Issue 15578 - assert before refcount overflow #22103
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
pullapprove
bot
requested review from
anush-apple,
arkq,
Byungjoo-Lee,
bzbarsky-apple,
carol-apple,
chrisdecenzo,
chshu,
chulspro,
Damian-Nordic,
dhrishi,
electrocucaracha,
emargolis,
franck-apple,
gjc13,
harsha-rajendran,
hawk248,
isiu-apple,
jelderton,
jepenven-silabs,
jmartinez-silabs,
kghost,
kpschoedel,
lazarkov,
LuDuda,
mlepage-google,
mrjerryjohns,
msandstedt and
rgoliver
pullapprove
bot
requested review from
robszewczyk,
saurabhst,
selissia,
tcarmelveilleux,
tecimovic,
turon,
vijs,
vivien-apple,
wbschiller,
xylophone21 and
yunhanw-google
andy31415
approved these changes
Aug 23, 2022
|
PR #22103: Size comparison from 4ab1882 to c0bd50f Increases (33 builds for cc13x2_26x2, cyw30739, efr32, k32w, linux, mbed, nrfconnect, psoc6, telink)
Decreases (10 builds for bl602, cc13x2_26x2, psoc6)
Full report (43 builds for bl602, cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, psoc6, telink)
|
vivien-apple
approved these changes
Aug 25, 2022
jtung-apple
force-pushed
the
issue-15578-assert-before-refcount-overflow
branch
from
aa4e071 to
ccf83df
Compare
jtung-apple
force-pushed
the
issue-15578-assert-before-refcount-overflow
branch
from
ccf83df to
132d6db
Compare
|
PR #22103: Size comparison from 5c2334a to 132d6db Increases (33 builds for bl602, cc13x2_26x2, cyw30739, efr32, k32w, linux, mbed, nrfconnect, psoc6, telink)
Decreases (6 builds for cc13x2_26x2, esp32, psoc6)
Full report (43 builds for bl602, cc13x2_26x2, cyw30739, efr32, esp32, k32w, linux, mbed, nrfconnect, psoc6, telink)
|
isiu-apple
pushed a commit
to isiu-apple/connectedhomeip
that referenced
this pull request
Sep 16, 2022
* Issue 15578 - assert before refcount overflow * changed assert to VerifyOrDieWithMsg for better error reporting and code doc * use numeric_limits to avoid problems with underlying type change * restyled
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Problem
As Issue #15578 points out - there is no protection for overflowing the refcount of PacketBuffer, and when that happens, another AddRef/Free would result in this memory getting deallocated, while there are still UINT16_MAX holders of the pointer, leading to use-after-free.
We could potentially have PacketBufferHandle do a check, and hold some error state, but 1) this doesn't prevent PacketBuffer itself from being broken, and 2) the change may introduce other issues.
Capping the refcount or making the refcount type larger just delay the use-after-free problem.
Seems like there is likely some other severe bug if the refcount gets incremented so much that it's about to overflow, and so making an assert here - to abort safely if this unexpected scenario should occur - is the only solution that makes sense.
Change overview
Before incrementing the refcount assert that the value is not already UINT16_MAX.
Testing
No testing done - this is a fairly trivial sanity safeguard for an edge case.