diff options
| author | riastradh <riastradh@NetBSD.org> | 2023-04-16 11:14:58 +0000 |
|---|---|---|
| committer | riastradh <riastradh@NetBSD.org> | 2023-04-16 11:14:58 +0000 |
| commit | b19049b1aea9e9eeae536bc3cc61c23ca3c8a5c9 (patch) | |
| tree | 187208b47a7b9568c51ee75ae233f7a8beaba331 /external/mit/lua/lib/liblua | |
| parent | f2404724093ea2c14f09de6c00a109f960018928 (diff) | |
autoconf(9): Avoid potential ABA bug in config_makeroom.
When we unlock alldevs_lock to allocate a new cd_devs array nsp,
other threads may have:
1. freed the old one (osp),
2. done some other memory allocation,
3. allocated a new _larger_ array whose address happens to concide
with osp (e.g., in (2) the page was recycled for a different pool
cache), and
4. updated cd_devs back to osp but increased cd_ndevs.
In that case, the memory may be corrupted: we try to copy the wrong
number of device_t pointers into nsp and we free osp with the wrong
(stale) length.
Avoid this by checking whether cd_ndevs has changed too -- if not,
osp might have been recycled but at least the lengths we're about to
copy and free are still correct so there's no harm in an ABA
situation.
XXX pullup-8
XXX pullup-9
XXX pullup-10
Diffstat (limited to 'external/mit/lua/lib/liblua')
0 files changed, 0 insertions, 0 deletions
