diff options
| author |   dlg <dlg@openbsd.org> | 2011-05-10 00:58:42 +0000 |
|---|---|---|
| committer | dlg <dlg@openbsd.org> | 2011-05-10 00:58:42 +0000 |
| commit | 1da6c1696e8d4ec0781658aa58fce41ba1297c2f (patch) | |
| tree | 0ef31a83ecdc8dec5237ee0ebe4db31774651269 | |
| parent | Refactor queue allocation and initialization into a wdc_alloc_queue() (diff) | |
| download | wireguard-openbsd-1da6c1696e8d4ec0781658aa58fce41ba1297c2f.tar.xz wireguard-openbsd-1da6c1696e8d4ec0781658aa58fce41ba1297c2f.zip | |
tweak timeout_del so it can tell the caller if it actually did remove a
timeout or not.
without this it is impossible to tell if the timeout was removed
or if it is just about to run. if the caller of timeout_del is about
to free some state the timeout itself might use, this could lead
to a use after free.
now if timeout_del returns 1, you know the timeout wont fire and
you can proceed with cleanup. how you cope with the timeout being
about to fire is up to the caller of timeout_del.
discussed with drinking art and art, and most of k2k11
ok miod@
| -rw-r--r-- | sys/kern/kern_timeout.c | 9 | ||||
| -rw-r--r-- | sys/sys/timeout.h | 4 |
2 files changed, 9 insertions, 4 deletions
diff --git a/sys/kern/kern_timeout.c b/sys/kern/kern_timeout.c index 90b3f08e1ed..3237f60b600 100644 --- a/sys/kern/kern_timeout.c +++ b/sys/kern/kern_timeout.c @@ -1,4 +1,4 @@ -/* $OpenBSD: kern_timeout.c,v 1.32 2009/11/04 19:14:10 kettenis Exp $ */ +/* $OpenBSD: kern_timeout.c,v 1.33 2011/05/10 00:58:42 dlg Exp $ */ /* * Copyright (c) 2001 Thomas Nordin <nordin@openbsd.org> * Copyright (c) 2000-2001 Artur Grabowski <art@openbsd.org> @@ -263,16 +263,21 @@ timeout_add_nsec(struct timeout *to, int nsecs) timeout_add(to, to_ticks); } -void +int timeout_del(struct timeout *to) { + int ret = 0; + mtx_enter(&timeout_mutex); if (to->to_flags & TIMEOUT_ONQUEUE) { CIRCQ_REMOVE(&to->to_list); to->to_flags &= ~TIMEOUT_ONQUEUE; + ret = 1; } to->to_flags &= ~TIMEOUT_TRIGGERED; mtx_leave(&timeout_mutex); + + return (ret); } /* diff --git a/sys/sys/timeout.h b/sys/sys/timeout.h index 87ac0847615..98b984ffae3 100644 --- a/sys/sys/timeout.h +++ b/sys/sys/timeout.h @@ -1,4 +1,4 @@ -/* $OpenBSD: timeout.h,v 1.20 2010/05/26 17:50:00 deraadt Exp $ */ +/* $OpenBSD: timeout.h,v 1.21 2011/05/10 00:58:42 dlg Exp $ */ /* * Copyright (c) 2000-2001 Artur Grabowski <art@openbsd.org> * All rights reserved. @@ -91,7 +91,7 @@ void timeout_add_sec(struct timeout *, int); void timeout_add_msec(struct timeout *, int); void timeout_add_usec(struct timeout *, int); void timeout_add_nsec(struct timeout *, int); -void timeout_del(struct timeout *); +int timeout_del(struct timeout *); void timeout_startup(void); |