Coverity report Oct 31st, 2024
We got a report of three CID from a patch we merged recently in 048+
________________________________________________________________________________________________________
*** CID 1634143: Concurrent data access violations (MISSING_LOCK)
/src/lib/evloop/workqueue.c: 609 in threadpool_free_()
603 workerthread_free(pool->threads[i]);
604
605 tor_free(pool->threads);
606 }
607
608 if (pool->update_args)
>>> CID 1634143: Concurrent data access violations (MISSING_LOCK)
>>> Accessing "pool->free_update_arg_fn" without holding lock "tor_mutex_t.mutex". Elsewhere, "threadpool_t.free_update_arg_fn" is written to with "tor_mutex_t.mutex" held 1 out of 1 times.
609 pool->free_update_arg_fn(pool->update_args);
610
611 if (pool->reply_event) {
612 tor_event_del(pool->reply_event);
613 tor_event_free(pool->reply_event);
614 }
** CID 1634142: Error handling issues (CHECKED_RETURN)
/src/lib/evloop/workqueue.c: 612 in threadpool_free_()
Then:
________________________________________________________________________________________________________
*** CID 1634142: Error handling issues (CHECKED_RETURN)
/src/lib/evloop/workqueue.c: 612 in threadpool_free_()
606 }
607
608 if (pool->update_args)
609 pool->free_update_arg_fn(pool->update_args);
610
611 if (pool->reply_event) {
>>> CID 1634142: Error handling issues (CHECKED_RETURN)
>>> Calling "event_del" without checking return value (as is done elsewhere 4 out of 5 times).
612 tor_event_del(pool->reply_event);
613 tor_event_free(pool->reply_event);
614 }
615
616 if (pool->reply_queue)
617 replyqueue_free(pool->reply_queue);
Finally:
________________________________________________________________________________________________________
*** CID 1634141: Concurrent data access violations (MISSING_LOCK)
/src/lib/evloop/workqueue.c: 608 in threadpool_free_()
602 for (int i = 0; i != pool->n_threads; ++i)
603 workerthread_free(pool->threads[i]);
604
605 tor_free(pool->threads);
606 }
607
>>> CID 1634141: Concurrent data access violations (MISSING_LOCK)
>>> Accessing "pool->update_args" without holding lock "tor_mutex_t.mutex". Elsewhere, "threadpool_t.update_args" is written to with "tor_mutex_t.mutex" held 1 out of 1 times.
608 if (pool->update_args)
609 pool->free_update_arg_fn(pool->update_args);
610
611 if (pool->reply_event) {
612 tor_event_del(pool->reply_event);
613 tor_event_free(pool->reply_event);