ruby-core@ruby-lang.org archive (unofficial mirror)
 help / color / mirror / Atom feed
* [ruby-core:120223] [Ruby master Bug#20950] Use-after-free in ep in Proc#dup for ifunc procs
@ 2024-12-12 19:14 peterzhu2118 (Peter Zhu) via ruby-core
  2024-12-22  2:34 ` [ruby-core:120362] " nagachika (Tomoyuki Chikanaga) via ruby-core
  2025-01-15  1:55 ` [ruby-core:120687] " k0kubun (Takashi Kokubun) via ruby-core
  0 siblings, 2 replies; 3+ messages in thread
From: peterzhu2118 (Peter Zhu) via ruby-core @ 2024-12-12 19:14 UTC (permalink / raw)
  To: ruby-core; +Cc: peterzhu2118 (Peter Zhu)

Issue #20950 has been reported by peterzhu2118 (Peter Zhu).

----------------------------------------
Bug #20950: Use-after-free in ep in Proc#dup for ifunc procs
https://bugs.ruby-lang.org/issues/20950

* Author: peterzhu2118 (Peter Zhu)
* Status: Open
* Backport: 3.1: WONTFIX, 3.2: REQUIRED, 3.3: REQUIRED
----------------------------------------
GitHub PR: https://github.com/ruby/ruby/pull/12319

ifunc proc has the ep allocated in the data of the TypedData object. If an ifunc proc is duplicated, the ep points to the ep of the source object. If the source object is freed, then the ep of the duplicated object now points to a freed memory region. If we try to use the ep we could crash.

For example, the following script crashes:

```ruby
p = { a: 1 }.to_proc
100.times do
  p = p.dup
  GC.start
  p.call
rescue ArgumentError
end
```

This commit changes ifunc proc to also duplicate the ep when it is duplicated.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/

^ permalink raw reply	[flat|nested] 3+ messages in thread

* [ruby-core:120362] [Ruby master Bug#20950] Use-after-free in ep in Proc#dup for ifunc procs
  2024-12-12 19:14 [ruby-core:120223] [Ruby master Bug#20950] Use-after-free in ep in Proc#dup for ifunc procs peterzhu2118 (Peter Zhu) via ruby-core
@ 2024-12-22  2:34 ` nagachika (Tomoyuki Chikanaga) via ruby-core
  2025-01-15  1:55 ` [ruby-core:120687] " k0kubun (Takashi Kokubun) via ruby-core
  1 sibling, 0 replies; 3+ messages in thread
From: nagachika (Tomoyuki Chikanaga) via ruby-core @ 2024-12-22  2:34 UTC (permalink / raw)
  To: ruby-core; +Cc: nagachika (Tomoyuki Chikanaga)

Issue #20950 has been updated by nagachika (Tomoyuki Chikanaga).


Backporting only 92dd9734a967c20e628c8f77c5ce700058dcd58c into ruby_3_2 causes a VM_ASSERT() failure in vm_ep_in_heap_p_().
I believe there are additional changesets that should be backported beforehand.
Any suggestions would be greatly appreciated.

----------------------------------------
Bug #20950: Use-after-free in ep in Proc#dup for ifunc procs
https://bugs.ruby-lang.org/issues/20950#change-111140

* Author: peterzhu2118 (Peter Zhu)
* Status: Closed
* Backport: 3.1: WONTFIX, 3.2: REQUIRED, 3.3: REQUIRED
----------------------------------------
GitHub PR: https://github.com/ruby/ruby/pull/12319

ifunc proc has the ep allocated in the data of the TypedData object. If an ifunc proc is duplicated, the ep points to the ep of the source object. If the source object is freed, then the ep of the duplicated object now points to a freed memory region. If we try to use the ep we could crash.

For example, the following script crashes:

```ruby
p = { a: 1 }.to_proc
100.times do
  p = p.dup
  GC.start
  p.call
rescue ArgumentError
end
```

This commit changes ifunc proc to also duplicate the ep when it is duplicated.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/

^ permalink raw reply	[flat|nested] 3+ messages in thread

* [ruby-core:120687] [Ruby master Bug#20950] Use-after-free in ep in Proc#dup for ifunc procs
  2024-12-12 19:14 [ruby-core:120223] [Ruby master Bug#20950] Use-after-free in ep in Proc#dup for ifunc procs peterzhu2118 (Peter Zhu) via ruby-core
  2024-12-22  2:34 ` [ruby-core:120362] " nagachika (Tomoyuki Chikanaga) via ruby-core
@ 2025-01-15  1:55 ` k0kubun (Takashi Kokubun) via ruby-core
  1 sibling, 0 replies; 3+ messages in thread
From: k0kubun (Takashi Kokubun) via ruby-core @ 2025-01-15  1:55 UTC (permalink / raw)
  To: ruby-core; +Cc: k0kubun (Takashi Kokubun)

Issue #20950 has been updated by k0kubun (Takashi Kokubun).

Backport changed from 3.1: WONTFIX, 3.2: REQUIRED, 3.3: REQUIRED to 3.1: WONTFIX, 3.2: REQUIRED, 3.3: DONE

ruby_3_3 commit:299455be9966c0a31dabe00014a4b8fae5093a7d merged revision(s) commit:92dd9734a967c20e628c8f77c5ce700058dcd58c.

----------------------------------------
Bug #20950: Use-after-free in ep in Proc#dup for ifunc procs
https://bugs.ruby-lang.org/issues/20950#change-111510

* Author: peterzhu2118 (Peter Zhu)
* Status: Closed
* Backport: 3.1: WONTFIX, 3.2: REQUIRED, 3.3: DONE
----------------------------------------
GitHub PR: https://github.com/ruby/ruby/pull/12319

ifunc proc has the ep allocated in the data of the TypedData object. If an ifunc proc is duplicated, the ep points to the ep of the source object. If the source object is freed, then the ep of the duplicated object now points to a freed memory region. If we try to use the ep we could crash.

For example, the following script crashes:

```ruby
p = { a: 1 }.to_proc
100.times do
  p = p.dup
  GC.start
  p.call
rescue ArgumentError
end
```

This commit changes ifunc proc to also duplicate the ep when it is duplicated.



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/

^ permalink raw reply	[flat|nested] 3+ messages in thread

end of thread, other threads:[~2025-01-15  1:55 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-12-12 19:14 [ruby-core:120223] [Ruby master Bug#20950] Use-after-free in ep in Proc#dup for ifunc procs peterzhu2118 (Peter Zhu) via ruby-core
2024-12-22  2:34 ` [ruby-core:120362] " nagachika (Tomoyuki Chikanaga) via ruby-core
2025-01-15  1:55 ` [ruby-core:120687] " k0kubun (Takashi Kokubun) via ruby-core

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).