-
Notifications
You must be signed in to change notification settings - Fork 42
Open
Description
There is a race condition in the mmap allocator memory management. Following sequence can happen:
- Memory in address X is allocated. X is put into allocatedMemoryReferences
- Memory in address X is released with 'close' request. X is removed from allocatedMemoryReferences
- MemoryReference for address X has been garbage collected, and it is put into the 'queue'.
- Memory in address X is reallocated. X is is put into allocatedMemoryReferences
- Memory in address X is popped from 'queue', and because X is in allocatedMemoryReferences, it gets released second time.
- Memory in address X is assumed to be allocated, and so it is used, which causes a segfault.
Metadata
Metadata
Assignees
Labels
No labels