utun2

844 Commits

15 Branches

2 Tags

169 MiB

Tree: a97a38d867

Commit Graph

Author	SHA1	Message	Date
Evgeny	a97a38d867	fix: set tc->sock=SOCKET_INVALID before on_error in handle_error В одном epoll_wait batch три события для fd: EPOLLERR (освобождает tc), EPOLLIN (read_cb), EPOLLOUT (write_cb). read_cb/write_cb guard проверяет tc->sock==SOCKET_INVALID, но sock обнулялся ПОСЛЕ on_error. Перенос sock=SOCKET_INVALID до on_error защищает от use-after-free. Доказано: без фикса segfault на tcp_io.c:374 (write_cb → tc->connected). С фиксом тест работает без крашей.	3 months ago
Evgeny	ccdbab95a8	fix: use-after-free in pkt_normalizer + ll_queue waiter cancel + uasync gen counter for epoll fd-reuse - pkt_normalizer: save recvpart->len before queue_data_put (may free synchronously) - ll_queue: save uasync_call_soon handle in queue_waiter_handle, cancel on free - uasync: generation counter in epoll data.u64 to skip stale events after fd reuse - uasync: keep fd_to_index mapping after socket_array_remove for inactive nodes - test: test_uasync_socket_race — 4 children × 200 iterations, currently flaky	3 months ago

Author

SHA1

Message

Date

Evgeny

a97a38d867

fix: set tc->sock=SOCKET_INVALID before on_error in handle_error

В одном epoll_wait batch три события для fd: EPOLLERR (освобождает tc),
EPOLLIN (read_cb), EPOLLOUT (write_cb). read_cb/write_cb guard проверяет
tc->sock==SOCKET_INVALID, но sock обнулялся ПОСЛЕ on_error.
Перенос sock=SOCKET_INVALID до on_error защищает от use-after-free.

Доказано: без фикса segfault на tcp_io.c:374 (write_cb → tc->connected).
С фиксом тест работает без крашей.

3 months ago

Evgeny

ccdbab95a8

fix: use-after-free in pkt_normalizer + ll_queue waiter cancel + uasync gen counter for epoll fd-reuse

- pkt_normalizer: save recvpart->len before queue_data_put (may free synchronously)
- ll_queue: save uasync_call_soon handle in queue_waiter_handle, cancel on free
- uasync: generation counter in epoll data.u64 to skip stale events after fd reuse
- uasync: keep fd_to_index mapping after socket_array_remove for inactive nodes
- test: test_uasync_socket_race — 4 children × 200 iterations, currently flaky

3 months ago

2 Commits (a97a38d867d273d55a8251b5cfd7ef2cceff2937)