequeue(aMessage);
     LogMessage(kMessageEvict, aMessage, NULL, OT_ERROR_NO_BUFS);
     aMessage.Free();
 }