all messages for Emacs-related lists mirrored at yhetil.org
 help / color / mirror / code / Atom feed
From: "Gerd Möllmann" <gerd.moellmann@gmail.com>
To: Eli Zaretskii <eliz@gnu.org>
Cc: 56108@debbugs.gnu.org
Subject: bug#56108: 29.0.50; ASAN use-after-free in re_match_2_internal
Date: Wed, 22 Jun 2022 16:10:23 +0200	[thread overview]
Message-ID: <6e56407a-b564-4aa9-b74c-78883727ef09@Spark> (raw)
In-Reply-To: <83a6a4kec0.fsf@gnu.org>

[-- Attachment #1: Type: text/plain, Size: 2330 bytes --]

On 22. Jun 2022, 15:39 +0200, Eli Zaretskii <eliz@gnu.org>, wrote:
> > Date: Wed, 22 Jun 2022 10:13:08 +0200
> > From: Gerd Möllmann <gerd.moellmann@gmail.com>
> > Cc: 56108@debbugs.gnu.org
> >
> > On 20. Jun 2022, 21:10 +0200, Eli Zaretskii <eliz@gnu.org>, wrote:
> >
> > I don't understand why some callers of compile_pattern mark the cache
> > entry as busy, but some others don't. If a cache entry that is in use
> > is not marked as busy, then any GC can decide to shrink the cache by
> > freeing that entry.
> >
> > struct re_pattern_buffer *bufp;
> > ...
> > bufp = &compile_pattern (regexp,
> > ...
> >
> > The address operator is there to confuse the Russians.
> >
> > Hmm... did you mean by that to explain why some callers of
> > compile_pattern don't mark the new cache entry as "busy"? Because if
> > so, I guess I'm one of the "confused Russians", as I don't understand
> > the explanation. Please elaborate.
> >
Sorry, looking at this again, I'm now also completely confused.

I see, all in search.c:

	static struct regexp_cache *
	compile_pattern (Lisp_Object pattern, struct re_registers *regp,

and then, later

	struct re_pattern_buffer *bufp;
	bufp = &compile_pattern

How the heck does this compile?
> >
> > Or maybe _I_ should elaborate. By "marking an entry busy" I meant the
> > call to freeze_pattern,
Yes, I've seen that.
> > not a call to freeze_buffer_relocation (the
> > latter is mostly a no-op nowadays, as almost all the supported
> > platforms don't use ralloc.c). So it isn't the C pointer we keep
> > around to compile_pattern's result that bothered me, it's the fact
> > that the pattern cache entry created by compile_pattern is not
> > protected from being freed by shrink_regexp_cache that is called by
> > GC. AFAIU, that entry must be protected for the whole time the
> > compiled pattern is in use by re_match_2 or any of its callers.
> >
> > Does the above make sense?

Yes, it's the same I see.

Functions fast_string_match_internal* don't freeze in the sense you explained.  What I don't see so far is what could lead to a GC in these cases, between the compile_pattern and the use of its result...

Did you find other places where there's no freeze?
Can Emacs GC while handling a signal?
Does Emacs use threads nowadays?

[-- Attachment #2: Type: text/html, Size: 3913 bytes --]

  reply	other threads:[~2022-06-22 14:10 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-06-20 14:07 bug#56108: 29.0.50; ASAN use-after-free in re_match_2_internal Gerd Möllmann
2022-06-20 19:09 ` Eli Zaretskii
2022-06-22  8:13   ` Gerd Möllmann
2022-06-22 13:38     ` Eli Zaretskii
2022-06-22 14:10       ` Gerd Möllmann [this message]
2022-06-22 14:24         ` Eli Zaretskii
2022-06-22 15:11           ` Gerd Möllmann
2022-06-22 16:19             ` Eli Zaretskii
2022-06-23  5:53               ` Gerd Möllmann
2022-06-23  6:57                 ` Eli Zaretskii
2022-06-23  7:17                   ` Eli Zaretskii
2022-06-23 21:29                     ` Stefan Monnier via Bug reports for GNU Emacs, the Swiss army knife of text editors
2022-06-24  5:55                       ` Eli Zaretskii
2022-06-24  6:01                         ` Gerd Möllmann
2022-06-24  9:35                           ` Gerd Möllmann
2022-06-24 15:40                             ` Eli Zaretskii
2022-06-25  9:18                               ` Eli Zaretskii
2022-06-27 13:26                             ` Eli Zaretskii
2022-06-27 13:29                               ` Gerd Möllmann
2022-06-23  8:24                   ` Gerd Möllmann
2022-06-23  8:37                     ` Eli Zaretskii
2022-06-23  8:49                       ` Gerd Möllmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=6e56407a-b564-4aa9-b74c-78883727ef09@Spark \
    --to=gerd.moellmann@gmail.com \
    --cc=56108@debbugs.gnu.org \
    --cc=eliz@gnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
Code repositories for project(s) associated with this external index

	https://git.savannah.gnu.org/cgit/emacs.git
	https://git.savannah.gnu.org/cgit/emacs/org-mode.git

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.