diff options
| author | Frediano Ziglio <fziglio@redhat.com> | 2016-04-12 16:28:07 +0100 |
|---|---|---|
| committer | Frediano Ziglio <fziglio@redhat.com> | 2016-04-12 16:28:07 +0100 |
| commit | b3aebf913623ed4c8cb7eb03380c0f3f2b7c42d6 (patch) | |
| tree | d410de6cd35ca06713db92d716dbbfb4863f8360 | |
| parent | 7d616b3de3256dac4b773b07531625515bf56d92 (diff) | |
red-channel: make red_client_{ref,unref} thread safe
These function are called on both sides of dispatcher so the
increment/decrement of the counter is done in multiple threads.
This caused the counter to not get incremented correctly and
freed the structure too early, leaving a dangling pointer in
the other thread.
This fixes https://bugzilla.redhat.com/show_bug.cgi?id=1253375.
Signed-off-by: Frediano Ziglio <fziglio@redhat.com>
Acked-by: Christophe Fergeau <cfergeau@redhat.com>
Acked-by: Jonathon Jongsma <jjongsma@redhat.com>
| -rw-r--r-- | server/red-channel.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/server/red-channel.c b/server/red-channel.c index d8f1d273..cfddea06 100644 --- a/server/red-channel.c +++ b/server/red-channel.c @@ -2064,13 +2064,13 @@ RedClient *red_client_new(RedsState *reds, int migrated) RedClient *red_client_ref(RedClient *client) { spice_assert(client); - client->refs++; + g_atomic_int_inc(&client->refs); return client; } RedClient *red_client_unref(RedClient *client) { - if (!--client->refs) { + if (g_atomic_int_dec_and_test(&client->refs)) { spice_debug("release client=%p", client); pthread_mutex_destroy(&client->lock); free(client); |