go /
exp /
1eff713ba9c2d8361ebc3ce80c537babb5405fee shiny/driver/x11driver: fix a buffer TOCTTOU race.
Previously, bufferImpl's swizzling and clean-up were done outside of
holding the b.mu lock. One goroutine could call b.postUpload and another
call b.Release, and race so that the first goroutine would check
b.released (and see false), release the b.mu lock, and call swizzle.RGBA
(as b.released was false at the time of check). Concurrently, the second
goroutine would now acquire b.mu, set b.released to true, release b.mu,
and then call b.cleanUp. The swizzle and the clean-up don't play well
together.
The fix is hold the mutex for the entirety of the Release, preUpload and
postUpload methods.
Change-Id: Ic40a918cad48a1f2159da7b3410a77faf68cef06
Reviewed-on: https://go-review.googlesource.com/14819
Reviewed-by: David Crawshaw <crawshaw@golang.org>
1 file changed
