Skip to content

Commit 3db1654

Browse files
zhhyu7jerpelea
authored andcommitted
net/local: remove client from server.lc_waiters when client close
if client is a noblocking socket, user can do close when server has not yet invoke accept interface, so we need remove this socket from server.lc_waiters. avoid server socket access the freed memory. ==936564==ERROR: AddressSanitizer: heap-use-after-free on address 0xf23071c8 at pc 0x58eaac3b bp 0xf0b9e218 sp 0xf0b9e208 READ of size 4 at 0xf23071c8 thread T0 #0 0x58eaac3a in dq_remfirst queue/dq_remfirst.c:45 #1 0x58fd1efe in local_accept local/local_accept.c:141 #2 0x58f66df6 in psock_accept socket/accept.c:149 apache#3 0x58f672a4 in accept4 socket/accept.c:280 apache#4 0x5be9ee0c in accept net/lib_accept.c:50 apache#5 0x592d6a5d in uv__accept libuv/src/unix/core.c:502 apache#6 0x5930d83b in uv__server_io libuv/src/unix/stream.c:550 apache#7 0x592efbde in uv__io_poll libuv/src/unix/posix-poll.c:335 apache#8 0x592d649a in uv_run libuv/src/unix/core.c:387 apache#9 0x5a7180f7 in service_schedule_loop service/common/service_loop.c:146 apache#10 0x591f300b in pthread_startup pthread/pthread_create.c:59 apache#11 0x5be8134f in pthread_start pthread/pthread_create.c:139 apache#12 0x58ee2762 in pre_start sim/sim_initialstate.c:53 Signed-off-by: zhanghongyu <zhanghongyu@xiaomi.com>
1 parent 427f8a1 commit 3db1654

File tree

1 file changed

+29
-1
lines changed

1 file changed

+29
-1
lines changed

net/local/local_release.c

Lines changed: 29 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,9 +66,37 @@ int local_release(FAR struct local_conn_s *conn)
6666

6767
DEBUGASSERT(conn->lc_state != LOCAL_STATE_ACCEPT);
6868

69+
if (conn->lc_state == LOCAL_STATE_CONNECTING)
70+
{
71+
FAR struct local_conn_s *server = NULL;
72+
FAR struct local_conn_s *client;
73+
FAR dq_entry_t *waiter = NULL;
74+
75+
while ((server = local_nextconn(server)) && waiter == NULL)
76+
{
77+
if (server->lc_state == LOCAL_STATE_LISTENING)
78+
{
79+
for (waiter = dq_peek(&server->u.server.lc_waiters);
80+
waiter;
81+
waiter = dq_next(&client->u.client.lc_waiter))
82+
{
83+
if (&conn->u.client.lc_waiter == waiter)
84+
{
85+
dq_rem(waiter, &server->u.server.lc_waiters);
86+
server->u.server.lc_pending--;
87+
break;
88+
}
89+
90+
client = container_of(waiter, struct local_conn_s,
91+
u.client.lc_waiter);
92+
}
93+
}
94+
}
95+
}
96+
6997
/* Is the socket is listening socket (SOCK_STREAM server) */
7098

71-
if (conn->lc_state == LOCAL_STATE_LISTENING)
99+
else if (conn->lc_state == LOCAL_STATE_LISTENING)
72100
{
73101
FAR struct local_conn_s *client;
74102
FAR dq_entry_t *waiter;

0 commit comments

Comments
 (0)