You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@nuttx.apache.org by GitBox <gi...@apache.org> on 2023/01/10 10:09:18 UTC
[GitHub] [nuttx] anchao opened a new pull request, #8066: sched/group: fix task info heap-use-after-free
anchao opened a new pull request, #8066:
URL: https://github.com/apache/nuttx/pull/8066
## Summary
sched/group: fix task info heap-use-after-free
tg_info is still in use after task_uninit_info() unifies lib_stream_* with life cycle of task info to avoid this issue.
```
=================================================================
==1940861==ERROR: AddressSanitizer: heap-use-after-free on address 0xf47032e0 at pc 0x5676dc4f bp 0xf2f38c68 sp 0xf2f38c58
READ of size 2 at 0xf47032e0 thread T0
|#10 0xf7abec89 in __asan::__asan_report_load2 (addr=4100993760) at ../../../../src/libsanitizer/asan/asan_rtl.cpp:119
|#11 0x5677356a in nxsem_destroy (sem=0xf47032e0) at semaphore/sem_destroy.c:73
|#12 0x56773695 in sem_destroy (sem=0xf47032e0) at semaphore/sem_destroy.c:120
|#13 0x5676faa2 in nxmutex_destroy (mutex=0xf47032e0) at include/nuttx/mutex.h:126
|#14 0x567a3430 in lib_stream_release (group=0xf4901ba0) at stdio/lib_libstream.c:98
|#15 0x5676da75 in group_release (group=0xf4901ba0) at group/group_leave.c:162
|#16 0x5676e51c in group_leave (tcb=0xf5377740) at group/group_leave.c:360
|#17 0x569fe79b in nxtask_exithook (tcb=0xf5377740, status=0) at task/task_exithook.c:455
|#18 0x569f90b9 in _exit (status=0) at task/exit.c:82
|#19 0x56742680 in exit (status=0) at stdlib/lib_exit.c:61
|#20 0x56a69c78 in iperf_showusage (progname=0xf2f28838 "iperf", exitcode=0) at iperf_main.c:91
|#21 0x56a6a6ec in iperf_main (argc=1, argv=0xf2f28830) at iperf_main.c:140
|#22 0x5679c148 in nxtask_startup (entrypt=0x56a69c78 <iperf_main>, argc=1, argv=0xf2f28830) at sched/task_startup.c:70
|#23 0x56767f58 in nxtask_start () at task/task_start.c:134
```
Signed-off-by: chao an <an...@xiaomi.com>
## Impact
N/A
## Testing
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nuttx] pussuw commented on a diff in pull request #8066: sched/group: fix task info heap-use-after-free
Posted by GitBox <gi...@apache.org>.
pussuw commented on code in PR #8066:
URL: https://github.com/apache/nuttx/pull/8066#discussion_r1065595100
##########
sched/group/group_leave.c:
##########
@@ -156,12 +155,6 @@ static inline void group_release(FAR struct task_group_s *group)
pthread_release(group);
#endif
-#ifdef CONFIG_FILE_STREAM
- /* Free resource held by the stream list */
-
- lib_stream_release(group);
Review Comment:
Would it not suffice to just move this before line 140?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nuttx] xiaoxiang781216 merged pull request #8066: sched/group: fix task info heap-use-after-free
Posted by GitBox <gi...@apache.org>.
xiaoxiang781216 merged PR #8066:
URL: https://github.com/apache/nuttx/pull/8066
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nuttx] pussuw commented on a diff in pull request #8066: sched/group: fix task info heap-use-after-free
Posted by GitBox <gi...@apache.org>.
pussuw commented on code in PR #8066:
URL: https://github.com/apache/nuttx/pull/8066#discussion_r1065622597
##########
sched/group/group_leave.c:
##########
@@ -156,12 +155,6 @@ static inline void group_release(FAR struct task_group_s *group)
pthread_release(group);
#endif
-#ifdef CONFIG_FILE_STREAM
- /* Free resource held by the stream list */
-
- lib_stream_release(group);
Review Comment:
Yes I agree it makes the current code easier to follow and less prone to mistakes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
[GitHub] [nuttx] anchao commented on a diff in pull request #8066: sched/group: fix task info heap-use-after-free
Posted by GitBox <gi...@apache.org>.
anchao commented on code in PR #8066:
URL: https://github.com/apache/nuttx/pull/8066#discussion_r1065604589
##########
sched/group/group_leave.c:
##########
@@ -156,12 +155,6 @@ static inline void group_release(FAR struct task_group_s *group)
pthread_release(group);
#endif
-#ifdef CONFIG_FILE_STREAM
- /* Free resource held by the stream list */
-
- lib_stream_release(group);
Review Comment:
The life cycle of tg_info is related to task_init_info()/task_uninit_info(), merging them together is easier to understand and avoid such issue in the future
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@nuttx.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org