Skip to content

Fix stale operation instance for connection error paths#540

Merged
palladia merged 3 commits intomasterfrom
dantra/issue502
Jul 9, 2018
Merged

Fix stale operation instance for connection error paths#540
palladia merged 3 commits intomasterfrom
dantra/issue502

Conversation

@dantraMSFT
Copy link
Copy Markdown
Contributor

@dantraMSFT dantraMSFT commented Jul 7, 2018

Fix #502

This change adds a reference count to the InteractionProtcolHandler_Operation structure to address the race condition between InteractionProtocolHandler_Operation_Strand_Finish and InteractionProtocolHandler_Session_CommonInstanceCode.

For connection errors, the operation instance was being freed before returning to InteractionProtocolHandler_Session_Connect. This resulted in Session_Connect referencing a stale instance pointer and, later, a double free to occur on the operation instance.

The fix is as follows:
1: Set the reference count to 2 when the operation created

  • 1 refcount ensures the lifetime is valid until control is returned to InteractionProtocolHandler_Session_CommonInstanceCode
  • 1 refcount is for Strand_Finish to use when releasing the operation.

2: Remove the PAL_Free(operation) call from the error path in InteractionProtocolHandler_Operation_Close. This was causing a double free in error paths.

For error paths, the final release occurs in CommonInstanceCode since Finish has already been called.
For success paths, the final release typically occurs in Finish sometime after CommonInstanceCode has released it's reference.

@dantraMSFT dantraMSFT requested review from palladia and paulcallen July 7, 2018 01:59
@palladia palladia merged commit 4a22d84 into master Jul 9, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

segfault in InteractionProtocolHandler_Session_Connect in debug builds on failed connections.

3 participants