diff options
| author | Taylor Yu <catalyst@torproject.org> | 2018-03-29 17:18:04 -0500 |
|---|---|---|
| committer | Taylor Yu <catalyst@torproject.org> | 2018-03-29 17:21:33 -0500 |
| commit | 596eed3715bac9fcf1041d73328e4fe07e58837c (patch) | |
| tree | d76aa2cf6faed8ad26e377ca63fdfad1605422f0 | |
| parent | e8c1d4c8b05247e3e3cfec20ca11bafa5369bf41 (diff) | |
| download | tor-596eed3715bac9fcf1041d73328e4fe07e58837c.tar.gz tor-596eed3715bac9fcf1041d73328e4fe07e58837c.zip | |
Fix CID 1433643
Add a missing lock acquisition around access to queued_control_events
in control_free_all(). Use the reassign-and-unlock strategy as in
queued_events_flush_all(). Fixes bug 25675. Coverity found this bug,
but only after we recently added an access to
flush_queued_event_pending.
| -rw-r--r-- | changes/bug25675 | 4 | ||||
| -rw-r--r-- | src/or/control.c | 18 |
2 files changed, 17 insertions, 5 deletions
diff --git a/changes/bug25675 b/changes/bug25675 new file mode 100644 index 0000000000..d0f0287b59 --- /dev/null +++ b/changes/bug25675 @@ -0,0 +1,4 @@ + o Minor bugfixes (C correctness): + - Add a missing lock acquisition in the shutdown code of the + control subsystem. Fixes bug 25675; bugfix on 0.2.7.3-rc. Found + by Coverity; this is CID 1433643. diff --git a/src/or/control.c b/src/or/control.c index 2c8ac96f77..5cac0e1722 100644 --- a/src/or/control.c +++ b/src/or/control.c @@ -7586,17 +7586,26 @@ control_event_hs_descriptor_upload_failed(const char *id_digest, void control_free_all(void) { + smartlist_t *queued_events = NULL; + if (authentication_cookie) /* Free the auth cookie */ tor_free(authentication_cookie); if (detached_onion_services) { /* Free the detached onion services */ SMARTLIST_FOREACH(detached_onion_services, char *, cp, tor_free(cp)); smartlist_free(detached_onion_services); } - if (queued_control_events) { - SMARTLIST_FOREACH(queued_control_events, queued_event_t *, ev, - queued_event_free(ev)); - smartlist_free(queued_control_events); + + if (queued_control_events_lock) { + tor_mutex_acquire(queued_control_events_lock); + flush_queued_event_pending = 0; + queued_events = queued_control_events; queued_control_events = NULL; + tor_mutex_release(queued_control_events_lock); + } + if (queued_events) { + SMARTLIST_FOREACH(queued_events, queued_event_t *, ev, + queued_event_free(ev)); + smartlist_free(queued_events); } if (flush_queued_events_event) { tor_event_free(flush_queued_events_event); @@ -7609,7 +7618,6 @@ control_free_all(void) global_event_mask = 0; disable_log_messages = 0; memset(last_sent_bootstrap_message, 0, sizeof(last_sent_bootstrap_message)); - flush_queued_event_pending = 0; } #ifdef TOR_UNIT_TESTS |