You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When calling async operation OCL uses _cache_mngt_async_callee_set_result() and _cache_mngt_async_caller_set_result() to communicate whether the caller or the callee is responsible for cleanup.
The API has an invalid assumption - it's not prepared for the callee() part being called before the caller(). This may lead to use-after-free in the caller() code - in case if an async operation is interrupted and the completion function gets called first it marks the completion in struct _cache_mngt_async_context and it frees the context structure instantly. Then, when the caller thread is waked up, it calls _cache_mngt_async_caller_set_result() with the pointer to context, which just has been freed in the completion.
The possible solution is adding reference counter to struct _cache_mngt_async_context
The text was updated successfully, but these errors were encountered:
When calling async operation OCL uses
_cache_mngt_async_callee_set_result()
and_cache_mngt_async_caller_set_result()
to communicate whether the caller or the callee is responsible for cleanup.The API has an invalid assumption - it's not prepared for the
callee()
part being called before thecaller()
. This may lead to use-after-free in thecaller()
code - in case if an async operation is interrupted and the completion function gets called first it marks the completion instruct _cache_mngt_async_context
and it frees the context structure instantly. Then, when the caller thread is waked up, it calls_cache_mngt_async_caller_set_result()
with the pointer to context, which just has been freed in the completion.The possible solution is adding reference counter to
struct _cache_mngt_async_context
The text was updated successfully, but these errors were encountered: