{"object_kind":"push","event_name":"push","before":"e9a0ac13463da251db0d26c3f4dc8214202757fc","after":"f93b3b23a3500ec3a2db91ff684ac54190f0f826","ref":"refs/heads/master","ref_protected":true,"checkout_sha":"f93b3b23a3500ec3a2db91ff684ac54190f0f826","message":null,"user_id":3060,"user_name":"Wim Taymans","user_username":"wtaymans","user_email":"","user_avatar":"https://secure.gravatar.com/avatar/ee99737f7492c79c3a9be75f2e2437f2c944c95fca1480fafcd7ce3bf8c85784?s=80&d=identicon","project_id":4753,"project":{"id":4753,"name":"pipewire","description":"Multimedia processing graphs","web_url":"https://gitlab.freedesktop.org/pipewire/pipewire","avatar_url":"https://gitlab.freedesktop.org/uploads/-/system/project/avatar/4753/pipewire.png","git_ssh_url":"git@ssh.gitlab.freedesktop.org:pipewire/pipewire.git","git_http_url":"https://gitlab.freedesktop.org/pipewire/pipewire.git","namespace":"PipeWire","visibility_level":20,"path_with_namespace":"pipewire/pipewire","default_branch":"master","ci_config_path":"","homepage":"https://gitlab.freedesktop.org/pipewire/pipewire","url":"git@ssh.gitlab.freedesktop.org:pipewire/pipewire.git","ssh_url":"git@ssh.gitlab.freedesktop.org:pipewire/pipewire.git","http_url":"https://gitlab.freedesktop.org/pipewire/pipewire.git"},"commits":[{"id":"f93b3b23a3500ec3a2db91ff684ac54190f0f826","message":"loop: fix use after free case\n\nBecause we can now destroy sources (and free the source structure) by\nsimply holding the lock, there is a window where we might access the\nfreed source.\n\nWhen we in iterate release the lock and go into the epoll, another\nthread might acquire the lock and delete the fd from epoll. This might\nhappen right after epoll detected activity on the fd. When iterate\nmanages to acquire the lock again, it will process to dispatch the\nactive fd and deref the ep.data pointer, which is now pointing to freed\nmemory.\n\nFix this by incrementing a removed_count whenever we remove a source.\nCheck the counter if it was the same as before the epoll otherwise we\ncan't assume all sources are alive still. Return in that case as if\nthere were no fds to poll. The caller should reenter the iterate at some\npoint and we will return all the fds with activity, minus the one that\ngot destroyed. We need to give control to the caller because part of the\nremoval could be to stop the loop iteration all together.\n","title":"loop: fix use after free case","timestamp":"2025-06-30T12:44:15+02:00","url":"https://gitlab.freedesktop.org/pipewire/pipewire/-/commit/f93b3b23a3500ec3a2db91ff684ac54190f0f826","author":{"name":"Wim Taymans","email":"wtaymans@redhat.com"},"added":[],"modified":["spa/plugins/support/loop.c"],"removed":[]}],"total_commits_count":1,"push_options":{},"repository":{"name":"pipewire","url":"git@ssh.gitlab.freedesktop.org:pipewire/pipewire.git","description":"Multimedia processing graphs","homepage":"https://gitlab.freedesktop.org/pipewire/pipewire","git_http_url":"https://gitlab.freedesktop.org/pipewire/pipewire.git","git_ssh_url":"git@ssh.gitlab.freedesktop.org:pipewire/pipewire.git","visibility_level":20}}