[mod_sofia] use-after-free crash - ensure that sofia_private is cleared in all cases where the nh handle is destroyed (since it is allocated out of nh's memory pool).#3082
Open
creslin287 wants to merge 1 commit into
Conversation
destroyed (it is allocated out of nh's memory pool). This particular use case was found when running load testing under very adverse calling circumstances. Bug originally manifested as a heap metadata corruption issue causing random crashes in memory allocation and free functions. After running the test using ASAN, it was found that the corrupting write was during a call to sofia_on_hangup(). At this callsite, tech_pvt->nh had already been set to NULL somewhere else, but tech_pvt->sofia_private was still set to a non-NULL pointer. This is problematic as this likely meant that the nua_handle had been destroyed and any child allocations on the same memory pool (such as tech_pvt->sofia_private) were likely free'd and shouldn't be touched. After auditing the event callback code path a case was found where tech_pvt->nh was destroyed without clearing sofia_private, prompting this fix. After re-running the load test, this patch resolved our issue - no more crashes.
creslin287
changed the title
creslin287
changed the title
creslin287
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This particular bug was found when running load testing under very adverse calling circumstances. Bug originally manifested as a heap metadata corruption issue causing random crashes in memory allocation and free functions.
After running the test using ASAN, it was found that the corrupting write was during a call to sofia_on_hangup(). At this callsite, tech_pvt->nh had already been set to NULL somewhere else, but tech_pvt->sofia_private was still set to a non-NULL pointer. This is problematic as this likely meant that the nua_handle had been destroyed and any child allocations on the same memory pool (such as tech_pvt->sofia_private) were likely free'd and shouldn't be touched.
After auditing the event callback code path, a case was found where tech_pvt->nh was destroyed without clearing sofia_private, prompting this fix. After re-running the load test, this patch resolved our issue - no more crashes.