Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

pagekitec: add patch to fix use after free leading to segfault #24982

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Commits on Sep 17, 2024

  1. pagekitec: add patch to fix use after free

    Observation:
    - programs using libpagekitec did crash with SIGSEGV on startup on RPi3,4
      while having worked fine for years on RPi1+2
    
    Explantation:
    - the final "judgement" test were done on pointers into the `copy` buffer
      freed on line 766 instead of on the safe copies of those strings in `kite`
      and `kite_r`.
    - this opened a very short race condition window, however the crash was
      caught happening while a tight loop (`pkb_start_blockers`) fired up 16
      of those threads in rapid succession.
      So probably if the next thread got to allocate memory before the
      "judgements" tests, accessing the just freed `copy` would cause a segfault.
    
    Fix:
    - check the safe copies of the strings instead of pointers into freed `copy`.
    
    Signed-off-by: Lukas Zeller <[email protected]>
    plan44 committed Sep 17, 2024
    Configuration menu
    Copy the full SHA
    ed379e5 View commit details
    Browse the repository at this point in the history