Race condition between event_persist_closure and event_callback_finalize_many_ about libevent HOT 3 CLOSED

I've investigated it further and it I'm not positive event_callback_finalize_many_ is so much as changing the pointer for the wrong callback as it is just leaving a garbage value behind that gets picked up in the race via event_persist_closure. I'm not 100% sure of the inner workings of these functions, but please let me know if I'm on to something here ;-).

Assuming all this could be solved by ensuring that only the base-loop thread executes bufferevent_free - I'll try re-arranging some things and see if that solves it in the short term.

Thanks!

from libevent.

Interesting! I think the solution here is possibly to change the logic so that we grab the relevant values from evcb (including) before we release the lock, but I want to look at the rest of the code a bit before I get too sure about that.

from libevent.

I've merged the patch here. Please reopen if this wasn't the right fix.

from libevent.