Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6f8dbf54 authored by Treehugger Robot's avatar Treehugger Robot Committed by Automerger Merge Worker
Browse files

Merge "init/epoll: Fix a potential use-after-free" am: 9c3113ab am: a0d6b24f am: 0ebfbc21 

Original change: https://android-review.googlesource.com/c/platform/system/core/+/2260824



Change-Id: I37ff00b2f7380f2297d8e762b390759748ce859c
Signed-off-by: default avatarAutomerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
parents fb14e4b7 0ebfbc21

init/epoll.cpp

+6 −4
Original line number Diff line number Diff line
@@ -54,9 +54,7 @@ Result<void> Epoll::RegisterHandler(int fd, Handler handler, uint32_t events) { 
    }

    epoll_event ev;

    ev.events = events;

    // std::map's iterators do not get invalidated until erased, so we use the

    // pointer to the std::function in the map directly for epoll_ctl.

    ev.data.ptr = reinterpret_cast<void*>(&it->second);

    ev.data.fd = fd;

    if (epoll_ctl(epoll_fd_, EPOLL_CTL_ADD, fd, &ev) == -1) {

        Result<void> result = ErrnoError() << "epoll_ctl failed to add fd";

        epoll_handlers_.erase(fd);
@@ -96,7 +94,11 @@ Result<std::vector<std::shared_ptr<Epoll::Handler>>> Epoll::Wait( 
    }

    std::vector<std::shared_ptr<Handler>> pending_functions;

    for (int i = 0; i < num_events; ++i) {

        auto& info = *reinterpret_cast<Info*>(ev[i].data.ptr);

        const auto it = epoll_handlers_.find(ev[i].data.fd);

        if (it == epoll_handlers_.end()) {

            continue;

        }

        const Info& info = it->second;

        if ((info.events & (EPOLLIN | EPOLLPRI)) == (EPOLLIN | EPOLLPRI) &&

            (ev[i].events & EPOLLIN) != ev[i].events) {

            // This handler wants to know about exception events, and just got one.