• Yedidya Feldblum's avatar
    Destroy promise/future callback functions before waking waiters · 8e110a76
    Yedidya Feldblum authored
    Summary:
    Code may pass a callback which captures an object with a destructor which mutates through a stored reference, triggering heap-use-after-free or stack-use-after-scope.
    
    ```lang=c++
    void performDataRace() {
      auto number = std::make_unique<int>(0);
      auto guard = folly::makeGuard([&number] { *number = 1; });
      folly::via(getSomeExecutor(), [guard = std::move(guard)]() mutable {}).wait();
      // data race - we may wake and destruct number before guard is destructed on the
      // executor thread, which is both stack-use-after-scope and heap-use-after-free!
    }
    ```
    
    We can avoid this condition by always destructing the provided functor before setting any result on the promise.
    
    Retry at {D4982969}.
    
    Reviewed By: andriigrynenko
    
    Differential Revision: D5058750
    
    fbshipit-source-id: 4d1d878b4889e5e6474941187f03de5fa84d3061
    8e110a76
CallbackLifetimeTest.cpp 5.5 KB