Skip to content

Backport !1158 “Fix use-after-free when calling g_dbus_connection_flush_sync()” to glib-2-62

Philip Withnall requested to merge pwithnall/glib:backport-1158-dbus-race-glib-2-62 into glib-2-62

When the _g_dbus_worker_flush_sync() schedules the 'data' and releases the worker->write_lock, it is possible for the GDBus worker thread thread to finish the D-Bus call and acquire the worker->write_lock before the _g_dbus_worker_flush_sync() re-acquires it in the if (data != NULL) body. When that happens, the ostream_flush_cb() increases the worker->write_num_messages_flushed and then releases the worker->write_lock. The write lock is reacquired by the _g_dbus_worker_flush_sync(), which sees that the while condition is satisfied, thus it doesn't enter the loop body and immediately clears the data members and frees the data structure itself. The ostream_flush_cb() is still ongoing, possibly inside flush_data_list_complete(), where it accesses the FlushData, which can be in any stage of being freed.

Instead, add an explicit boolean flag indicating when the flush is truly finished.

Closes #1896 (closed)

Trivial backport of !1158 (merged).

Merge request reports