From 5c455d32dc10aafc97f7d62e89aa6167c34cf657 Mon Sep 17 00:00:00 2001 From: Richard Fuchs Date: Fri, 8 Aug 2025 09:24:48 -0400 Subject: [PATCH] MT#62181 wheeltimer: prevent double free Requesting removal of a timer that isn't present in the list indicates a race condition. Something else has already removed/disarmed the timer (possibly from firing the timer), and that something else is then in charge of freeing the object. Therefore do not free the timer object at removal if the timer wasn't armed. Change-Id: I26b58b6dc3400acf3241375da3cde879a5968d41 --- core/sip/wheeltimer.cpp | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/core/sip/wheeltimer.cpp b/core/sip/wheeltimer.cpp index d8b6ee4e..ceb9b25f 100644 --- a/core/sip/wheeltimer.cpp +++ b/core/sip/wheeltimer.cpp @@ -193,10 +193,12 @@ void _wheeltimer::add_timer_to_bucket(timer* t, uint64_t bucket) // requires buckets_mut mutex to be held void _wheeltimer::delete_timer(timer* t, bool del_timer) { - if (t->disarm()) - DBG("successfully removed timer [%p]\n", t); - else - DBG("timer [%p] not found for removing\n", t); + if (!t->disarm()) { + DBG("timer [%p] not found for removing\n", t); + return; + } + + DBG("successfully removed timer [%p]\n", t); if (del_timer) { DBG("timer object has been deallocated\n");