lib: fix thread_cancel_event()

ospfd was crashing some times on neighbour going down. The cause was that
ospf_nsm_event() was accessing already freed memory in ospf_nbr_delete()
call from ospf_nsm_event().

  What happens is that since commit b5043aab (lib: fix incorrect thread
list...) now a thread can be on the event and ready lists but
thread_cancel_event() doesn't account for that.

* thread.c: (thread_cancel_event) loop on the ready list too to cancel
  pending events.

Signed-off-by: Jorge Boncompte [DTI2] <jorge@dti2.net>
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>

lib/thread.c

@@ -916,6 +916,24 @@ thread_cancel_event (struct thread_master *m, void *arg)
           thread_add_unuse (m, t);
         }
     }
+
+  /* thread can be on the ready list too */
+  thread = m->ready.head;
+  while (thread)
+    {
+      struct thread *t;
+
+      t = thread;
+      thread = t->next;
+
+      if (t->arg == arg)
+        {
+          ret++;
+          thread_list_delete (&m->ready, t);
+          t->type = THREAD_UNUSED;
+          thread_add_unuse (m, t);
+        }
+    }
   return ret;
 }