Commit 7970e46
committed
race fix: worker thread destroyed before it is initialized
This fixes a race condition in makeThread that can currently trigger segfaults
as reported:
bitcoin/bitcoin#34711
bitcoin/bitcoin#34756
The problem is a segfault in ProxyServer<ThreadMap>::makeThread calling
`Lock lock(g_thread_context.waiter->m_mutex);` that happens because the
waiter pointer is null. The waiter pointer can be null if the worker
thread is destroyed immediately after it is created, because
`~ProxyServer<Thread>` sets it to null.
The fix works by moving the lock line above the
`thread_context.set_value()` line so the worker thread can't be
destroyed before it is fully initialized.
A more detailed description of the bug and fix can be found in
bitcoin-core#249 (comment)
The bug can be reproduced by running the unit test added in the previous commit
or by calling makeThread and immediately disconnecting or destroying the
returned thread. The bug is not new and has existed since makeThread was
implemented, but it was found due to a new functional test in bitcoin core and
with antithesis testing (see details in linked issues).
The fix was originally posted in
bitcoin/bitcoin#34711 (comment)1 parent ca1ce9c commit 7970e46
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
418 | 418 | | |
419 | 419 | | |
420 | 420 | | |
| 421 | + | |
421 | 422 | | |
422 | 423 | | |
423 | | - | |
424 | 424 | | |
425 | 425 | | |
426 | 426 | | |
| |||
0 commit comments