Skip to content

Fix two use-after-free bugs regarding sockets

Yorick Peterse requested to merge socket-segv into master

This fixes two use-after-free bugs that could happen when a process was rescheduled immediately after being registered with the system poller. There were two separate bugs:

  1. Saving the instruction pointer after registering a process, which could lead to either the wrong instruction being retried, or a use-after-free bug.

  2. Setting the "registered" flag of a socket after registering it. If a process was rescheduled fast enough, it might drop the socket before the "registered" flag could be written.

Both these issues were uncovered using AddressSanitizer, but still took a few days to debug as the problem was not immediately clear. Due to the heavy use of references in the VM, we sadly can't take advantage of Rust's move semantics to guard ourselves against these problems. Some comments were added to clarify these issues, hopefully preventing them from happening again in the future.

Merge request reports