MT#62181 wheeltimer: prevent double free

Requesting removal of a timer that isn't present in the list indicates a
race condition. Something else has already removed/disarmed the timer
(possibly from firing the timer), and that something else is then in
charge of freeing the object. Therefore do not free the timer object at
removal if the timer wasn't armed.

Change-Id: I26b58b6dc3400acf3241375da3cde879a5968d41
mr13.5
Richard Fuchs 1 year ago
parent 54f55d449c
commit 5c455d32dc

@ -193,10 +193,12 @@ void _wheeltimer::add_timer_to_bucket(timer* t, uint64_t bucket)
// requires buckets_mut mutex to be held
void _wheeltimer::delete_timer(timer* t, bool del_timer)
{
if (t->disarm())
DBG("successfully removed timer [%p]\n", t);
else
DBG("timer [%p] not found for removing\n", t);
if (!t->disarm()) {
DBG("timer [%p] not found for removing\n", t);
return;
}
DBG("successfully removed timer [%p]\n", t);
if (del_timer) {
DBG("timer object has been deallocated\n");

Loading…
Cancel
Save