Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix stale operation instance for connection error paths #540

Merged
merged 3 commits into from
Jul 9, 2018

Conversation

dantraMSFT
Copy link
Contributor

@dantraMSFT dantraMSFT commented Jul 7, 2018

Fix #502

This change adds a reference count to the InteractionProtcolHandler_Operation structure to address the race condition between InteractionProtocolHandler_Operation_Strand_Finish and InteractionProtocolHandler_Session_CommonInstanceCode.

For connection errors, the operation instance was being freed before returning to InteractionProtocolHandler_Session_Connect. This resulted in Session_Connect referencing a stale instance pointer and, later, a double free to occur on the operation instance.

The fix is as follows:
1: Set the reference count to 2 when the operation created

  • 1 refcount ensures the lifetime is valid until control is returned to InteractionProtocolHandler_Session_CommonInstanceCode
  • 1 refcount is for Strand_Finish to use when releasing the operation.

2: Remove the PAL_Free(operation) call from the error path in InteractionProtocolHandler_Operation_Close. This was causing a double free in error paths.

For error paths, the final release occurs in CommonInstanceCode since Finish has already been called.
For success paths, the final release typically occurs in Finish sometime after CommonInstanceCode has released it's reference.

@dantraMSFT dantraMSFT requested review from palladia and paulcallen July 7, 2018 01:59
@palladia palladia merged commit 4a22d84 into master Jul 9, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

segfault in InteractionProtocolHandler_Session_Connect in debug builds on failed connections.
3 participants