Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 05:41:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1838286 - Fix a race condition with in-process DLL interception. r=win-reviewers,gstoll

Browse Source 
If a thread starts running a detoured function right after we
successfully committed our 13-bytes patch, there is a short delay where
it can reach the patched_XXX function and try to call stub_XXX while
stub_XXX.mOrigFunc is still a null pointer.

We fix this specific race condition, which, in the current code base,
materializes mostly as crashes in patched_BaseThreadInitThunk when
trying to call stub_BaseThreadInitThunk.

Differential Revision: https://phabricator.services.mozilla.com/D192668
This commit is contained in:
Yannis Juglaret 2023-11-03 16:57:50 +00:00
parent 9529ca9444
commit a5fe9e5af0
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
toolkit/xre/dllservices/mozglue/interceptor/PatcherDetour.h
View File

@ -1737,12 +1737,14 @@ class WindowsDllDetourPatcher final
PrimitiveT::ApplyDefaultPatch(target, aDest); PrimitiveT::ApplyDefaultPatch(target, aDest);
} while (false); } while (false);
if (!target.Commit()) { // Output the trampoline, thus signalling that this call was a success. This
return; // must happen before our patched function can be reached from another
} // thread, so before we commit the target code (bug 1838286).
// Output the trampoline, thus signalling that this call was a success
*aOutTramp = trampPtr; *aOutTramp = trampPtr;
if (!target.Commit()) {
*aOutTramp = nullptr;
}
} }
}; };