Opened 6 months ago

Closed 6 months ago

#25675 closed defect (fixed)

fix CID 1433643

Reported by: catalyst Owned by: catalyst
Priority: Medium Milestone: Tor: 0.3.4.x-final
Component: Core Tor/Tor Version: Tor: 0.2.7.3-rc
Severity: Normal Keywords: coverity
Cc: Actual Points:
Parent ID: Points:
Reviewer: Sponsor: Sponsor3

Description (last modified by catalyst)

Coverity found control_free_all() was accessing flush_queued_event_pending without locking. This was actually an old latent bug dating back to when we added multithreading to this queue, but Coverity somehow didn't notice the other unlocked accesses.

Child Tickets

Change History (3)

comment:1 Changed 6 months ago by catalyst

Keywords: regression removed

Latent bug, not actually a regression.

comment:2 Changed 6 months ago by catalyst

Description: modified (diff)
Sponsor: Sponsor3
Status: assignedneeds_review
Version: Tor: 0.2.7.3-rc

Patch in https://github.com/torproject/tor/pull/34

We probably don't need to backport this unless people are trying the restart thing in older releases somehow?

comment:3 Changed 6 months ago by nickm

Resolution: fixed
Status: needs_reviewclosed

Solid work. I hadn't thought of this move-the-pointer-out solution. Merging!

I agree that no backport is needed, since we're not going to backport any more restart-fixes to 0.3.3.

Note: See TracTickets for help on using tickets.