From: "ioquatix (Samuel Williams) via ruby-core" <ruby-core@...>
Date: 2026-09-14T02:07:19+00:00
Subject: [ruby-core:126683] [Ruby Bug#22298] IO::Buffer is left unfreed with an invalid pointer when fiber scheduler raises

Issue #22298 has been updated by ioquatix (Samuel Williams).

Status changed from Open to Closed
Backport deleted (3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN)

Fixed in <https://github.com/ruby/ruby/commit/ae5a02b056ebb3040daf47d04e0ba3cafa5d2748>.

----------------------------------------
Bug #22298: IO::Buffer is left unfreed with an invalid pointer when fiber scheduler raises
https://bugs.ruby-lang.org/issues/22298#change-118978

* Author: hanazuki (Kasumi Hanazuki)
* Status: Closed
* ruby -v: ruby 4.1.0dev (2026-09-06T12:40:34Z master e536482403) +PRISM [x86_64-linux]
----------------------------------------
When an installed Fiber scheduler raises from its I/O hook, the temporary IO::Buffer passed to the hook is left unfreed. The buffer may then outlive the memory it wraps, so accessing it afterward can cause undefined behavior.

This only happens when the buffer escapes from the I/O callback, which is supposed to be a bug in the scheduler, but I think it is worth fixing silent memory corruption.

```ruby
class Scheduler
  def block(*) = Fiber.yield
  def unblock(*) = nil
  def kernel_sleep(*) = nil
  def io_wait(*) = 0
  def fiber_interrupt(*) = nil

  def fiber(&block)
    Fiber.new(blocking: false, &block).tap(&:transfer)
  end

  def io_write(io, buffer, offset, length)
    $escape = buffer  # This buffer wraps a borrowed temporary memory
    fail
  end
end

r, w = IO.pipe

Fiber.set_scheduler(Scheduler.new)
Fiber.schedule { w.write('hello') } rescue nil

GC.start

p $escape  # .inspect will read freed memory
```




-- 
https://bugs.ruby-lang.org/
______________________________________________
 ruby-core mailing list -- ruby-core@ml.ruby-lang.org
 To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org
 ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/