Skip to content

Fix UAF in InputGate::Waiter#232

Merged
harrishancock merged 1 commit intomainfrom
harris/fix-uaf-in-input-gate-waiter
Dec 20, 2022
Merged

Fix UAF in InputGate::Waiter#232
harrishancock merged 1 commit intomainfrom
harris/fix-uaf-in-input-gate-waiter

Conversation

@harrishancock
Copy link
Collaborator

When a critical section completes with leftover waiters, they are reparented such that the waiters are now waiting on the parent scope. Before this commit, this did not correctly update the gate reference in the waiter.

This commit also fixes 2 other reparenting bugs, and adds additional test coverage for reparenting:

  • Ensures that reparenting works with multiple layers of nested critical sections, by skipping already reparented critical sections in the family hierarchy.
  • Fixes bug when reparenting waiters for nested critical sections, where they were being removed from the incorrect list.

(@xortive wrote this commit, and the above text.)

When a critical section completes with leftover waiters, they are reparented
such that the waiters are now waiting on the parent scope. Before this commit,
this did not correctly update the `gate` reference in the waiter.

This commit also fixes 2 other reparenting bugs, and adds additional
test coverage for reparenting:
* Ensures that reparenting works with multiple layers of
nested critical sections, by skipping already reparented critical
sections in the family hierarchy.
* Fixes bug when reparenting waiters for nested critical sections, where
they were being removed from the incorrect list.
@harrishancock harrishancock merged commit 489bb49 into main Dec 20, 2022
@harrishancock harrishancock deleted the harris/fix-uaf-in-input-gate-waiter branch December 20, 2022 21:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants