Page History

...

The following sequence of operations occurs:

Thread	Queue Before	Operation	Queue After
`T1`	`head -> A -> B -> C -> tail`	Enters `queue_dequeue()` function `head = A, tail = C` `next = B` after executing `data = next->data;` This thread gets preempted	`head -> A -> B -> C -> tail`
`T2`	`head -> A -> B -> C -> tail`	Removes node A	`head -> B -> C -> tail`
`T2`	`head -> B -> C -> tail`	Removes node B	`head -> C -> tail`
`T2`	`head -> C -> tail`	Enqueues node A back into the queue	`head -> C -> A -> tail`
`T2`	`head -> C -> A -> tail`	Removes node C	`head -> A -> tail`
`T2`	`head -> A -> tail`	Enqueues a new node D After enqueue operation, thread 2 gets preempted	`head -> A -> D -> tail`
`T1`	`head -> A -> D -> tail`	Thread 1 starts execution Compares the local head = `q->head` = A (true in this case) Updates `q->head` with node B (but node B is removed)	undefined {}

According to the sequence of events in this table, head will now point to memory that was freed. Also, if reclaimed memory is returned to the operating system (for example, using munmap()), access to such memory locations can result in fatal access violation errors. The ABA problem occurred because of the internal reuse of nodes that have been popped off the list or the reclamation of memory occupied by removed nodes.

...

The likelihood of having a race condition is low. Once the race condition occurs, the reading memory that has already been freed can lead to abnormal program termination or unintended information disclosure.

Recommendation	Severity	Likelihood	Detectable	RepairableRemediation Cost	Priority	Level
CON09-C	Medium	Unlikely	No	NoHigh	P2	L3

Automated Detection

Tool	Version	Checker	Description

...

Space shortcuts

Page tree

Versions Compared

Old Version 58

New Version 59

Key

Automated Detection