URL:
https://github.com/SSSD/sssd/pull/724
Title: #724: COMPONENT: util/tev_curl
alexey-tikhonov commented:
"""
Could you please explain the double-free in more detail?
Looking at tevent docs, they say that the tevent timer is freed automatically
That's correct.
and looking at the code, the `schedule_fd_processing` function is
only ever called from `tcurl_init` which should be a one-time operation. So currently
I'm not sure how could the function delete a timer that was already executed?
`schedule_fd_processing` is not "called" from `tcurl_init`. It is setup as
callback there. So `libcurl` calls `schedule_fd_processing` every time it wants to have
(new) timer setup. And (in kcm intg test) it happens quite a lot of times.
Being called `schedule_fd_processing` wants to delete previous timer before creating new
one. That's basically proper action. The problem is it sometimes tries to delete
non-existent (already executed and deleted by libtevent) timer. This is "double
free" case.
Proposed patch sets timer pointer in `tcurl_ctx` to NULL at the end of timer handler
(actually can be placed anywhere in the handler: handler called => timer deleted by
libtevent). That prevents `schedule_fd_processing` from freeing already freed memory. And
I think it is good idea overall to not have pointers to freed memory (dangling
pointers).
This should be safe operation since all processes are single-thread processes (as far as I
understand).
"""
See the full comment at
https://github.com/SSSD/sssd/pull/724#issuecomment-451390544