Bug #21883: IO::Buffer can be unlocked and freed by another thread during syscall

• Status: Assigned
• Assignee: ioquatix (Samuel Williams)
• Target version: -
• ruby -v: ruby 4.0.1 (2026-01-13 revision e04267a14b) +PRISM [x86_64-linux]
• Backport: 3.2: UNKNOWN, 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[hanazuki (Kasumi Hanazuki)]

# Assume this file is on a very slow device such as NFS.
io = File.open('/mnt/slowfs/slow')

buf = IO::Buffer.new(100)

t1 = Thread.new do
  buf.locked do
    sleep 0.5
  end

  buf.free
end

t2 = Thread.new do
  buf.read(io)  # syscall takes 1 second
  # When the kernal writes to the memory, buf is already freed, thus use-after-free
end

t1.join
t2.join

io_buffer_blocking_region skips taking a lock when the buffer is already locked, but this lock may be owned by another thread and can be unlocked during the syscall.

[mame (Yusuke Endoh)]

• Status changed from Open to Assigned
• Assignee set to ioquatix (Samuel Williams)

[kou (Kouhei Sutou)]

The IO::Buffer#locked document says that it's not thread safe explicitly.

https://github.com/ruby/ruby/blob/ca52ee245721efdc01f6304b6b1bc1294b47ed33/io_buffer.c#L1583-L1585

Locking is not thread safe. It is designed as a safety net around
non-blocking system calls. You can only share a buffer between threads with
appropriate synchronisation techniques.

So I think that this is a user program bug not an IO::Buffer#locked problem.