Skip to content

Schedule function holds a reference to RawTask #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
3 commits merged into from
Dec 31, 2019
Merged

Schedule function holds a reference to RawTask #12

3 commits merged into from
Dec 31, 2019

Conversation

ghost
Copy link

@ghost ghost commented Dec 26, 2019

Fixes #11

tests/basic.rs Outdated
move |task| {
println!("{:?}", s);
drop(task);
println!("{:?}", s);
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How are you making sure that this test doesn't actually pass when the UAF isn't actually catched here by some random segfault or something like that? (For example on macOS that test passes easily even with the UAF-present, the output is simply wrong).

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would suggest something like this:

use std::sync::atomic::{AtomicBool, Ordering};

fn test() {
    struct DropGuard(AtomicBool);
    impl Drop for DropGuard {
        fn drop(&mut self) {
            self.0.store(false, Ordering::SeqCst);
        }
    }
    let s = DropGuard(AtomicBool::new(true));

    let (task, _) = async_task::spawn(
        async {},
        move |task| {
            assert_eq!(s.0.load(Ordering::SeqCst), true);
            drop(task);
            assert_eq!(s.0.load(Ordering::SeqCst), true);
        },
        (),
    );
    task.schedule();
}

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The UAF is caught by valgrind (it is used in CI), and I checked to make sure.

That said, your version is more robust so I'll try that instead.

@ghost ghost merged commit 45a2c1f into master Dec 31, 2019
@ghost ghost deleted the refcnt-schedule branch December 31, 2019 00:39
This pull request was closed.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Memory holding schedule function might be freed during its invocation
1 participant