eina: fix a possible race condition during eina_file_close.

The lock on the main hash was taken to late (after we took the decision
to remove the targeted Eina_File from the cache), this means it was possible
to get an Eina_File from the cache that was going to be removed. This patch
attempt to fix that potential race condition.

Hopefully should fix T461.

4 files changed, 19 insertions, 15 deletions

diff --git a/src/lib/eina/eina_file.c b/src/lib/eina/eina_file.c
index 6d7ee56f54..8ae5a0f4ed 100644
--- a/src/lib/eina/eina_file.c
+++ b/src/lib/eina/eina_file.c
@@ -305,11 +305,6 @@ eina_file_real_close(Eina_File *file)
 {
    Eina_File_Map *map;
 
-   if (file->refcount != 0) return;
-
-   eina_hash_free(file->rmap);
-   eina_hash_free(file->map);
-
    EINA_LIST_FREE(file->dead_map, map)
      {
         munmap(map->map, map->length);
@@ -320,8 +315,6 @@ eina_file_real_close(Eina_File *file)
      munmap(file->global_map, file->length);
 
    if (file->fd != -1) close(file->fd);
-
-   free(file);
 }
 
 static void
@@ -912,6 +905,8 @@ eina_file_open(const char *path, Eina_Bool shared)
         n->shared = shared;
         eina_lock_new(&n->lock);
         eina_hash_direct_add(_eina_file_cache, n->filename, n);
+
+        EINA_MAGIC_SET(n, EINA_FILE_MAGIC);
      }
    else
      {
diff --git a/src/lib/eina/eina_file_common.c b/src/lib/eina/eina_file_common.c
index 7b05b3b249..f5724d70bf 100644
--- a/src/lib/eina/eina_file_common.c
+++ b/src/lib/eina/eina_file_common.c
@@ -451,17 +451,26 @@ eina_file_close(Eina_File *file)
 
    EINA_SAFETY_ON_NULL_RETURN(file);
 
+   eina_lock_take(&_eina_file_lock_cache);
+
    eina_lock_take(&file->lock);
    file->refcount--;
    if (file->refcount == 0) leave = EINA_FALSE;
    eina_lock_release(&file->lock);
-   if (leave) return;
-
-   eina_lock_take(&_eina_file_lock_cache);
+   if (leave) goto end;
 
    eina_hash_del(_eina_file_cache, file->filename, file);
+
+   // Backend specific file resource close
    eina_file_real_close(file);
 
+   // Generic destruction of the file
+   eina_hash_free(file->rmap); file->rmap = NULL;
+   eina_hash_free(file->map); file->map = NULL;
+   EINA_MAGIC_SET(file, 0);
+   free(file);
+
+ end:
    eina_lock_release(&_eina_file_lock_cache);
 }
 
diff --git a/src/lib/eina/eina_file_common.h b/src/lib/eina/eina_file_common.h
index 0ac704d028..e3ee0fc553 100644
--- a/src/lib/eina/eina_file_common.h
+++ b/src/lib/eina/eina_file_common.h
@@ -24,11 +24,14 @@
 #include "eina_lock.h"
 #include "eina_list.h"
 
+#define EINA_FILE_MAGIC 0xFEEDBEEF
+
 typedef struct _Eina_File_Map Eina_File_Map;
 typedef struct _Eina_Lines_Iterator Eina_Lines_Iterator;
 
 struct _Eina_File
 {
+   EINA_MAGIC;
    const char *filename;
 
    Eina_Hash *map;
diff --git a/src/lib/eina/eina_file_win32.c b/src/lib/eina/eina_file_win32.c
index cddf2da81a..8290501869 100644
--- a/src/lib/eina/eina_file_win32.c
+++ b/src/lib/eina/eina_file_win32.c
@@ -366,9 +366,6 @@ eina_file_real_close(Eina_File *file)
 {
    Eina_File_Map *map;
 
-   eina_hash_free(file->rmap);
-   eina_hash_free(file->map);
-
    EINA_LIST_FREE(file->dead_map, map)
      {
         UnmapViewOfFile(map->map);
@@ -380,8 +377,6 @@ eina_file_real_close(Eina_File *file)
 
    if (file->fm) CloseHandle(file->fm);
    if (file->handle) CloseHandle(file->handle);
-
-   free(file);
 }
 
 static void
@@ -837,6 +832,8 @@ eina_file_open(const char *path, Eina_Bool shared)
         n->shared = shared;
         eina_lock_new(&n->lock);
         eina_hash_direct_add(_eina_file_cache, n->filename, n);
+
+        EINA_MAGIC_SET(n, EINA_FILE_MAGIC);
      }
    else
      {