From c551b08f88753b22d909b9616c8e0b3f48266ef8 Mon Sep 17 00:00:00 2001 From: Levi Neely Date: Tue, 3 Mar 2026 16:11:52 +0100 Subject: [PATCH] Fix race condition in pfs_dec_of_refcnt Call pfs_free_openfile() before releasing locks to prevent another thread from accessing freed memory between unlock and free. Fixes #257 --- pclsync/pfs.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/pclsync/pfs.c b/pclsync/pfs.c index 83da3ef..78af7ee 100644 --- a/pclsync/pfs.c +++ b/pclsync/pfs.c @@ -1782,12 +1782,15 @@ void pfs_dec_of_refcnt(psync_openfile_t *of) { uint32_t refcnt; pfs_get_both_locks(of); refcnt = --of->refcnt; - if (!refcnt) + if (!refcnt) { ptree_del(&openfiles, &of->tree); - psql_unlock(); - pthread_mutex_unlock(&of->mutex); - if (!refcnt) + psql_unlock(); + pthread_mutex_unlock(&of->mutex); pfs_free_openfile(of); + } else { + psql_unlock(); + pthread_mutex_unlock(&of->mutex); + } } void pfs_inc_of_refcnt_and_readers(psync_openfile_t *of) {