This is an automated email from the ASF dual-hosted git repository. zwoop pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/trafficserver.git
commit 2615a2792d38ff6f6fe41c01ec2a5f91c236d941 Author: Susan Hinrichs <shinr...@yahoo-inc.com> AuthorDate: Thu Apr 9 09:24:47 2020 -0500 Fix migrate use after free (#6578) Co-authored-by: Susan Hinrichs <shinr...@verizonmedia.com> (cherry picked from commit 7e58f90c51c86cf222bcf11e91e6d963a6ef440c) --- iocore/net/UnixNetVConnection.cc | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/iocore/net/UnixNetVConnection.cc b/iocore/net/UnixNetVConnection.cc index bb67fd5..ab068f3 100644 --- a/iocore/net/UnixNetVConnection.cc +++ b/iocore/net/UnixNetVConnection.cc @@ -1384,29 +1384,31 @@ UnixNetVConnection::migrateToCurrentThread(Continuation *cont, EThread *t) // Go ahead and remove the fd from the original thread's epoll structure, so it is not // processed on two threads simultaneously this->ep.stop(); - this->do_io_close(); // Create new VC: + UnixNetVConnection *netvc = nullptr; if (save_ssl) { SSLNetVConnection *sslvc = static_cast<SSLNetVConnection *>(sslNetProcessor.allocate_vc(t)); if (sslvc->populate(hold_con, cont, save_ssl) != EVENT_DONE) { sslvc->do_io_close(); sslvc = nullptr; } else { + // Update the SSL fields sslvc->set_context(get_context()); } - return sslvc; - // Update the SSL fields + netvc = sslvc; } else { - UnixNetVConnection *netvc = static_cast<UnixNetVConnection *>(netProcessor.allocate_vc(t)); + netvc = static_cast<UnixNetVConnection *>(netProcessor.allocate_vc(t)); if (netvc->populate(hold_con, cont, save_ssl) != EVENT_DONE) { netvc->do_io_close(); netvc = nullptr; } else { netvc->set_context(get_context()); } - return netvc; } + // Do not mark this closed until the end so it does not get freed by the other thread too soon + this->do_io_close(); + return netvc; } void