From: Richard Henderson <richard.henderson@linaro.org>
To: anjo@rev.ng, qemu-devel@nongnu.org
Cc: "ale@rev.ng" <ale@rev.ng>,
iii@linux.ibm.com, "Alex Bennée" <alex.bennee@linaro.org>
Subject: Re: ASan reports use-after-free when running munmap-pthread
Date: Fri, 3 Feb 2023 11:18:39 -1000 [thread overview]
Message-ID: <18e96c58-b6e5-9837-9753-a263f3b15918@linaro.org> (raw)
In-Reply-To: <b7de2f25-c6a4-d053-2e27-ed8f13996182@rev.ng>
On 2/2/23 09:06, Anton Johansson wrote:
> Hi,
>
> I was running check-tcg with ASan enabled on master, and ran into
> the following use-after-free. There appears to be a race between
> jump cache invalidation and thread destruction (?)
>
> I thought I'd post here since I noticed some previous discussion on the
> topic, and I'm not sure myself what a proper fix would look like.
>
> Tested on arm/aarch64/x86_64-linux-user.
>
> Here's a snippet of the ASan output:
> =================================================================
> ==187529==ERROR: AddressSanitizer: heap-use-after-free on address 0x62d000f433b0 at pc
> 0x55cfefe00246 bp 0x7f4725f400b0 sp 0x7f4725f400a0
The fix for this was merged today:
4731f89b3b cpu: free cpu->tb_jmp_cache with RCU
I'd forgotten about this, since the pull request was pending for some time, while we
waited for CI minutes to refresh.
r~
next prev parent reply other threads:[~2023-02-03 21:18 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-02 19:06 ASan reports use-after-free when running munmap-pthread Anton Johansson via
2023-02-03 11:23 ` Alex Bennée
2023-02-03 17:34 ` Richard Henderson
2023-02-03 18:08 ` Richard Henderson
2023-02-03 21:18 ` Richard Henderson [this message]
2023-02-04 12:33 ` Anton Johansson via
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=18e96c58-b6e5-9837-9753-a263f3b15918@linaro.org \
--to=richard.henderson@linaro.org \
--cc=ale@rev.ng \
--cc=alex.bennee@linaro.org \
--cc=anjo@rev.ng \
--cc=iii@linux.ibm.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).