[Boost-bugs] [Boost C++ Libraries] #7611: segfault in epoll_reactor.ipp

Subject: [Boost-bugs] [Boost C++ Libraries] #7611: segfault in epoll_reactor.ipp
From: Boost C++ Libraries (noreply_at_[hidden])
Date: 2012-10-30 18:15:28

#7611: segfault in epoll_reactor.ipp
------------------------------------------------------------+---------------
 Reporter:  Fredrik Jansson <fredrik.jansson.se@…>          |       Owner:  chris_kohlhoff
     Type:  Bugs                                            |      Status:  new           
Milestone:  To Be Determined                                |   Component:  asio          
  Version:  Boost 1.52.0                                    |    Severity:  Problem       
 Keywords:                                                  |  
------------------------------------------------------------+---------------
 During testing of versions 1.46.1 and 1.51 on a 64-bit Ubuntu 12.04 I have
 found a seg fault condition in epoll_reactor.ipp.

 The function is

 void epoll_reactor::deregister_descriptor(socket_type descriptor,
     epoll_reactor::per_descriptor_data& descriptor_data, bool closing)
 {
   if (!descriptor_data)
     return;

   mutex::scoped_lock descriptor_lock(descriptor_data->mutex_);

   if (!descriptor_data->shutdown_)
   {

 The member descriptor_data is checked for NULL before the mutex is locked,
 in rare conditions, when the if-statement is reached, descriptor_data is
 NULL.

 I have solved this by adding a second check after the mutex is locked,
 i.e.

   if (!descriptor_data)
     return;

   mutex::scoped_lock descriptor_lock(descriptor_data->mutex_);

   if (!descriptor_data)
     return;

   if (!descriptor_data->shutdown_)
   {

 Best regards,
 Fredrik Jansson

-- 
Ticket URL: <https://svn.boost.org/trac/boost/ticket/7611>
Boost C++ Libraries <http://www.boost.org/>
Boost provides free peer-reviewed portable C++ source libraries.