Re: ASan reports use-after-free when running munmap-pthread

[Richard Henderson]

On 2/3/23 07:34, Richard Henderson wrote:
> On 2/3/23 01:23, Alex Bennée wrote:
> > Anton Johansson <anjo@rev.ng> writes:
> >
> > > Hi,
> > >
> > > I was running check-tcg with ASan enabled on master, and ran into
> > > the following use-after-free. There appears to be a race between
> > > jump cache invalidation and thread destruction (?)
> > >
> > > I thought I'd post here since I noticed some previous discussion on the
> > > topic, and I'm not sure myself what a proper fix would look like.
> >
> > Something like:
> >
> > modified   accel/tcg/tb-maint.c
> > @@ -858,9 +858,7 @@ static void tb_jmp_cache_inval_tb(TranslationBlock *tb)
> >           CPU_FOREACH(cpu) {
> >               CPUJumpCache *jc = cpu->tb_jmp_cache;
> > -            if (qatomic_read(&jc->array[h].tb) == tb) {
> > -                qatomic_set(&jc->array[h].tb, NULL);
> > -            }
> > +            qatomic_cmpxchg(&jc->array[h].tb, tb, NULL);
> >           }
> >       }
>
> No, this doesn't affect the use-after-free of jc itself.
> I think CPUJumpCache needs to be freed with RCU.

Bah, we already do that.


r~