Skip to content

Commit c9bfbbc

Browse files
KenoKristofferC
authored andcommitted
Fix use-after-free in FileWatching (#59017)
We observe an abort on Windows on Revise master CI, where a free'd handle is passed to jl_close_uv. The root cause is that uv_fseventscb_file called uvfinalize earlier, but did not set the handle to NULL, so when the actual finalizer ran later, it would see corrupted state. (cherry picked from commit b45b429)
1 parent 6846af7 commit c9bfbbc

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

stdlib/FileWatching/src/FileWatching.jl

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -516,17 +516,19 @@ end
516516

517517
function uvfinalize(uv::Union{FileMonitor, FolderMonitor})
518518
iolock_begin()
519-
if uv.handle != C_NULL
520-
disassociate_julia_struct(uv) # close (and free) without notify
521-
ccall(:jl_close_uv, Cvoid, (Ptr{Cvoid},), uv.handle)
519+
handle = @atomicswap :monotonic uv.handle = C_NULL
520+
if handle != C_NULL
521+
disassociate_julia_struct(handle) # close (and free) without notify
522+
ccall(:jl_close_uv, Cvoid, (Ptr{Cvoid},), handle)
522523
end
523524
iolock_end()
524525
end
525526

526527
function close(t::Union{FileMonitor, FolderMonitor})
527528
iolock_begin()
528-
if t.handle != C_NULL
529-
ccall(:jl_close_uv, Cvoid, (Ptr{Cvoid},), t.handle)
529+
handle = t.handle
530+
if handle != C_NULL
531+
ccall(:jl_close_uv, Cvoid, (Ptr{Cvoid},), handle)
530532
end
531533
iolock_end()
532534
end

0 commit comments

Comments
 (0)