Fix: Use after free in rcu_barrier()
authorKeir Fraser <keir@cohodata.com>
Sat, 19 Apr 2014 19:59:01 +0000 (15:59 -0400)
committerMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Sun, 20 Apr 2014 13:07:41 +0000 (09:07 -0400)
commit81dd9134333f1c00117cf5addd2f193b89998201
tree74e9aa2513a6a6b1a0cf410520bb67e565f070e8
parentfbc55dd1caeba6fdce2b781537b785eaf58279ed
Fix: Use after free in rcu_barrier()

Do not free the rcu_barrier() completion struct until all threads are
done with it.

It cannot reside on the waiter's stack as rcu_barrier() may return
before the call_rcu handlers have finished checking whether it needs a
futex wakeup. Instead we dynamically allocate the structure and
determine its lifetime with a reference count.

Signed-off-by: Keir Fraser <keir@cohodata.com>
[ Edit by Mathieu Desnoyers: use urcu/ref.h. Cleanup: use
  uatomic_sub_return() rather than uatomic_add_return() with negative
  value. ]
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
urcu-call-rcu-impl.h
This page took 0.033956 seconds and 4 git commands to generate.