Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pkproto.c: fix use-after-free that did cause pagekite to SIGSEGV #79

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

plan44
Copy link
Contributor

@plan44 plan44 commented Sep 16, 2024

  • occasionally, with higher probability on faster/multicore systems
  • like: never crashed in years on RPi B+, crashed 95% of all startup attempts on Rpi3 or Rpi4

…sionally, with higher probability on faster/multicore systems

- like: never crashed in years on RPi B+, crashed 95% of all startup attempts on Rpi3 or Rpi4
@plan44
Copy link
Contributor Author

plan44 commented Sep 17, 2024

Some more context:

Observation:

  • programs using libpagekitec did crash with SIGSEGV on startup on RPi3,4 while having worked fine for years on RPi1+2

Explantation:

  • the final "judgement" test were done on pointers into the copy buffer freed on line 766 instead of on the safe copies of those strings in kite and kite_r.
  • this opened a very short race condition window, however the crash was caught happening while a tight loop (pkb_start_blockers) fired up 16 of those threads in rapid succession. So probably if the next thread got to allocate memory before the "judgements" tests, accessing the just freed copy would cause a segfault.

Fix:

  • check the safe copies of the strings instead of pointers into copy.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant