Fix race condition in Thread::PostTaskImpl, potential for UAF

When a task is posted to a Thread using PostTaskImpl, the target thread
might process the task and destroy itself immediately (e.g., if the task
calls Quit() and the thread owner destroys the thread).

Previously, PostTaskImpl would release the mutex before calling
WakeUpSocketServer(). This allowed the target thread to run, process the
task, and potentially be destroyed before PostTaskImpl could access ss_
(socket server) in WakeUpSocketServer(), leading to a
Use-After-Free/Destruction.

This moves the WakeUpSocketServer() call inside the mutex lock. This
ensures that the task is not visible to the target thread (via Get())
until PostTaskImpl has finished its work, effectively extending the
critical section to cover the wake-up call.

This issue was caught on the msan bot:
https://chromium-swarm.appspot.com/task?id=76216a8fa02bd411&o=true&w=true

Bug: None
Change-Id: I15af36aab965c1c9180d0c982d23b200de1d3472
Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/445120
Commit-Queue: Evan Shrubsole <eshr@webrtc.org>
Auto-Submit: Tomas Gunnarsson <tommi@webrtc.org>
Reviewed-by: Danil Chapovalov <danilchap@webrtc.org>
Reviewed-by: Evan Shrubsole <eshr@webrtc.org>
Cr-Commit-Position: refs/heads/main@{#46791}
1 file changed
tree: 23e8b086ac70deeb8fe5397da25772af6ac0b756
  1. agents/
  2. api/
  3. audio/
  4. build_overrides/
  5. call/
  6. common_audio/
  7. common_video/
  8. data/
  9. docs/
  10. examples/
  11. experiments/
  12. g3doc/
  13. infra/
  14. logging/
  15. media/
  16. modules/
  17. net/
  18. p2p/
  19. pc/
  20. resources/
  21. rtc_base/
  22. rtc_tools/
  23. sdk/
  24. stats/
  25. system_wrappers/
  26. test/
  27. tools_webrtc/
  28. video/
  29. .clang-format
  30. .clang-tidy
  31. .git-blame-ignore-revs
  32. .gitignore
  33. .gn
  34. .mailmap
  35. .rustfmt.toml
  36. .style.yapf
  37. .vpython3
  38. AUTHORS
  39. BUILD.gn
  40. CODE_OF_CONDUCT.md
  41. codereview.settings
  42. DEPS
  43. DIR_METADATA
  44. ENG_REVIEW_OWNERS
  45. GEMINI.md
  46. LICENSE
  47. license_template.txt
  48. native-api.md
  49. OWNERS
  50. OWNERS_INFRA
  51. PATENTS
  52. PRESUBMIT.py
  53. presubmit_test.py
  54. presubmit_test_mocks.py
  55. pylintrc
  56. pylintrc_old_style
  57. README.chromium
  58. README.md
  59. unsafe_buffers_paths.txt
  60. WATCHLISTS
  61. webrtc.gni
  62. webrtc_lib_link_test.cc
  63. whitespace.txt
README.md

WebRTC is a free, open software project that provides browsers and mobile applications with Real-Time Communications (RTC) capabilities via simple APIs. The WebRTC components have been optimized to best serve this purpose.

Our mission: To enable rich, high-quality RTC applications to be developed for the browser, mobile platforms, and IoT devices, and allow them all to communicate via a common set of protocols.

The WebRTC initiative is a project supported by Google, Mozilla and Opera, amongst others.

Development

See here for instructions on how to get started developing with the native code.

Authoritative list of directories that contain the native API header files.

More info