Re: [Boost-bugs] [Boost C++ Libraries] #10956: null point exception using asio based on linux

Subject: Re: [Boost-bugs] [Boost C++ Libraries] #10956: null point exception using asio based on linux
From: Boost C++ Libraries (noreply_at_[hidden])
Date: 2015-06-24 14:42:11

#10956: null point exception using asio based on linux
--------------------------------------+----------------------------
  Reporter:  xuzhiteng <419855192@…>  |      Owner:  chris_kohlhoff
      Type:  Bugs                     |     Status:  new
 Milestone:  To Be Determined         |  Component:  asio
   Version:  Boost 1.56.0             |   Severity:  Problem
Resolution:                           |   Keywords:
--------------------------------------+----------------------------

Comment (by mike.sampson@…):

 I just ran into this same issue today.  From what I can tell, there is a
 race condition between
 epoll_reactor::deregister_descriptor/epoll_reactor::deregister_internal_descriptor
 and the epoll_reactor::start_op and epoll_reactor::cancel_ops routines.

 Both start_op and cancel_op check the descriptor_data for NULL before
 proceeding; however, this logic is not enough.  If the descriptor_data is
 not NULL when the check is made and the code blocks while trying to
 acquire the descriptor_data->mutex, there is no guarantee the object is
 valid after acquiring the lock.  Both deregister_xxx routines release the
 lock just before deleting and Null-ing out the descriptor_data.

 A segmentation fault occurs when trying to dereference descriptor_data.
 For example, when checking descriptor_data->shutdown in start_ops.

-- 
Ticket URL: <https://svn.boost.org/trac/boost/ticket/10956#comment:2>
Boost C++ Libraries <http://www.boost.org/>
Boost provides free peer-reviewed portable C++ source libraries.