Another race in db_close_events()
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
EPICS Base |
Fix Released
|
Undecided
|
mdavidsaver |
Bug Description
Mark Rivers reports a valgrind alert in db_close_events().
https:/
This looks like a race leading to a real use-after-free which is
being "covered up" by the free list.
>>> ==146728== Thread 25 CAS-client:
>>> ==146728== Invalid read of size 8
>>> ==146728== at 0xE37113: db_close_events (dbEvent.c:378)
In dbEvent.c db_close_events()
> /* notify the waiting task */
> epicsEventSigna
>
> if(evUser->taskid) // <- line 378
> epicsThreadMust
> /* evUser has been deleted by the worker */
Since event_task() is deleting evUser, it looks like everything from the epicsEventSignal()
onwards is a race. event_task() also deletes ppendsem, which could happen before
epicsEventSignal() returns. So I don't think it would be enough to save 'evUser->taskid'
before signaling.
I'm developing a long history with this particular issue. This being the second time I've introduced a similar regression (cf. lp:1730982). This time with 37a76b433a9e7d5
Changed in epics-base: | |
status: | New → Fix Released |
cf. https:/ /github. com/epics- base/epics- base/pull/ 151