[ruby-core:122548] [Ruby Bug#21441] SEGV during thread cleanup if profiler calls thread_profiles_frames at wrong time
From:
"luke-gru (Luke Gruber) via ruby-core" <ruby-core@...>
Date:
2025-06-17 20:45:34 UTC
List:
ruby-core #122548
Issue #21441 has been reported by luke-gru (Luke Gruber). ---------------------------------------- Bug #21441: SEGV during thread cleanup if profiler calls thread_profiles_frames at wrong time https://bugs.ruby-lang.org/issues/21441 * Author: luke-gru (Luke Gruber) * Status: Open * ruby -v: 3.5.0 * Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN ---------------------------------------- During thread cleanup, if a ruby sampling profiler calls `thread_profile_frames` at just the wrong time, the ec's stack is cleared but the CFP still exists on the EC, so `thread_profile_frames` assumes it can walk the stack and crashes. In `rb_ec_clear_vm_stack`, it should set `cfp` to `NULL` before clearing the stack. If during `rc_ec_clear_vm_stack` the process gets a signal and this thread handles it and calls `thread_profile_frames`, the early return check of `if (!cfp)` fails, it continues and crashes in this function. -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/