Fix crash caused by race condition in timer creation

The race condition is the timer elapses before isc__timer_create()
returns the pointer to the caller.  Assigning the return pointer before
enabling the timer will fix it.

diff --git a/lib/isc/timer.c b/lib/isc/timer.c
index 65b72b882be3fb3f74c20f23413930bb8ff798f1..628b9221e2f6198a72bc2d1e54a916505f908fec 100644 (file)
--- a/lib/isc/timer.c
+++ b/lib/isc/timer.c
@@ -398,8 +398,10 @@ isc__timer_create(isc_timermgr_t *manager0, isc_timertype_t type,
                result = schedule(timer, &now, true);
        else
                result = ISC_R_SUCCESS;
-       if (result == ISC_R_SUCCESS)
+       if (result == ISC_R_SUCCESS) {
+               *timerp = (isc_timer_t *)timer;
                APPEND(manager->timers, timer, link);
+       }
 
        UNLOCK(&manager->lock);
 
@@ -412,8 +414,6 @@ isc__timer_create(isc_timermgr_t *manager0, isc_timertype_t type,
                return (result);
        }
 
-       *timerp = (isc_timer_t *)timer;
-
        return (ISC_R_SUCCESS);
 }