MT#62181 wheeltimer: prevent double free

Requesting removal of a timer that isn't present in the list indicates a
race condition. Something else has already removed/disarmed the timer
(possibly from firing the timer), and that something else is then in
charge of freeing the object. Therefore do not free the timer object at
removal if the timer wasn't armed.

Change-Id: I26b58b6dc3400acf3241375da3cde879a5968d41
(cherry picked from commit 5c455d32dc)
mr13.4
Richard Fuchs 1 year ago
parent 340bd8ece5
commit cc5490e33c

@ -193,10 +193,12 @@ void _wheeltimer::add_timer_to_bucket(timer* t, uint64_t bucket)
// requires buckets_mut mutex to be held
void _wheeltimer::delete_timer(timer* t, bool del_timer)
{
if (t->disarm())
DBG("successfully removed timer [%p]\n", t);
else
DBG("timer [%p] not found for removing\n", t);
if (!t->disarm()) {
DBG("timer [%p] not found for removing\n", t);
return;
}
DBG("successfully removed timer [%p]\n", t);
if (del_timer) {
DBG("timer object has been deallocated\n");

Loading…
Cancel
Save