Race condition in LifetimeManager could result in access to freed memory
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
Juniper Openstack | Status tracked in Trunk | |||||
R2.20 |
Fix Committed
|
Medium
|
Nischal Sheth | |||
Trunk |
Fix Committed
|
Medium
|
Nischal Sheth |
Bug Description
Access to freed memory can happen in the following scenario:
- LifetimeActor:
- LifetimeActor:
yet enqueued the actor to the LifetimeManager
- LifetimeActor:
- If the dependent being removed is the last one, refcount_ is incremented
to 1 and the actor is added to LifetimeManager queue
- LifetimeManager
actor in question, which returns true because the deleted_ flag is set and
the refcount_ just became 0
- LifetimeManager
- LifetimeActor:
the destroyed actor
Note that this problem will not happen if LifetimeActor:
from any Task, since all Tasks are mutually exclusive with bgp::Config and
LifetimeManager
Since LifetimeActor:
node shutdown and in unit tests, this problem shouldn't impact normal
operation of control node.
description: | updated |
description: | updated |
Review in progress for https:/ /review. opencontrail. org/10015
Submitter: Nischal Sheth (<email address hidden>)