Skip to content

Fix shutdown crash

Pre-release
Pre-release

Choose a tag to compare

@graebm graebm released this 20 Feb 00:06
5ed5ee0
Fix crash-on-shutdown due to double-free (#125)

Changed MQTT channel-handler so it completes its shutdown after sending disconnect packet. It no longer waits until the disconnect packet finishes writing. This behavior was resulting in a double-free in the TLS channel handler. The bug worked like this:

1) MQTT sends aws_io_message with disconnect in it, the message's write-complete callback will cause MQTT to say it's done shutting down.

2) TLS receives messages and completes it synchronously. MQTT immediately finishes its own shutdown. TLS finishes its own shutdown and frees ALL of its memory.

Callstack looks like this:
`MQTT shutdown() -> send aws_io_message -> TLS encrypt message -> TLS encrypt complete cb -> aws_io_message complete cb -> MQTT finish shutdown -> TLS finish shutdown and free ALL its memory`

But then we pop our way down the callstack until we're back in the "TLS encrypt complete cb", which goes to free some memory it used to encrypt the message.
BUT TLS has already deleted ALL its memory.
Double free. 💣

It should be the duty of TLS and Socket handlers to finish writing queued messages before completing their shutdown anyway. MQTT shouldn't have needed to wait.