From c4049c0c449ca428ded2999c5258269cb470722c Mon Sep 17 00:00:00 2001
From: Xie Han <63350856@qq.com>
Date: Mon, 16 Oct 2023 15:00:53 +0800
Subject: [PATCH] Fix timer bug of accessing SleepSession after added to
 poller.

---
 src/kernel/Communicator.cc | 10 ++--------
 src/kernel/mpoller.h       |  8 ++++----
 src/kernel/poller.c        | 10 ++++++----
 src/kernel/poller.h        |  4 ++--
 4 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/src/kernel/Communicator.cc b/src/kernel/Communicator.cc
index 8837625d6a..c26a8ea110 100644
--- a/src/kernel/Communicator.cc
+++ b/src/kernel/Communicator.cc
@@ -1846,18 +1846,12 @@ int Communicator::shutdown(CommSession *session)
 int Communicator::sleep(SleepSession *session)
 {
 	struct timespec value;
-	void *timer;
-	int index;
 
 	if (session->duration(&value) >= 0)
 	{
-		timer = mpoller_add_timer(&value, session, &index, this->mpoller);
-		if (timer)
-		{
-			session->timer = timer;
-			session->index = index;
+		if (mpoller_add_timer(&value, session, &session->timer, &session->index,
+							  this->mpoller) >= 0)
 			return 0;
-		}
 	}
 
 	return -1;
diff --git a/src/kernel/mpoller.h b/src/kernel/mpoller.h
index 4e4233a549..9013bc7c57 100644
--- a/src/kernel/mpoller.h
+++ b/src/kernel/mpoller.h
@@ -71,13 +71,13 @@ static inline int mpoller_set_timeout(int fd, int timeout, mpoller_t *mpoller)
 	return poller_set_timeout(fd, timeout, mpoller->poller[index]);
 }
 
-static inline void *mpoller_add_timer(const struct timespec *value,
-									  void *context, int *index,
-									  mpoller_t *mpoller)
+static inline int mpoller_add_timer(const struct timespec *value, void *context,
+									void **timer, int *index,
+									mpoller_t *mpoller)
 {
 	static unsigned int n = 0;
 	*index = n++ % mpoller->nthreads;
-	return poller_add_timer(value, context, mpoller->poller[*index]);
+	return poller_add_timer(value, context, timer, mpoller->poller[*index]);
 }
 
 static inline int mpoller_del_timer(void *timer, int index, mpoller_t *mpoller)
diff --git a/src/kernel/poller.c b/src/kernel/poller.c
index 7e9dcf74a7..a75c5079da 100644
--- a/src/kernel/poller.c
+++ b/src/kernel/poller.c
@@ -1527,8 +1527,8 @@ int poller_set_timeout(int fd, int timeout, poller_t *poller)
 	return -!node;
 }
 
-void *poller_add_timer(const struct timespec *value, void *context,
-					   poller_t *poller)
+int poller_add_timer(const struct timespec *value, void *context, void **timer,
+					 poller_t *poller)
 {
 	struct __poller_node *node;
 
@@ -1552,12 +1552,14 @@ void *poller_add_timer(const struct timespec *value, void *context,
 			node->timeout.tv_sec++;
 		}
 
+		*timer = node;
 		pthread_mutex_lock(&poller->mutex);
 		__poller_insert_node(node, poller);
 		pthread_mutex_unlock(&poller->mutex);
+		return 0;
 	}
 
-	return node;
+	return -1;
 }
 
 int poller_del_timer(void *timer, poller_t *poller)
@@ -1578,7 +1580,7 @@ int poller_del_timer(void *timer, poller_t *poller)
 		node->error = 0;
 		node->state = PR_ST_DELETED;
 		stopped = poller->stopped;
-		if (!poller->stopped)
+		if (!stopped)
 			write(poller->pipe_wr, &node, sizeof (void *));
 	}
 	else
diff --git a/src/kernel/poller.h b/src/kernel/poller.h
index 010ef28c50..89831277e3 100644
--- a/src/kernel/poller.h
+++ b/src/kernel/poller.h
@@ -103,8 +103,8 @@ int poller_add(const struct poller_data *data, int timeout, poller_t *poller);
 int poller_del(int fd, poller_t *poller);
 int poller_mod(const struct poller_data *data, int timeout, poller_t *poller);
 int poller_set_timeout(int fd, int timeout, poller_t *poller);
-void *poller_add_timer(const struct timespec *value, void *context,
-					   poller_t *poller);
+int poller_add_timer(const struct timespec *value, void *context, void **timer,
+					 poller_t *poller);
 int poller_del_timer(void *timer, poller_t *poller);
 void poller_stop(poller_t *poller);
 void poller_destroy(poller_t *poller);