From: Alexander Turenko <alexander.turenko@tarantool.org> To: Cyrill Gorcunov <gorcunov@gmail.com> Cc: tarantool-patches@dev.tarantool.org Subject: Re: [Tarantool-patches] [PATCH] Memtx_tuple_delete used heap after free Date: Wed, 15 Jan 2020 01:14:00 +0300 [thread overview] Message-ID: <20200114221359.hlbm3hj7u7c3544m@tkn_work_nb> (raw) In-Reply-To: <20200113164548.GA2451@uranus> On Mon, Jan 13, 2020 at 07:45:48PM +0300, Cyrill Gorcunov wrote: > On Fri, Dec 06, 2019 at 02:29:25PM +0300, Maria Khaydich wrote: > > Overlooked a better solution as @PersDep kindly suggested. Sending the > > fixed version. > > > > Subject: [PATCH] Memtx_tuple_delete used heap after free > > Struct of type tuple_format is being passed as > > an argument to tuple_format_unref where it might > > be freed. On such occasion any further references > > to format fields should not take place. > > > > Closes #4658 > > --- > > Issue: > > https://github.com/tarantool/tarantool/issues/4658 > > Branch: > > https://github.com/tarantool/tarantool/compare/eljashm/gh-4658-heap-use-after-free > > > > src/box/memtx_engine.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/src/box/memtx_engine.c b/src/box/memtx_engine.c > > index 23ccc4703..4da80824a 100644 > > --- a/src/box/memtx_engine.c > > +++ b/src/box/memtx_engine.c > > @@ -1177,7 +1177,6 @@ memtx_tuple_delete(struct tuple_format *format, > > struct tuple *tuple) > > struct memtx_engine *memtx = (struct memtx_engine *)format->engine; > > say_debug("%s(%p)", __func__, tuple); > > assert(tuple->refs == 0); > > - tuple_format_unref(format); > > struct memtx_tuple *memtx_tuple = > > container_of(tuple, struct memtx_tuple, base); > > size_t total = tuple_size(tuple) + offsetof(struct memtx_tuple, > > base); > > @@ -1187,6 +1186,7 @@ memtx_tuple_delete(struct tuple_format *format, > > struct tuple *tuple) > > smfree(&memtx->alloc, memtx_tuple, total); > > else > > smfree_delayed(&memtx->alloc, memtx_tuple, total); > > + tuple_format_unref(format); > > } > > So we basically defer unref. > Reviewed-by: Cyrill Gorcunov <gorcunov@gmail.com> LGTM too (it was already pushed to the master, but I looked anyway). > > FWIW the use after free introduced by the commit f9299c43d4fcc918a98c45563a5f96bb13863337 Added to the issue just in case. WBR, Alexander Turenko.
prev parent reply other threads:[~2020-01-14 22:13 UTC|newest] Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-11-29 21:39 Maria 2019-12-06 11:29 ` Maria Khaydich 2020-01-14 17:30 ` Cyrill Gorcunov 2020-01-14 20:24 ` Nikita Pettik 2020-01-14 21:21 ` Cyrill Gorcunov [not found] ` <20200113164548.GA2451@uranus> 2020-01-14 22:14 ` Alexander Turenko [this message]
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200114221359.hlbm3hj7u7c3544m@tkn_work_nb \ --to=alexander.turenko@tarantool.org \ --cc=gorcunov@gmail.com \ --cc=tarantool-patches@dev.tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH] Memtx_tuple_delete used heap after free' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox