utun2

859 Commits

15 Branches

2 Tags

185 MiB

Tree: 5ca0bbf9e7

Commit Graph

Author	SHA1	Message	Date
Evgeny	f06ebd2ab4	fix: protect fd 0 from close in socket_close_wrapper + dup2 reserve in tests - socket_close_wrapper: never close sock==0 (prevents fd 0 reuse cycle) - test_uasync_socket_race: dup2-based fd 0 reservation, pass 800/800 - tcp_io: SOCKET_INVALID before on_error (previous commit) - Plus earlier fixes: uasync gen counter, ll_queue call_soon_id, pkt_normalizer Result: test_uasync_socket_race PASSES, 50/51 tests pass	3 months ago
Evgeny	a97a38d867	fix: set tc->sock=SOCKET_INVALID before on_error in handle_error В одном epoll_wait batch три события для fd: EPOLLERR (освобождает tc), EPOLLIN (read_cb), EPOLLOUT (write_cb). read_cb/write_cb guard проверяет tc->sock==SOCKET_INVALID, но sock обнулялся ПОСЛЕ on_error. Перенос sock=SOCKET_INVALID до on_error защищает от use-after-free. Доказано: без фикса segfault на tcp_io.c:374 (write_cb → tc->connected). С фиксом тест работает без крашей.	3 months ago
Evgeny	ccdbab95a8	fix: use-after-free in pkt_normalizer + ll_queue waiter cancel + uasync gen counter for epoll fd-reuse - pkt_normalizer: save recvpart->len before queue_data_put (may free synchronously) - ll_queue: save uasync_call_soon handle in queue_waiter_handle, cancel on free - uasync: generation counter in epoll data.u64 to skip stale events after fd reuse - uasync: keep fd_to_index mapping after socket_array_remove for inactive nodes - test: test_uasync_socket_race — 4 children × 200 iterations, currently flaky	3 months ago

Author

SHA1

Message

Date

Evgeny

f06ebd2ab4

fix: protect fd 0 from close in socket_close_wrapper + dup2 reserve in tests

- socket_close_wrapper: never close sock==0 (prevents fd 0 reuse cycle)
- test_uasync_socket_race: dup2-based fd 0 reservation, pass 800/800
- tcp_io: SOCKET_INVALID before on_error (previous commit)
- Plus earlier fixes: uasync gen counter, ll_queue call_soon_id, pkt_normalizer

Result: test_uasync_socket_race PASSES, 50/51 tests pass

3 months ago

Evgeny

a97a38d867

fix: set tc->sock=SOCKET_INVALID before on_error in handle_error

В одном epoll_wait batch три события для fd: EPOLLERR (освобождает tc),
EPOLLIN (read_cb), EPOLLOUT (write_cb). read_cb/write_cb guard проверяет
tc->sock==SOCKET_INVALID, но sock обнулялся ПОСЛЕ on_error.
Перенос sock=SOCKET_INVALID до on_error защищает от use-after-free.

Доказано: без фикса segfault на tcp_io.c:374 (write_cb → tc->connected).
С фиксом тест работает без крашей.

3 months ago

Evgeny

ccdbab95a8

fix: use-after-free in pkt_normalizer + ll_queue waiter cancel + uasync gen counter for epoll fd-reuse

- pkt_normalizer: save recvpart->len before queue_data_put (may free synchronously)
- ll_queue: save uasync_call_soon handle in queue_waiter_handle, cancel on free
- uasync: generation counter in epoll data.u64 to skip stale events after fd reuse
- uasync: keep fd_to_index mapping after socket_array_remove for inactive nodes
- test: test_uasync_socket_race — 4 children × 200 iterations, currently flaky

3 months ago

3 Commits (5ca0bbf9e75dd6949281ec0d8ddbde772c9e1192)