Project

General

Profile

Actions

Bug #21441

closed

SEGV during thread cleanup if profiler calls thread_profiles_frames at wrong time

Added by luke-gru (Luke Gruber) 13 days ago. Updated 2 days ago.

Status:
Closed
Assignee:
-
Target version:
-
[ruby-core:122548]

Description

During thread cleanup, if a ruby sampling profiler calls thread_profile_frames at just the wrong time, the ec's stack is cleared but the CFP still exists on the EC, so thread_profile_frames assumes it can walk the stack and crashes.

In rb_ec_clear_vm_stack, it should set cfp to NULL before clearing the stack. If during rc_ec_clear_vm_stack the process gets a signal and this thread handles it and calls thread_profile_frames, the early return check of if (!cfp) fails, it continues and crashes in this function.

Updated by luke-gru (Luke Gruber) 13 days ago

I opened a PR here.

This may need to be backported.

Actions #2

Updated by Anonymous 13 days ago

  • Status changed from Open to Closed

Applied in changeset git|e3ec101cc21613550ef87b7bd8432a69c7e639de.


thread_cleanup: set CFP to NULL before clearing ec's stack

We clear the CFP first so that if a sampling profiler interrupts the current thread during rb_ec_set_vm_stack,
thread_profile_frames returns early instead of trying to walk the stack that's no longer set on the ec.

The early return in thread_profile_frames was introduced at eab7f4623fb.

Fixes [Bug #21441]

Actions #3

Updated by ufuk (Ufuk Kayserilioglu) 12 days ago

  • Backport changed from 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN to 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: REQUIRED
Actions #4

Updated by nagachika (Tomoyuki Chikanaga) 2 days ago

  • Backport changed from 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: REQUIRED to 3.2: UNKNOWN, 3.3: REQUIRED, 3.4: REQUIRED

Updated by nagachika (Tomoyuki Chikanaga) 2 days ago

  • Backport changed from 3.2: UNKNOWN, 3.3: REQUIRED, 3.4: REQUIRED to 3.2: UNKNOWN, 3.3: DONE, 3.4: REQUIRED

Merged https://github.com/ruby/ruby/pull/13672 into ruby_3_3 branch.

Actions

Also available in: Atom PDF

Like0
Like0Like0Like0Like0Like0