From bae235cd5fdfd10f63308e70eff8e689449e040b Mon Sep 17 00:00:00 2001
From: Craig Tiller <ctiller@google.com>
Date: Mon, 5 Oct 2015 11:33:36 -0700
Subject: [PATCH] Fix use-after-free

---
 src/core/iomgr/pollset_posix.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/core/iomgr/pollset_posix.c b/src/core/iomgr/pollset_posix.c
index 90428274843..b663780a02a 100644
--- a/src/core/iomgr/pollset_posix.c
+++ b/src/core/iomgr/pollset_posix.c
@@ -477,6 +477,7 @@ static void basic_pollset_maybe_work_and_unlock(grpc_exec_ctx *exec_ctx,
   if (fd) {
     pfd[2].fd = fd->fd;
     pfd[2].revents = 0;
+    GRPC_FD_REF(fd, "basicpoll_begin");
     gpr_mu_unlock(&pollset->mu);
     pfd[2].events =
         (short)grpc_fd_begin_poll(fd, pollset, POLLIN, POLLOUT, &fd_watcher);
@@ -523,6 +524,10 @@ static void basic_pollset_maybe_work_and_unlock(grpc_exec_ctx *exec_ctx,
       }
     }
   }
+
+  if (fd) {
+    GRPC_FD_UNREF(fd, "basicpoll_begin");
+  }
 }
 
 static void basic_pollset_destroy(grpc_pollset *pollset) {