[Tarantool-patches] [PATCH] Memtx_tuple_delete used heap after free
Alexander Turenko
alexander.turenko at tarantool.org
Wed Jan 15 01:14:00 MSK 2020
On Mon, Jan 13, 2020 at 07:45:48PM +0300, Cyrill Gorcunov wrote:
> On Fri, Dec 06, 2019 at 02:29:25PM +0300, Maria Khaydich wrote:
> > Overlooked a better solution as @PersDep kindly suggested. Sending the
> > fixed version.
> >
> > Subject: [PATCH] Memtx_tuple_delete used heap after free
> > Struct of type tuple_format is being passed as
> > an argument to tuple_format_unref where it might
> > be freed. On such occasion any further references
> > to format fields should not take place.
> >
> > Closes #4658
> > ---
> > Issue:
> > https://github.com/tarantool/tarantool/issues/4658
> > Branch:
> > https://github.com/tarantool/tarantool/compare/eljashm/gh-4658-heap-use-after-free
> >
> > src/box/memtx_engine.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/src/box/memtx_engine.c b/src/box/memtx_engine.c
> > index 23ccc4703..4da80824a 100644
> > --- a/src/box/memtx_engine.c
> > +++ b/src/box/memtx_engine.c
> > @@ -1177,7 +1177,6 @@ memtx_tuple_delete(struct tuple_format *format,
> > struct tuple *tuple)
> > struct memtx_engine *memtx = (struct memtx_engine *)format->engine;
> > say_debug("%s(%p)", __func__, tuple);
> > assert(tuple->refs == 0);
> > - tuple_format_unref(format);
> > struct memtx_tuple *memtx_tuple =
> > container_of(tuple, struct memtx_tuple, base);
> > size_t total = tuple_size(tuple) + offsetof(struct memtx_tuple,
> > base);
> > @@ -1187,6 +1186,7 @@ memtx_tuple_delete(struct tuple_format *format,
> > struct tuple *tuple)
> > smfree(&memtx->alloc, memtx_tuple, total);
> > else
> > smfree_delayed(&memtx->alloc, memtx_tuple, total);
> > + tuple_format_unref(format);
> > }
>
> So we basically defer unref.
> Reviewed-by: Cyrill Gorcunov <gorcunov at gmail.com>
LGTM too (it was already pushed to the master, but I looked anyway).
>
> FWIW the use after free introduced by the commit f9299c43d4fcc918a98c45563a5f96bb13863337
Added to the issue just in case.
WBR, Alexander Turenko.
More information about the Tarantool-patches
mailing list