dahjah/shadPS4
1
0
Fork 0
mirror of https://github.com/shadps4-emu/shadPS4.git synced 2025-12-16 12:09:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Kernel.Event: fix potential use-after-free in EqueueInternal::ScheduleEvent

Browse Source
This commit is contained in:
Rachel 2025-12-10 21:15:22 +08:00
parent de6c5bbb83
commit a8a01bfaae
No known key found for this signature in database
GPG Key ID: BA6DA18E0C1F046A
2 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/core/libraries/kernel/equeue.cpp
View File

@ -65,8 +65,16 @@ bool EqueueInternal::ScheduleEvent(u64 id, s16 filter,
it->timer->expires_at(it->timer->expiry() + event.timer_interval); it->timer->expires_at(it->timer->expiry() + event.timer_interval);
} }
std::weak_ptr weak_token = m_life_token;
it->timer->async_wait( it->timer->async_wait(
[this, event_data = event.event, callback](const boost::system::error_code& ec) { [this, event_data = event.event, callback, weak_token](const boost::system::error_code& ec) {
// If the token already expires return to avoid calling to callback with an invalid pointer.
if (weak_token.expired()) {
return;
}
if (ec) { if (ec) {
if (ec != boost::system::errc::operation_canceled) { if (ec != boost::system::errc::operation_canceled) {
LOG_ERROR(Kernel_Event, "Timer callback error: {}", ec.message()); LOG_ERROR(Kernel_Event, "Timer callback error: {}", ec.message());

1
src/core/libraries/kernel/equeue.h
View File

@ -180,6 +180,7 @@ private:
std::vector<EqueueEvent> m_events; std::vector<EqueueEvent> m_events;
std::condition_variable m_cond; std::condition_variable m_cond;
std::unordered_map<u64, SmallTimer> m_small_timers; std::unordered_map<u64, SmallTimer> m_small_timers;
std::shared_ptr<void> m_life_token = std::make_shared<int>(0);
}; };
u64 PS4_SYSV_ABI sceKernelGetEventData(const SceKernelEvent* ev); u64 PS4_SYSV_ABI sceKernelGetEventData(const SceKernelEvent* ev);