From 36b201879a2aa24c84b3a7fb3af6c57cbf5c6c71 Mon Sep 17 00:00:00 2001 From: fengzero Date: Fri, 22 Sep 2023 02:28:13 +0000 Subject: [PATCH] fix(timer): use after free --- src/event/event_linux.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/src/event/event_linux.c b/src/event/event_linux.c index c9429f70..8d5294f5 100644 --- a/src/event/event_linux.c +++ b/src/event/event_linux.c @@ -106,25 +106,24 @@ static void *event_loop(void *arg) if ((event.events & EPOLLIN) == EPOLLIN) { uint64_t t; + nng_mtx_lock(data->ctx.timer->mtx); ssize_t size = read(data->fd, &t, sizeof(t)); (void) size; if (!data->ctx.timer->stop) { if (data->ctx.timer->type == NEU_EVENT_TIMER_BLOCK) { - nng_mtx_lock(data->ctx.timer->mtx); epoll_ctl(epoll_fd, EPOLL_CTL_DEL, data->fd, NULL); ret = data->callback.timer(data->usr_data); timerfd_settime(data->fd, 0, &data->ctx.timer->value, NULL); epoll_ctl(epoll_fd, EPOLL_CTL_ADD, data->fd, &event); - nng_mtx_unlock(data->ctx.timer->mtx); } else { - nng_mtx_lock(data->ctx.timer->mtx); ret = data->callback.timer(data->usr_data); - nng_mtx_unlock(data->ctx.timer->mtx); } } + nng_mtx_unlock(data->ctx.timer->mtx); } + break; case IO: if ((event.events & EPOLLHUP) == EPOLLHUP) { @@ -221,6 +220,7 @@ int neu_event_del_timer(neu_events_t *events, neu_event_timer_t *timer) events->epoll_fd); timer->stop = true; + nng_mtx_lock(timer->mtx); close(timer->fd); epoll_ctl(events->epoll_fd, EPOLL_CTL_DEL, timer->fd, NULL); @@ -229,6 +229,7 @@ int neu_event_del_timer(neu_events_t *events, neu_event_timer_t *timer) nng_mtx_free(timer->mtx); free(timer); + return 0; }