From bae235cd5fdfd10f63308e70eff8e689449e040b Mon Sep 17 00:00:00 2001
From: Craig Tiller <ctiller@google.com>
Date: Mon, 5 Oct 2015 11:33:36 -0700
Subject: [PATCH] Fix use-after-free
---
src/core/iomgr/pollset_posix.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/src/core/iomgr/pollset_posix.c b/src/core/iomgr/pollset_posix.c
index 9042827484..b663780a02 100644
--- a/src/core/iomgr/pollset_posix.c
+++ b/src/core/iomgr/pollset_posix.c
@@ -477,6 +477,7 @@ static void basic_pollset_maybe_work_and_unlock(grpc_exec_ctx *exec_ctx,
if (fd) {
pfd[2].fd = fd->fd;
pfd[2].revents = 0;
+ GRPC_FD_REF(fd, "basicpoll_begin");
gpr_mu_unlock(&pollset->mu);
pfd[2].events =
(short)grpc_fd_begin_poll(fd, pollset, POLLIN, POLLOUT, &fd_watcher);
@@ -523,6 +524,10 @@ static void basic_pollset_maybe_work_and_unlock(grpc_exec_ctx *exec_ctx,
}
}
}
+
+ if (fd) {
+ GRPC_FD_UNREF(fd, "basicpoll_begin");
+ }
}
static void basic_pollset_destroy(grpc_pollset *pollset) {
--
GitLab