Fix use-after-free by tun thread after tun obj destroyed
The main thread calls pthread_cancel before freeing the tun object.
However, pthread_cancel doesn't kill the thread synchronously (man
pthread_cancel). Hence, the tun thread may still be running for a while
after the tun object is/has been(ing) freed.
Let's avoid this by making sure the thread is stopped before
freeing the object.
To accomplish it, we must wait for the thread to be cancelled. A cleanup
routie is added which will signal the "tun_released" message to the main
thread through an osmo_itq, which will then free the object (since
talloc context is managed by the main thread).
Related: SYS#5523
Change-Id: Idf005359afb41d3413b09281a9ff937d5eafcc7c
diff --git a/daemon/daemon_vty.c b/daemon/daemon_vty.c
index 3c44ed1..cfbe421 100644
--- a/daemon/daemon_vty.c
+++ b/daemon/daemon_vty.c
@@ -99,7 +99,7 @@
vty_out(vty, "Cannot destrory non-existant TUN%s", VTY_NEWLINE);
return CMD_WARNING;
}
- _tun_device_deref_destroy(tun);
+ _tun_device_deref_release(tun);
pthread_rwlock_unlock(&g_daemon->rwlock);
return CMD_SUCCESS;