From e794639e31559c0b4054ce5c31f46194d93325f1 Mon Sep 17 00:00:00 2001
From: Michael Davidsaver <mdavidsaver@gmail.com>
Date: Wed, 8 Nov 2017 13:51:08 -0600
Subject: [PATCH] ioc/db: avoid possible race in db_close_events()

lp:1730982
---
 src/ioc/db/dbEvent.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/src/ioc/db/dbEvent.c b/src/ioc/db/dbEvent.c
index 5e386dd5c..fb1f3a168 100644
--- a/src/ioc/db/dbEvent.c
+++ b/src/ioc/db/dbEvent.c
@@ -117,6 +117,8 @@ static char *EVENT_PEND_NAME = "eventTask";
 
 static struct evSubscrip canceledEvent;
 
+static epicsMutexId stopSync;
+
 static unsigned short ringSpace ( const struct event_que *pevq )
 {
     if ( pevq->evque[pevq->putix] == EVENTQEMPTY ) {
@@ -258,6 +260,10 @@ dbEventCtx db_init_events (void)
 {
     struct event_user * evUser;
 
+    if (!stopSync) {
+        stopSync = epicsMutexMustCreate();
+    }
+
     if (!dbevEventUserFreeList) {
         freeListInitPvt(&dbevEventUserFreeList,
             sizeof(struct event_user),8);
@@ -321,6 +327,8 @@ fail:
     return NULL;
 }
 
+
+    /* intentionally leak stopSync to avoid possible shutdown races */
 /*
  *  DB_CLOSE_EVENTS()
  *
@@ -356,11 +364,15 @@ void db_close_events (dbEventCtx ctx)
 
     epicsMutexUnlock ( evUser->lock );
 
+    epicsMutexMustLock (stopSync);
+
     epicsEventDestroy(evUser->pexitsem);
     epicsEventDestroy(evUser->ppendsem);
     epicsEventDestroy(evUser->pflush_sem);
     epicsMutexDestroy(evUser->lock);
 
+    epicsMutexUnlock (stopSync);
+
     freeListFree(dbevEventUserFreeList, evUser);
 }
 
@@ -1043,8 +1055,15 @@ static void event_task (void *pParm)
 
     taskwdRemove(epicsThreadGetIdSelf());
 
+    /* use stopSync to ensure pexitsem is not destroy'd
+     * until epicsEventSignal() has returned.
+     */
+    epicsMutexMustLock (stopSync);
+
     epicsEventSignal(evUser->pexitsem);
 
+    epicsMutexUnlock(stopSync);
+
     return;
 }