| 4eda8e1eabead3a9115bdd9cedd7e336ed431dbe |
|
23-Nov-2016 |
Dante Russo <drusso@codeaurora.org> |
fixing a race condition on MsgTask::destroy()
when MsgTask::destroy() happens, msg_q_unblock() triggers
the running thread to come out from blocking state. A race
condition may happen such that that thread may complete
first, causing msgTask obj to be already deleted. A next
allocation may change the value at MsgTask::mThread. Then
when control comes back to destroy(), it may try to check
mThread and call delete on it to crash the program.
mThread is a heap obj, so it is possible to delete it after
the hosting msgTask obj is deleted. We just have to keep
its value on the stack before calling msg_q_unblock().
Change-Id: If15884815eea05fbfa523ec92aa300ed21ef897c
CR-Fixed: 1091530
/hardware/qcom/gps/msm8909/utils/MsgTask.cpp
|