don't access free'd memory in cancel_sync()
as it happens, the 1st round *may* trash svars - if we get the cancelation request after the slave store has already died.
This commit is contained in:
parent
9554026443
commit
6d86e5347e
|
@ -403,14 +403,17 @@ cancel_sync( sync_vars_t *svars )
|
||||||
{
|
{
|
||||||
int t;
|
int t;
|
||||||
|
|
||||||
/* the 1st round is guaranteed not to trash svars */
|
for (t = 0; t < 2; t++) {
|
||||||
for (t = 0; t < 2; t++)
|
int other_state = svars->state[1-t];
|
||||||
if (svars->ret & SYNC_BAD(t)) {
|
if (svars->ret & SYNC_BAD(t)) {
|
||||||
svars->drv[t]->cancel_store( svars->ctx[t] );
|
svars->drv[t]->cancel_store( svars->ctx[t] );
|
||||||
cancel_done( AUX );
|
cancel_done( AUX );
|
||||||
} else {
|
} else {
|
||||||
svars->drv[t]->cancel( svars->ctx[t], cancel_done, AUX );
|
svars->drv[t]->cancel( svars->ctx[t], cancel_done, AUX );
|
||||||
}
|
}
|
||||||
|
if (other_state & ST_CANCELED)
|
||||||
|
break;
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
static void
|
static void
|
||||||
|
|
Loading…
Reference in New Issue
Block a user