[trafficserver] branch master updated: Fix migrate use after free (#6578)

[shinrich]

This is an automated email from the ASF dual-hosted git repository.

shinrich pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new 7e58f90  Fix migrate use after free (#6578)
7e58f90 is described below

commit 7e58f90c51c86cf222bcf11e91e6d963a6ef440c
Author: Susan Hinrichs <shinr...@yahoo-inc.com>
AuthorDate: Thu Apr 9 09:24:47 2020 -0500

    Fix migrate use after free (#6578)
    
    Co-authored-by: Susan Hinrichs <shinr...@verizonmedia.com>
---
 iocore/net/UnixNetVConnection.cc | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/iocore/net/UnixNetVConnection.cc b/iocore/net/UnixNetVConnection.cc
index c2ab855..b5d2b89 100644
--- a/iocore/net/UnixNetVConnection.cc
+++ b/iocore/net/UnixNetVConnection.cc
@@ -1389,29 +1389,31 @@ UnixNetVConnection::migrateToCurrentThread(Continuation 
*cont, EThread *t)
   // Go ahead and remove the fd from the original thread's epoll structure, so 
it is not
   // processed on two threads simultaneously
   this->ep.stop();
-  this->do_io_close();
 
   // Create new VC:
+  UnixNetVConnection *netvc = nullptr;
   if (save_ssl) {
     SSLNetVConnection *sslvc = static_cast<SSLNetVConnection 
*>(sslNetProcessor.allocate_vc(t));
     if (sslvc->populate(hold_con, cont, save_ssl) != EVENT_DONE) {
       sslvc->do_io_close();
       sslvc = nullptr;
     } else {
+      // Update the SSL fields
       sslvc->set_context(get_context());
     }
-    return sslvc;
-    // Update the SSL fields
+    netvc = sslvc;
   } else {
-    UnixNetVConnection *netvc = static_cast<UnixNetVConnection 
*>(netProcessor.allocate_vc(t));
+    netvc = static_cast<UnixNetVConnection *>(netProcessor.allocate_vc(t));
     if (netvc->populate(hold_con, cont, save_ssl) != EVENT_DONE) {
       netvc->do_io_close();
       netvc = nullptr;
     } else {
       netvc->set_context(get_context());
     }
-    return netvc;
   }
+  // Do not mark this closed until the end so it does not get freed by the 
other thread too soon
+  this->do_io_close();
+  return netvc;
 }
 
 void