Frontported fix for bug CORE-6477 : Rare race condition in Plugin Manager could lead to the server crash

hvlad · hvlad · commit 07030d3e23e8 · 2021-02-03T19:47:09.000+02:00
diff --git a/src/yvalve/PluginManager.cpp b/src/yvalve/PluginManager.cpp
@@ -500,8 +500,10 @@ namespace
 		void handler()
 		{ }
 
+		int release();
 	private:
-		~ConfiguredPlugin();
+		~ConfiguredPlugin() {}
+		void destroy();
 
 		RefPtr<PluginModule> module;
 		unsigned int regPlugin;
@@ -653,10 +655,15 @@ namespace
 
 	GlobalPtr<PluginsMap> plugins;
 
-	ConfiguredPlugin::~ConfiguredPlugin()
+	void ConfiguredPlugin::destroy()
 	{
-		MutexLockGuard g(plugins->mutex, FB_FUNCTION);
+		// plugins->mutex must be entered by current thread
 
+#ifdef DEV_BUILD
+		if (!plugins->mutex.tryEnter(FB_FUNCTION))
+			fb_assert(false);
+		plugins->mutex.leave();
+#endif
 		if (!destroyingPluginsMap)
 		{
 			plugins->remove(MapKey(module->getPlugin(regPlugin).type, plugName));
@@ -676,6 +683,33 @@ namespace
 #endif
 	}
 
+	int ConfiguredPlugin::release()
+	{
+		int x = --refCounter;
+
+#ifdef DEBUG_PLUGINS
+		fprintf(stderr, "ConfiguredPlugin::release %s %d\n", plugName.c_str(), x);
+#endif
+
+		if (x == 0)
+		{
+			{ // plugins->mutex scope
+				MutexLockGuard g(plugins->mutex, FB_FUNCTION);
+				if (refCounter != 0)
+					return 1;
+
+				destroy();
+			}
+
+			// Must run out of mutex scope to avoid deadlock with PluginManager::threadDetach()
+			// called when module is unloaded by dtor
+			delete this;
+			return 0;
+		}
+
+		return 1;
+	}
+
 	PluginModule* modules = NULL;
 
 	PluginModule* current = NULL;
