Skip to content

Commit cde6ad3

Browse files
committed
Fix nasty double-free bug where a newrt chan could get killed after rescheduling but before suppressing_finalize.
1 parent be7738b commit cde6ad3

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

src/libstd/rt/comm.rs

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,13 @@ impl<T> ChanOne<T> {
131131
// acquire barrier that keeps the subsequent access of the
132132
// ~Task pointer from being reordered.
133133
let oldstate = (*packet).state.swap(STATE_ONE, SeqCst);
134+
135+
// Suppress the synchronizing actions in the finalizer. We're
136+
// done with the packet. NB: In case of do_resched, this *must*
137+
// happen before waking up a blocked task (or be unkillable),
138+
// because we might get a kill signal during the reschedule.
139+
this.suppress_finalize = true;
140+
134141
match oldstate {
135142
STATE_BOTH => {
136143
// Port is not waiting yet. Nothing to do
@@ -165,8 +172,6 @@ impl<T> ChanOne<T> {
165172
}
166173
}
167174

168-
// Suppress the synchronizing actions in the finalizer. We're done with the packet.
169-
this.suppress_finalize = true;
170175
return recvr_active;
171176
}
172177
}

0 commit comments

Comments
 (0)