DBusCounter: add a mutex to protect the refcount and notify function
authorAdrian Szyndela <adrian.s@samsung.com>
Tue, 5 May 2015 11:30:30 +0000 (12:30 +0100)
committerSimon McVittie <simon.mcvittie@collabora.co.uk>
Tue, 5 May 2015 11:30:30 +0000 (12:30 +0100)
commitbbef8e40383efd84972e6346b3f37b553531e191
tree9811a95696231c2da3e1116a36ccd081f78bbf8d
parentbebe9ca9937a5e44147c8fc0160f04d39573d110
DBusCounter: add a mutex to protect the refcount and notify function

The overall problem here is that DBusCounter is indirectly linked
to a DBusConnection, but is not actually guaranteed to be protected by
that connection's mutex; and a DBusMessage can carry a reference to the
DBusCounter, resulting in freeing that DBusMessage having an effect on
the DBusCounter.

Making the refcount atomic would not be a sufficient fix, since it would
not protect the notify function: _dbus_counter_notify() could be called
indirectly by dbus_message_unref(), in an arbitrary thread that does not
hold the DBusConnection's lock, at the same time that the holder
of the DBusConnection lock calls _dbus_transport_set_max_message_size().

[smcv: added commit message]
Bug: https://bugs.freedesktop.org/show_bug.cgi?id=89297
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
dbus/dbus-resources.c