fix(ffi): don't steal Arc in dc_jsonrpc_init#7961
Closed
d2weber wants to merge 1 commit intochatmail:mainfrom
Closed
fix(ffi): don't steal Arc in dc_jsonrpc_init#7961d2weber wants to merge 1 commit intochatmail:mainfrom
d2weber wants to merge 1 commit intochatmail:mainfrom
Conversation
dc_jsonrpc_init called Arc::from_raw on the account_manager pointer, which took ownership of the caller's refcount. When the local Arc dropped at the end of the function, the refcount was decremented, leaving the C side's pointer with a stolen refcount. This caused a use-after-free race between dc_accounts_unref and dc_jsonrpc_unref at shutdown. Wrap in ManuallyDrop to prevent the implicit drop, keeping the caller's refcount intact. Regression introduced in chatmail#7662.
Collaborator
Author
|
Replaced with #7962 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dc_jsonrpc_init called Arc::from_raw on the account_manager pointer, which took ownership of the caller's refcount. When the local Arc dropped at the end of the function, the refcount was decremented, leaving the C side's pointer with a stolen refcount. This caused a use-after-free race between dc_accounts_unref and dc_jsonrpc_unref at shutdown.
Wrap in ManuallyDrop to prevent the implicit drop, keeping the caller's refcount intact.
Regression introduced in #7662.
We encountered this issue in deltatouch. It manifests as a double free and thus a sporadic SIGABRT when shutting down the app, caused by malloc which complains: "corrupted double-linked list"
For reference, here the backtrace when deltatouch crashes after the double free.
Valgrind reports the double free from `dc_accounts_unref` and `dc_jsonrpc_unref`