diff options
author | 2017-07-13 20:56:13 -0700 | |
---|---|---|
committer | 2017-07-13 22:02:09 -0700 | |
commit | fc94d1f4a06c34cf637f48c9d1c6efab09e6a52b (patch) | |
tree | 0f7a666eab57b283d0847a6aee228e9ec4b648a9 /src | |
parent | e48bff9ba03bfa76eba5f1e63949f89a60f32a77 (diff) |
Fix use-after-free in timer manager
Diffstat (limited to 'src')
-rw-r--r-- | src/core/lib/iomgr/timer_manager.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/core/lib/iomgr/timer_manager.c b/src/core/lib/iomgr/timer_manager.c index b9bea9a2ab..631f7935d9 100644 --- a/src/core/lib/iomgr/timer_manager.c +++ b/src/core/lib/iomgr/timer_manager.c @@ -84,7 +84,14 @@ static void start_timer_thread_and_unlock(void) { gpr_thd_options opt = gpr_thd_options_default(); gpr_thd_options_set_joinable(&opt); completed_thread *ct = gpr_malloc(sizeof(*ct)); + // The call to gpr_thd_new() has to be under the same lock used by + // gc_completed_threads(), particularly due to ct->t, which is written here + // (internally by gpr_thd_new) and read there. Otherwise it's possible for ct + // to leak through g_completed_threads and be freed in gc_completed_threads() + // before "&ct->t" is written to, causing a use-after-free. + gpr_mu_lock(&g_mu); gpr_thd_new(&ct->t, timer_thread, ct, &opt); + gpr_mu_unlock(&g_mu); } void grpc_timer_manager_tick() { |