April 2022 - gerrit-log - lists.osmocom.org

Change in osmo-uecups[master]: Fix use-after-free by tun thread after tun obj destroyed

by pespin

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-uecups/+/27739 ) Change subject: Fix use-after-free by tun thread after tun obj destroyed ...................................................................... Fix use-after-free by tun thread after tun obj destroyed The main thread calls pthread_cancel before freeing the tun object. However, pthread_cancel doesn't kill the thread synchronously (man pthread_cancel). Hence, the tun thread may still be running for a while after the tun object is/has been(ing) freed. Let's avoid this by making sure the thread is stopped before freeing the object. To accomplish it, we must wait for the thread to be cancelled. A cleanup routie is added which will signal the "tun_released" message to the main thread through an osmo_itq, which will then free the object (since talloc context is managed by the main thread). Related: SYS#5523 Change-Id: Idf005359afb41d3413b09281a9ff937d5eafcc7c --- M daemon/daemon_vty.c M daemon/internal.h M daemon/main.c M daemon/tun_device.c 4 files changed, 84 insertions(+), 15 deletions(-) Approvals: daniel: Looks good to me, but someone else must approve osmith: Looks good to me, but someone else must approve pespin: Looks good to me, approved Jenkins Builder: Verified diff --git a/daemon/daemon_vty.c b/daemon/daemon_vty.c index 3c44ed1..cfbe421 100644 --- a/daemon/daemon_vty.c +++ b/daemon/daemon_vty.c @@ -99,7 +99,7 @@ vty_out(vty, "Cannot destrory non-existant TUN%s", VTY_NEWLINE); return CMD_WARNING; } - _tun_device_deref_destroy(tun); + _tun_device_deref_release(tun); pthread_rwlock_unlock(&g_daemon->rwlock); return CMD_SUCCESS; diff --git a/daemon/internal.h b/daemon/internal.h index 09ba52e..fc5708d 100644 --- a/daemon/internal.h +++ b/daemon/internal.h @@ -7,6 +7,7 @@ #include <sys/socket.h> #include <osmocom/core/linuxlist.h> #include <osmocom/core/write_queue.h> +#include <osmocom/core/it_q.h> #include <osmocom/core/utils.h> struct nl_sock; @@ -84,6 +85,13 @@ /*********************************************************************** * TUN Device ***********************************************************************/ +/* Message sent tun thread -> main thread through osmo_itq */ +struct gtp_daemon_itq_msg { + struct llist_head list; + struct { + struct tun_device *tun; + } tun_released; /* tun became stopped and can be freed */ +}; struct tun_device { /* entry in global list */ @@ -110,6 +118,9 @@ /* the thread handling Rx from the tun fd */ pthread_t thread; + + /* Used to store messages to be sent to main thread, since tun thread doesn't allocate through talloc */ + struct gtp_daemon_itq_msg itq_msg; }; struct tun_device * @@ -121,9 +132,10 @@ struct tun_device * _tun_device_find(struct gtp_daemon *d, const char *devname); -void _tun_device_deref_destroy(struct tun_device *tun); +void _tun_device_destroy(struct tun_device *tun); bool _tun_device_release(struct tun_device *tun); +void _tun_device_deref_release(struct tun_device *tun); bool tun_device_release(struct tun_device *tun); @@ -222,6 +234,12 @@ struct osmo_stream_srv_link *cups_link; struct osmo_signalfd *signalfd; + /* inter-thread queue between main thread and workers, pass struct gtp_daemon_itq_msg: */ + struct osmo_it_q *itq; + + /* Number of tunnels in progrress of being released: */ + unsigned int reset_all_state_tun_remaining; + struct { char *cups_local_ip; uint16_t cups_local_port; diff --git a/daemon/main.c b/daemon/main.c index 76aeab5..014e28a 100644 --- a/daemon/main.c +++ b/daemon/main.c @@ -58,6 +58,7 @@ /* client socket */ struct osmo_stream_srv *srv; char sockname[OSMO_SOCK_NAME_MAXLEN]; + bool reset_all_state_res_pending; }; struct subprocess { @@ -493,8 +494,12 @@ subprocess_destroy(p, SIGKILL); } - jres = gen_uecups_result("reset_all_state_res", "OK"); - cups_client_tx_json(cc, jres); + if (d->reset_all_state_tun_remaining == 0) { + jres = gen_uecups_result("reset_all_state_res", "OK"); + cups_client_tx_json(cc, jres); + } else { + cc->reset_all_state_res_pending = true; + } return 0; } @@ -669,6 +674,31 @@ } } +static void gtp_daemon_itq_read_cb(struct osmo_it_q *q, struct llist_head *item) +{ + struct gtp_daemon *d = (struct gtp_daemon *)q->data; + struct gtp_daemon_itq_msg *itq_msg = container_of(item, struct gtp_daemon_itq_msg, list); + + LOGP(DTUN, LOGL_DEBUG, "Rx new itq message from %s\n", + itq_msg->tun_released.tun->devname); + + _tun_device_destroy(itq_msg->tun_released.tun); + if (d->reset_all_state_tun_remaining > 0) { + d->reset_all_state_tun_remaining--; + if (d->reset_all_state_tun_remaining == 0) { + struct cups_client *cc; + llist_for_each_entry(cc, &d->cups_clients, list) { + json_t *jres; + if (!cc->reset_all_state_res_pending) + continue; + cc->reset_all_state_res_pending = false; + jres = gen_uecups_result("reset_all_state_res", "OK"); + cups_client_tx_json(cc, jres); + } + } + } +} + static struct gtp_daemon *gtp_daemon_alloc(void *ctx) { struct gtp_daemon *d = talloc_zero(ctx, struct gtp_daemon); @@ -682,6 +712,9 @@ pthread_rwlock_init(&d->rwlock, NULL); d->main_thread = pthread_self(); + d->itq = osmo_it_q_alloc(d, "itq", 4096, gtp_daemon_itq_read_cb, d); + osmo_fd_register(&d->itq->event_ofd); + INIT_LLIST_HEAD(&d->cups_clients); d->cfg.cups_local_ip = talloc_strdup(d, "localhost"); diff --git a/daemon/tun_device.c b/daemon/tun_device.c index 7d1948f..5993856 100644 --- a/daemon/tun_device.c +++ b/daemon/tun_device.c @@ -120,6 +120,14 @@ return 0; } +static void tun_device_pthread_cleanup_routine(void *data) +{ + struct tun_device *tun = data; + LOGTUN(tun, LOGL_DEBUG, "pthread_cleanup\n"); + int rc = osmo_it_q_enqueue(tun->d->itq, &tun->itq_msg, list); + OSMO_ASSERT(rc == 0); +} + /* one thread for reading from each TUN device (TUN -> GTP encapsulation) */ static void *tun_device_thread(void *arg) { @@ -136,6 +144,8 @@ gtph->flags = 0x30; gtph->type = GTP_TPDU; + pthread_cleanup_push(tun_device_pthread_cleanup_routine, tun); + while (1) { struct gtp_tunnel *t; struct pkt_info pinfo; @@ -187,6 +197,7 @@ exit(1); } } + pthread_cleanup_pop(1); } static int tun_open(int flags, const char *name) @@ -376,24 +387,24 @@ return tun; } -/* UNLOCKED hard/forced destroy; caller must make sure references are cleaned up */ -static void _tun_device_destroy(struct tun_device *tun) +/* UNLOCKED hard/forced destroy; caller must make sure references are cleaned + * up, and tun thread is stopped beforehand by calling + * _tun_device_{deref_}release */ +void _tun_device_destroy(struct tun_device *tun) { /* talloc is not thread safe, all alloc/free must come from main thread */ ASSERT_MAIN_THREAD(tun->d); + LOGTUN(tun, LOGL_INFO, "Destroying\n"); - pthread_cancel(tun->thread); - llist_del(&tun->list); if (tun->netns_name) close(tun->netns_fd); close(tun->fd); nl_socket_free(tun->nl); - LOGTUN(tun, LOGL_INFO, "Destroying\n"); talloc_free(tun); } -/* UNLOCKED remove all objects referencing this tun and then destroy */ -void _tun_device_deref_destroy(struct tun_device *tun) +/* UNLOCKED remove all objects referencing this tun and then start async tun release procedure */ +void _tun_device_deref_release(struct tun_device *tun) { struct gtp_daemon *d = tun->d; char *devname = talloc_strdup(d, tun->devname); @@ -412,12 +423,12 @@ * check if the tun can still be found in the list */ tun2 = _tun_device_find(d, devname); if (tun2 && tun2 == tun) - _tun_device_destroy(tun2); + _tun_device_release(tun2); talloc_free(devname); } -/* UNLOCKED release a reference; destroy if refcount drops to 0 */ +/* UNLOCKED release a reference; start async tun release procedure if refcount drops to 0 */ bool _tun_device_release(struct tun_device *tun) { bool released = false; @@ -427,10 +438,17 @@ tun->use_count--; if (tun->use_count == 0) { - _tun_device_destroy(tun); + LOGTUN(tun, LOGL_INFO, "Releasing\n"); + llist_del(&tun->list); + tun->itq_msg.tun_released.tun = tun; + tun->d->reset_all_state_tun_remaining++; + /* We cancel the thread: the pthread_cleanup routing will send a message + * back to us (main thread) when finally cancelled. */ + pthread_cancel(tun->thread); released = true; - } else + } else { LOGTUN(tun, LOGL_DEBUG, "Release; new use_count=%lu\n", tun->use_count); + } return released; } -- To view, visit https://gerrit.osmocom.org/c/osmo-uecups/+/27739 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-uecups Gerrit-Branch: master Gerrit-Change-Id: Idf005359afb41d3413b09281a9ff937d5eafcc7c Gerrit-Change-Number: 27739 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

3 years, 2 months

1
0
0 0

Change in osmo-uecups[master]: Fix use-after-free by tun thread after tun obj destroyed

by pespin

Attention is currently required from: lynxis lazus. pespin has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-uecups/+/27739 ) Change subject: Fix use-after-free by tun thread after tun obj destroyed ...................................................................... Patch Set 3: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-uecups/+/27739 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-uecups Gerrit-Branch: master Gerrit-Change-Id: Idf005359afb41d3413b09281a9ff937d5eafcc7c Gerrit-Change-Number: 27739 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Tue, 12 Apr 2022 09:30:26 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

3 years, 2 months

1
0
0 0

Change in osmo-uecups[master]: Fix use-after-free by tun thread after tun obj destroyed

by osmith

Attention is currently required from: pespin, lynxis lazus. osmith has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-uecups/+/27739 ) Change subject: Fix use-after-free by tun thread after tun obj destroyed ...................................................................... Patch Set 3: Code-Review+1 (1 comment) File daemon/tun_device.c: https://gerrit.osmocom.org/c/osmo-uecups/+/27739/comment/77838668_648a07a4 PS3, Line 200: pthread_cleanup_pop(1); > Sorry we discussed this through jabber since it's a bit of a complex topic. […] Ack, makes sense now. -- To view, visit https://gerrit.osmocom.org/c/osmo-uecups/+/27739 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-uecups Gerrit-Branch: master Gerrit-Change-Id: Idf005359afb41d3413b09281a9ff937d5eafcc7c Gerrit-Change-Number: 27739 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Tue, 12 Apr 2022 09:30:05 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: osmith <osmith(a)sysmocom.de> Comment-In-Reply-To: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: comment

3 years, 2 months

1
0
0 0

Change in osmo-uecups[master]: main.c: Improve logging

by pespin

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-uecups/+/27738 ) Change subject: main.c: Improve logging ...................................................................... main.c: Improve logging Change-Id: I6d9a355fef78906cee1ddf65ebb00a738b43c596 --- M daemon/main.c 1 file changed, 4 insertions(+), 0 deletions(-) Approvals: Jenkins Builder: Verified fixeria: Looks good to me, approved diff --git a/daemon/main.c b/daemon/main.c index 328d074..76aeab5 100644 --- a/daemon/main.c +++ b/daemon/main.c @@ -72,6 +72,8 @@ /* kill the specified subprocess and forget about it */ static void subprocess_destroy(struct subprocess *p, int signal) { + LOGCC(p->cups_client, LOGL_DEBUG, "Kill subprocess pid %llu with signal %u\n", + (unsigned long long)p->pid, signal); kill(p->pid, signal); llist_del(&p->list); talloc_free(p); @@ -478,6 +480,7 @@ struct subprocess *p, *p2; json_t *jres; + LOGCC(cc, LOGL_DEBUG, "Destroying all tunnels\n"); pthread_rwlock_wrlock(&d->rwlock); llist_for_each_entry_safe(t, t2, &d->gtp_tunnels, list) { _gtp_tunnel_destroy(t); @@ -485,6 +488,7 @@ pthread_rwlock_unlock(&d->rwlock); /* no locking needed as this list is only used by main thread */ + LOGCC(cc, LOGL_DEBUG, "Destroying all subprocesses\n"); llist_for_each_entry_safe(p, p2, &d->subprocesses, list) { subprocess_destroy(p, SIGKILL); } -- To view, visit https://gerrit.osmocom.org/c/osmo-uecups/+/27738 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-uecups Gerrit-Branch: master Gerrit-Change-Id: I6d9a355fef78906cee1ddf65ebb00a738b43c596 Gerrit-Change-Number: 27738 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

3 years, 2 months

1
0
0 0

Change in osmo-uecups[master]: main: Remove duplicate call to child_terminated()

by pespin

pespin has submitted this change. ( https://gerrit.osmocom.org/c/osmo-uecups/+/27737 ) Change subject: main: Remove duplicate call to child_terminated() ...................................................................... main: Remove duplicate call to child_terminated() The same pid will be handled below tyhrough waitpid. This can be seen when running PGW_Tests: """ 20220411134309656 DUECUPS main.c:343 SIGCHLD receive from pid 24; status=0 20220411134309656 DUECUPS main.c:95 r=172.18.18.202:9999<->l=172.18.18.20:4268: JSON Tx '{"program_term_ind": {"exit_code": 0, "pid": 24}}' 20220411134309656 DUECUPS main.c:343 SIGCHLD receive from pid 24; status=0 """ Change-Id: I348b91097fe9bf78b2c7e33d4f3eaf316618068e --- M daemon/main.c 1 file changed, 0 insertions(+), 2 deletions(-) Approvals: Jenkins Builder: Verified fixeria: Looks good to me, but someone else must approve daniel: Looks good to me, approved diff --git a/daemon/main.c b/daemon/main.c index 39d60e6..328d074 100644 --- a/daemon/main.c +++ b/daemon/main.c @@ -367,8 +367,6 @@ OSMO_ASSERT(fdsi->ssi_signo == SIGCHLD); - child_terminated(d, fdsi->ssi_pid, fdsi->ssi_status); - /* it is known that classic signals coalesce: If you get multiple signals of the * same type before a process is scheduled, the subsequent signals are dropped. This * makes sense for SIGINT or something like this, but for SIGCHLD carrying the PID of -- To view, visit https://gerrit.osmocom.org/c/osmo-uecups/+/27737 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-uecups Gerrit-Branch: master Gerrit-Change-Id: I348b91097fe9bf78b2c7e33d4f3eaf316618068e Gerrit-Change-Number: 27737 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-MessageType: merged

3 years, 2 months

1
0
0 0

Change in docker-playground[master]: ttcn3-pgw: Pass config file to osmo-uecups

by pespin

pespin has posted comments on this change. ( https://gerrit.osmocom.org/c/docker-playground/+/27734 ) Change subject: ttcn3-pgw: Pass config file to osmo-uecups ...................................................................... Patch Set 1: (1 comment) File ttcn3-pgw-test/jenkins.sh: https://gerrit.osmocom.org/c/docker-playground/+/27734/comment/21d4571f_ef3… PS1, Line 74: -c /data/osmo-uecups-daemon.cfg > Have you checked that it actually works? The current osmo-uecups master does not parse command like […] Ah good to know,I changed the config file and I saw it applied, but I didn't think about the fact that it was taking it due to $WORKDIR. -- To view, visit https://gerrit.osmocom.org/c/docker-playground/+/27734 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: docker-playground Gerrit-Branch: master Gerrit-Change-Id: I714172ca063c76a3104daf06f52b5823f304dffe Gerrit-Change-Number: 27734 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Reviewer: pespin <pespin(a)sysmocom.de> Gerrit-CC: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Comment-Date: Tue, 12 Apr 2022 09:26:21 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-MessageType: comment

3 years, 2 months

1
0
0 0

Change in osmo-uecups[master]: main: Remove duplicate call to child_terminated()

by daniel

Attention is currently required from: laforge, pespin. daniel has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-uecups/+/27737 ) Change subject: main: Remove duplicate call to child_terminated() ...................................................................... Patch Set 1: Code-Review+2 -- To view, visit https://gerrit.osmocom.org/c/osmo-uecups/+/27737 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-uecups Gerrit-Branch: master Gerrit-Change-Id: I348b91097fe9bf78b2c7e33d4f3eaf316618068e Gerrit-Change-Number: 27737 Gerrit-PatchSet: 1 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: laforge <laforge(a)osmocom.org> Gerrit-Attention: laforge <laforge(a)osmocom.org> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Comment-Date: Tue, 12 Apr 2022 09:20:09 +0000 Gerrit-HasComments: No Gerrit-Has-Labels: Yes Gerrit-MessageType: comment

3 years, 2 months

1
0
0 0

Change in osmo-uecups[master]: Fix use-after-free by tun thread after tun obj destroyed

by pespin

Attention is currently required from: osmith, lynxis lazus. pespin has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-uecups/+/27739 ) Change subject: Fix use-after-free by tun thread after tun obj destroyed ...................................................................... Patch Set 3: (1 comment) File daemon/tun_device.c: https://gerrit.osmocom.org/c/osmo-uecups/+/27739/comment/cfa1f163_2d0db5d9 PS3, Line 200: pthread_cleanup_pop(1); > Daniel already asked, but it's not answered and I don't see it: how do you reach this, since there's […] Sorry we discussed this through jabber since it's a bit of a complex topic. In summary, check "man pthread_cleanup_push". push/pop can be implemented as a while loop, as specified by POSIX. And if you check /usr/include/pthread.h, it is actually implemented that way in linux. This adds further restrictions, like having to put both push/pop, and having to put them in the same function block. So in reality the function is not called, and we don't need it called, but it's needed to make the "do while" block. -- To view, visit https://gerrit.osmocom.org/c/osmo-uecups/+/27739 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-uecups Gerrit-Branch: master Gerrit-Change-Id: Idf005359afb41d3413b09281a9ff937d5eafcc7c Gerrit-Change-Number: 27739 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Tue, 12 Apr 2022 09:18:58 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Comment-In-Reply-To: osmith <osmith(a)sysmocom.de> Gerrit-MessageType: comment

3 years, 2 months

1
0
0 0

Change in osmo-uecups[master]: Fix use-after-free by tun thread after tun obj destroyed

by osmith

Attention is currently required from: pespin, lynxis lazus. osmith has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-uecups/+/27739 ) Change subject: Fix use-after-free by tun thread after tun obj destroyed ...................................................................... Patch Set 3: (1 comment) File daemon/tun_device.c: https://gerrit.osmocom.org/c/osmo-uecups/+/27739/comment/083b9452_9c6d4c7a PS3, Line 200: pthread_cleanup_pop(1); Daniel already asked, but it's not answered and I don't see it: how do you reach this, since there's no break in the while loop? -- To view, visit https://gerrit.osmocom.org/c/osmo-uecups/+/27739 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-uecups Gerrit-Branch: master Gerrit-Change-Id: Idf005359afb41d3413b09281a9ff937d5eafcc7c Gerrit-Change-Number: 27739 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Tue, 12 Apr 2022 09:15:16 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: No Gerrit-MessageType: comment

3 years, 2 months

1
0
0 0

Change in osmo-uecups[master]: Fix use-after-free by tun thread after tun obj destroyed

by daniel

Attention is currently required from: osmith, pespin, lynxis lazus. daniel has posted comments on this change. ( https://gerrit.osmocom.org/c/osmo-uecups/+/27739 ) Change subject: Fix use-after-free by tun thread after tun obj destroyed ...................................................................... Patch Set 3: Code-Review+1 (1 comment) File daemon/tun_device.c: https://gerrit.osmocom.org/c/osmo-uecups/+/27739/comment/6bbf091c_06a7e8d2 PS2, Line 204: pthread_cleanup_pop(tun_device_pthread_cleanup_routine); > man pthread_cleanup_pop reads: […] Done -- To view, visit https://gerrit.osmocom.org/c/osmo-uecups/+/27739 To unsubscribe, or for help writing mail filters, visit https://gerrit.osmocom.org/settings Gerrit-Project: osmo-uecups Gerrit-Branch: master Gerrit-Change-Id: Idf005359afb41d3413b09281a9ff937d5eafcc7c Gerrit-Change-Number: 27739 Gerrit-PatchSet: 3 Gerrit-Owner: pespin <pespin(a)sysmocom.de> Gerrit-Reviewer: Jenkins Builder Gerrit-Reviewer: daniel <dwillmann(a)sysmocom.de> Gerrit-Reviewer: fixeria <vyanitskiy(a)sysmocom.de> Gerrit-Reviewer: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Reviewer: osmith <osmith(a)sysmocom.de> Gerrit-Attention: osmith <osmith(a)sysmocom.de> Gerrit-Attention: pespin <pespin(a)sysmocom.de> Gerrit-Attention: lynxis lazus <lynxis(a)fe80.eu> Gerrit-Comment-Date: Tue, 12 Apr 2022 08:57:06 +0000 Gerrit-HasComments: Yes Gerrit-Has-Labels: Yes Comment-In-Reply-To: daniel <dwillmann(a)sysmocom.de> Gerrit-MessageType: comment

3 years, 2 months

1
0
0 0

2025

2024

2023

2022

gerrit-log April 2022