diff options
| author | Volker Lendecke <vl@samba.org> | 2017-05-24 16:22:34 +0200 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2017-06-09 00:45:26 +0200 |
| commit | 1828011317b0a8142c3b66fff22661a962760574 (patch) | |
| tree | 204367d267930edbcd5cb2cb73366e55e4e89a60 | |
| parent | 00390ae27b6bd207add571d7975c37951e15a3e5 (diff) | |
| download | samba-1828011317b0a8142c3b66fff22661a962760574.tar.gz | |
tevent: Fix a race condition in tevent context rundown
We protect setting tctx->event_ctx=NULL with tctx->event_ctx_mutex.
But in _tevent_threaded_schedule_immediate we have the classic
TOCTOU race: After we checked "ev==NULL", looking at
tevent_common_context_destructor the event context can go after
_tevent_threaded_schedule_immediate checked. We need to serialize
things a bit by keeping tctx->event_ctx_mutex locked while we
reference "ev", in particular in the
DLIST_ADD_END(ev->scheduled_immediates,im);
I think the locking hierarchy is still maintained, tevent_atfork_prepare()
first locks all the tctx locks, and then the scheduled_mutex. Also,
I don't think this will impact parallelism too badly: event_ctx_mutex
is only used to protect setting tctx->ev.
Found by staring at code while fixing the FreeBSD memleak due to
not destroying scheduled_mutex.
Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Fri Jun 9 00:45:26 CEST 2017 on sn-devel-144
| -rw-r--r-- | lib/tevent/tevent_threads.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/lib/tevent/tevent_threads.c b/lib/tevent/tevent_threads.c index 8197323af02..8ecda027c33 100644 --- a/lib/tevent/tevent_threads.c +++ b/lib/tevent/tevent_threads.c @@ -443,15 +443,14 @@ void _tevent_threaded_schedule_immediate(struct tevent_threaded_context *tctx, ev = tctx->event_ctx; - ret = pthread_mutex_unlock(&tctx->event_ctx_mutex); - if (ret != 0) { - abort(); - } - if (ev == NULL) { /* * Our event context is already gone. */ + ret = pthread_mutex_unlock(&tctx->event_ctx_mutex); + if (ret != 0) { + abort(); + } return; } @@ -479,6 +478,11 @@ void _tevent_threaded_schedule_immediate(struct tevent_threaded_context *tctx, abort(); } + ret = pthread_mutex_unlock(&tctx->event_ctx_mutex); + if (ret != 0) { + abort(); + } + /* * We might want to wake up the main thread under the lock. We * had a slightly similar situation in pthreadpool, changed |