Project

General

Profile

Bug #3531

Updated by Marcel Telka almost 7 years ago

If the log_sysevent_filename() and log_event_upcall() are running concurrently it can cause several issues: 
 - two threads can call the door_ki_rele(event_door) in parallel - *Root Cause 1* (panic) 
 - the event_door even_door is cleared out before it is referenced - *Root Cause 2* (panic) 
 - the logevent_door_upcall_filename is used after it is freed - *Root Cause 3* (use-after-free) 

 *Solution:* 
 Added event_door_mutex into log_sysevent_filename() and log_event_upcall() to prevent the race.

Back