[ruby-core:122735] [Ruby Bug#21511] Use-after-free of the execution context after the fiber object carrying it is freed in GC
From:
"nobu (Nobuyoshi Nakada) via ruby-core" <ruby-core@...>
Date:
2025-07-14 06:56:45 UTC
List:
ruby-core #122735
Issue #21511 has been updated by nobu (Nobuyoshi Nakada).
Status changed from Open to Feedback
I can't reproduce it with ruby_3_4 (commit:1e3d24a0f47) on aarch64-linux.
What version is commit:de8de51182?
----------------------------------------
Bug #21511: Use-after-free of the execution context after the fiber object carrying it is freed in GC
https://bugs.ruby-lang.org/issues/21511#change-114016
* Author: tuonigou (tianyang sun)
* Status: Feedback
* ruby -v: ruby 3.4.1 (2025-06-13 revision de8de51182) +PRISM [x86_64-linux]
* Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN
----------------------------------------
In bootstraptest/test_thread.rb,
``` ruby
assert_equal 'ok', %{
File.write("zzz_t1.rb", <<-END)
begin
Thread.new { fork { GC.start } }.join
pid, status = Process.wait2
$result = status.success? ? :ok : :ng
rescue NotImplementedError
$result = :ok
end
END
require "./zzz_t1.rb"
$result
}
```
``` shell
# in build/
make btest BTESTS="file_containing_above.rb"
# or
ruby --disable=gems "../bootstraptest/runner.rb" --ruby="./miniruby -I../lib -I. -I.ext/common -r./x86_64-linux-fake --disable-gems" file_containing_above.rb
```
Suppose **thread 1** called the `Thread.new` and created **thread 2**
The forked process by thread 2 that initiates GC with `GC.start` would sweep the fiber object embedded in `RTypedData` in the `gc_sweep_rest()` stage of sweep in `fiber_free()`. That fiber object contains the execution context of thread 1, `rb_execution_context_t saved_ec` field of `cont`.
Since the fiber object is freed, the allocated area pointed by it should be invalid, including the embedded struct for ec, but after thread 2 joins, thread 1 still uses the ec in rb_current_thread(), causing a use after free.
--
https://bugs.ruby-lang.org/
______________________________________________
ruby-core mailing list -- ruby-core@ml.ruby-lang.org
To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/