Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

libarena::TypedArena::alloc_from_iter does not allow for recursive allocations #67001

Closed
cjgillot opened this issue Dec 3, 2019 · 2 comments · Fixed by #67003
Closed

libarena::TypedArena::alloc_from_iter does not allow for recursive allocations #67001

cjgillot opened this issue Dec 3, 2019 · 2 comments · Fixed by #67003
Labels
C-bug Category: This is a bug. I-unsound Issue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness P-high High priority T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.

Comments

@cjgillot
Copy link
Contributor

cjgillot commented Dec 3, 2019

I stumbled on this while debugging #66936

I tried calling TypedArena::alloc_from_iter with an iterator which itself allocates on the arena.
If that iterator has fixed size (known through size_hint), the allocation goes in the fast path.
In that case, the allocation for the range and the recursive allocations get interlaced.
The returned pointers are wrong, and valid objects get overwritten.
This can lead to undropped objects and infinite loops.

A simple fix has been committed to #66936.
A more intelligent one may be better.
@cjgillot cjgillot changed the title libarena::TypedArena::alloc_from_iter not not allow for recursive allocations libarena::TypedArena::alloc_from_iter does not allow for recursive allocations Dec 3, 2019
@Mark-Simulacrum
Copy link
Member

Can you split out the fix (presuming it's to TypedArena itself) from the arena code? It sounds like if we're returning wrong pointers this is a "soundness" bug too, since that method is safe; which is not great. Nominating for compiler team so we can hopefully assign someone to investigate a proper fix.

@Mark-Simulacrum Mark-Simulacrum added T-compiler Relevant to the compiler team, which will review and decide on the PR/issue. I-nominated labels Dec 3, 2019
@cjgillot cjgillot mentioned this issue Dec 3, 2019
Merged
bors added a commit that referenced this issue Dec 3, 2019
@bors
Auto merge of #67003 - cjgillot:corrida, r=<try>
f0ced29 
Fix TypedArena returning wrong pointers for recursive allocations

Closes #67001
@pnkfelix
Copy link
Member

pnkfelix commented Dec 5, 2019 •
edited
Loading

triage: sounds very bad. has PR. P-high. removing nomination.

@pnkfelix pnkfelix added I-unsound Issue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness T-libs-api Relevant to the library API team, which will review and decide on the PR/issue. P-high High priority and removed T-libs-api Relevant to the library API team, which will review and decide on the PR/issue. I-nominated labels Dec 5, 2019
Centril added a commit to Centril/rust that referenced this issue Dec 7, 2019
@Centril
Rollup merge of rust-lang#67003 - cjgillot:corrida, r=Mark-Simulacrum
b8ab423 
Fix TypedArena returning wrong pointers for recursive allocations

Closes rust-lang#67001
Centril added a commit to Centril/rust that referenced this issue Dec 8, 2019
@Centril
Rollup merge of rust-lang#67003 - cjgillot:corrida, r=Mark-Simulacrum
9384dd7 
Fix TypedArena returning wrong pointers for recursive allocations

Closes rust-lang#67001
@JohnTitor JohnTitor added the C-bug Category: This is a bug. label Dec 8, 2019
@bors bors closed this as completed in 2b0e6d2 Dec 9, 2019
@cjgillot cjgillot mentioned this issue Dec 22, 2019
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
C-bug Category: This is a bug. I-unsound Issue: A soundness hole (worst kind of bug), see: https://en.wikipedia.org/wiki/Soundness P-high High priority T-compiler Relevant to the compiler team, which will review and decide on the PR/issue.
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Fix TypedArena returning wrong pointers for recursive allocations cjgillot/rust
4 participants
@pnkfelix @cjgillot @Mark-Simulacrum @JohnTitor