Skip to content

Commit 8989870

Browse files
irozzo-1Apoiana
authored andcommitted
fix(userspace/falco): fix watchdog race condition on timeout exchange
The watchdog thread and stop() consume the timeout pointer with m_timeout.exchange(nullptr, ...). That exchange was using memory_order_release. The load part of the RMW needs acquire semantics so it synchronizes-with the release store in set_timeout()/cancel_timeout(); otherwise the consumer can see the pointer value without seeing the writes that initialized the timeout_data and payload (data race). Use memory_order_acq_rel on the consumer exchanges so the load synchronizes-with the producer and the pointed-to memory is visible before use. Signed-off-by: irozzo-1A <iacopo@sysdig.com>
1 parent 526dc9a commit 8989870

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

userspace/falco/watchdog.h

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ class watchdog {
3535
const auto no_deadline = time_point{};
3636
timeout_data curr;
3737
while(m_is_running.load(std::memory_order_acquire)) {
38-
auto t = m_timeout.exchange(nullptr, std::memory_order_release);
38+
auto t = m_timeout.exchange(nullptr, std::memory_order_acq_rel);
3939
if(t) {
4040
curr = *t;
4141
delete t;
@@ -56,7 +56,7 @@ class watchdog {
5656
if(m_thread.joinable()) {
5757
m_thread.join();
5858
}
59-
delete m_timeout.exchange(nullptr, std::memory_order_release);
59+
delete m_timeout.exchange(nullptr, std::memory_order_acq_rel);
6060
}
6161
}
6262

0 commit comments

Comments
 (0)