aboutsummaryrefslogtreecommitdiffhomepage
path: root/src
diff options
context:
space:
mode:
authorGravatar David Garcia Quintas <dgq@google.com>2017-07-13 20:56:13 -0700
committerGravatar David Garcia Quintas <dgq@google.com>2017-07-13 22:02:09 -0700
commitfc94d1f4a06c34cf637f48c9d1c6efab09e6a52b (patch)
tree0f7a666eab57b283d0847a6aee228e9ec4b648a9 /src
parente48bff9ba03bfa76eba5f1e63949f89a60f32a77 (diff)
Fix use-after-free in timer manager
Diffstat (limited to 'src')
-rw-r--r--src/core/lib/iomgr/timer_manager.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/src/core/lib/iomgr/timer_manager.c b/src/core/lib/iomgr/timer_manager.c
index b9bea9a2ab..631f7935d9 100644
--- a/src/core/lib/iomgr/timer_manager.c
+++ b/src/core/lib/iomgr/timer_manager.c
@@ -84,7 +84,14 @@ static void start_timer_thread_and_unlock(void) {
gpr_thd_options opt = gpr_thd_options_default();
gpr_thd_options_set_joinable(&opt);
completed_thread *ct = gpr_malloc(sizeof(*ct));
+ // The call to gpr_thd_new() has to be under the same lock used by
+ // gc_completed_threads(), particularly due to ct->t, which is written here
+ // (internally by gpr_thd_new) and read there. Otherwise it's possible for ct
+ // to leak through g_completed_threads and be freed in gc_completed_threads()
+ // before "&ct->t" is written to, causing a use-after-free.
+ gpr_mu_lock(&g_mu);
gpr_thd_new(&ct->t, timer_thread, ct, &opt);
+ gpr_mu_unlock(&g_mu);
}
void grpc_timer_manager_tick() {