-
-
Notifications
You must be signed in to change notification settings - Fork 14.7k
newrt select() implementation vulnerable to scheduler/task environment race #8347
Copy link
Copy link
Closed
Labels
A-concurrencyArea: ConcurrencyArea: ConcurrencyA-runtimeArea: std's runtime and "pre-main" init for handling backtraces, unwinds, stack overflowsArea: std's runtime and "pre-main" init for handling backtraces, unwinds, stack overflowsI-crashIssue: The compiler crashes (SIGSEGV, SIGABRT, etc). Use I-ICE instead when the compiler panics.Issue: The compiler crashes (SIGSEGV, SIGABRT, etc). Use I-ICE instead when the compiler panics.
Metadata
Metadata
Assignees
Labels
A-concurrencyArea: ConcurrencyArea: ConcurrencyA-runtimeArea: std's runtime and "pre-main" init for handling backtraces, unwinds, stack overflowsArea: std's runtime and "pre-main" init for handling backtraces, unwinds, stack overflowsI-crashIssue: The compiler crashes (SIGSEGV, SIGABRT, etc). Use I-ICE instead when the compiler panics.Issue: The compiler crashes (SIGSEGV, SIGABRT, etc). Use I-ICE instead when the compiler panics.
Type
Fields
Give feedbackNo fields configured for issues without a type.
As outlined in #8132.
In this case the race is around ready_index. Here is the closure:
Since we are letting any one of the ports wake the task, the access of
ready_indexhas the potential to clobber arbitrary values on the task's stack.This can't be fixed just by reordering accesses, since this is in a loop, the select implementation needs to be able to write to ready_index after storing the task handle in previous ports.