larray icon indicating copy to clipboard operation
larray copied to clipboard

Race condition

Open arauhala opened this issue 7 years ago • 0 comments

There is a race condition in the mmap allocator memory management. Following sequence can happen:

  1. Memory in address X is allocated. X is put into allocatedMemoryReferences
  2. Memory in address X is released with 'close' request. X is removed from allocatedMemoryReferences
  3. MemoryReference for address X has been garbage collected, and it is put into the 'queue'.
  4. Memory in address X is reallocated. X is is put into allocatedMemoryReferences
  5. Memory in address X is popped from 'queue', and because X is in allocatedMemoryReferences, it gets released second time.
  6. Memory in address X is assumed to be allocated, and so it is used, which causes a segfault.

arauhala avatar Jun 29 '18 11:06 arauhala