tree 95c3c6177f7c29938e036771f610937e5d33cae0
parent a29910ee26b0c83585af9325181ffda6f193aabd
author Nigel Tao <nigeltao@golang.org> 1442907445 +1000
committer Nigel Tao <nigeltao@golang.org> 1442968399 +0000

shiny/driver/x11driver: fix a buffer TOCTTOU race.

Previously, bufferImpl's swizzling and clean-up were done outside of
holding the b.mu lock. One goroutine could call b.postUpload and another
call b.Release, and race so that the first goroutine would check
b.released (and see false), release the b.mu lock, and call swizzle.RGBA
(as b.released was false at the time of check). Concurrently, the second
goroutine would now acquire b.mu, set b.released to true, release b.mu,
and then call b.cleanUp. The swizzle and the clean-up don't play well
together.

The fix is hold the mutex for the entirety of the Release, preUpload and
postUpload methods.

Change-Id: Ic40a918cad48a1f2159da7b3410a77faf68cef06
Reviewed-on: https://go-review.googlesource.com/14819
Reviewed-by: David Crawshaw <crawshaw@golang.org>