|
 |
3264a5 |
From 75f163dbcbd46922934e24cac6d4b7101e06321d Mon Sep 17 00:00:00 2001
|
|
|
3264a5 |
From: Volker Lendecke <vl@samba.org>
|
|
|
3264a5 |
Date: Fri, 10 Nov 2017 21:22:26 +0100
|
|
|
3264a5 |
Subject: [PATCH] tevent: Fix a race condition
|
|
|
3264a5 |
|
|
|
3264a5 |
We can't rely on tctx to exist after we unlocked the mutex. It took a
|
|
|
3264a5 |
while, but this does lead to data corruption. If *tctx is replaced with
|
|
|
3264a5 |
something where tctx->wakeup_fd points to a real, existing file
|
|
|
3264a5 |
descriptor, we're screwed. And by screwed, this means file corruption
|
|
|
3264a5 |
on disk.
|
|
|
3264a5 |
|
|
|
3264a5 |
Again. I am not tall enough for this business.
|
|
|
3264a5 |
|
|
|
3264a5 |
http://bholley.net/blog/2015/must-be-this-tall-to-write-multi-threaded-code.html
|
|
|
3264a5 |
|
|
|
3264a5 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13130
|
|
|
3264a5 |
|
|
|
3264a5 |
Signed-off-by: Volker Lendecke <vl@samba.org>
|
|
|
3264a5 |
Reviewed-by: Jeremy Allison <jra@samba.org>
|
|
|
3264a5 |
---
|
|
|
3264a5 |
lib/tevent/tevent_threads.c | 6 ++++--
|
|
|
3264a5 |
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
|
3264a5 |
|
|
|
3264a5 |
diff --git a/lib/tevent/tevent_threads.c b/lib/tevent/tevent_threads.c
|
|
|
3264a5 |
index 4d1a8805181..2e83f1b66c2 100644
|
|
|
3264a5 |
--- a/lib/tevent/tevent_threads.c
|
|
|
3264a5 |
+++ b/lib/tevent/tevent_threads.c
|
|
|
3264a5 |
@@ -451,7 +451,7 @@ void _tevent_threaded_schedule_immediate(struct tevent_threaded_context *tctx,
|
|
|
3264a5 |
{
|
|
|
3264a5 |
#ifdef HAVE_PTHREAD
|
|
|
3264a5 |
struct tevent_context *ev;
|
|
|
3264a5 |
- int ret;
|
|
|
3264a5 |
+ int ret, wakeup_fd;
|
|
|
3264a5 |
|
|
|
3264a5 |
ret = pthread_mutex_lock(&tctx->event_ctx_mutex);
|
|
|
3264a5 |
if (ret != 0) {
|
|
|
3264a5 |
@@ -495,6 +495,8 @@ void _tevent_threaded_schedule_immediate(struct tevent_threaded_context *tctx,
|
|
|
3264a5 |
abort();
|
|
|
3264a5 |
}
|
|
|
3264a5 |
|
|
|
3264a5 |
+ wakeup_fd = tctx->wakeup_fd;
|
|
|
3264a5 |
+
|
|
|
3264a5 |
ret = pthread_mutex_unlock(&tctx->event_ctx_mutex);
|
|
|
3264a5 |
if (ret != 0) {
|
|
|
3264a5 |
abort();
|
|
|
3264a5 |
@@ -510,7 +512,7 @@ void _tevent_threaded_schedule_immediate(struct tevent_threaded_context *tctx,
|
|
|
3264a5 |
* than a noncontended one. So I'd opt for the lower footprint
|
|
|
3264a5 |
* initially. Maybe we have to change that later.
|
|
|
3264a5 |
*/
|
|
|
3264a5 |
- tevent_common_wakeup_fd(tctx->wakeup_fd);
|
|
|
3264a5 |
+ tevent_common_wakeup_fd(wakeup_fd);
|
|
|
3264a5 |
#else
|
|
|
3264a5 |
/*
|
|
|
3264a5 |
* tevent_threaded_context_create() returned NULL with ENOSYS...
|
|
|
3264a5 |
--
|
|
|
3264a5 |
2.15.0.448.gf294e3d99a-goog
|
|
|
3264a5 |
|