From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on dcvr.yhbt.net X-Spam-Level: X-Spam-ASN: AS4713 221.184.0.0/13 X-Spam-Status: No, score=-3.8 required=3.0 tests=AWL,BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, SPF_HELO_NONE,SPF_PASS,UNPARSEABLE_RELAY shortcircuit=no autolearn=ham autolearn_force=no version=3.4.2 Received: from neon.ruby-lang.org (neon.ruby-lang.org [221.186.184.75]) by dcvr.yhbt.net (Postfix) with ESMTP id C104F1F4B4 for ; Tue, 20 Apr 2021 16:49:45 +0000 (UTC) Received: from neon.ruby-lang.org (localhost [IPv6:::1]) by neon.ruby-lang.org (Postfix) with ESMTP id CF351121092; Wed, 21 Apr 2021 01:48:42 +0900 (JST) Received: from o1678948x4.outbound-mail.sendgrid.net (o1678948x4.outbound-mail.sendgrid.net [167.89.48.4]) by neon.ruby-lang.org (Postfix) with ESMTPS id CFF1912108F for ; Wed, 21 Apr 2021 01:48:40 +0900 (JST) Received: by filterdrecv-7cd54bd647-78cpw with SMTP id filterdrecv-7cd54bd647-78cpw-14-607F0624-3F 2021-04-20 16:49:40.259797377 +0000 UTC m=+419301.971251760 Received: from herokuapp.com (unknown) by geopod-ismtpd-3-1 (SG) with ESMTP id x2QRUTXPQWGmSTZdR9y3yw for ; Tue, 20 Apr 2021 16:49:40.217 +0000 (UTC) Date: Tue, 20 Apr 2021 16:49:40 +0000 (UTC) From: merch-redmine@jeremyevans.net Message-ID: References: Mime-Version: 1.0 X-Redmine-Project: ruby-master X-Redmine-Issue-Tracker: Bug X-Redmine-Issue-Id: 17807 X-Redmine-Issue-Author: ivoanjo X-Redmine-Sender: jeremyevans0 X-Mailer: Redmine X-Redmine-Host: bugs.ruby-lang.org X-Redmine-Site: Ruby Issue Tracking System X-Auto-Response-Suppress: All Auto-Submitted: auto-generated X-Redmine-MailingListIntegration-Message-Ids: 79575 X-SG-EID: =?us-ascii?Q?RVE3t853K5scBhbmJHUzZTFFeVC=2FZSUmHZ0Dc+26wcEi2CTgsF1oz0wTSSxGGN?= =?us-ascii?Q?BIkE9nHa520rMtEPsN5bwrZwoFyqQm1I5kJfBS7?= =?us-ascii?Q?e5jvu1eK8zLLwRUa2kRK7JrRi4aRT1ClJf3yyas?= =?us-ascii?Q?ASouMGxYz6PPyRlYfqDzjBgQcY0=2Frn+i32cSTtU?= =?us-ascii?Q?kWWC+s36UqwUzG4abkWlmGAgVKlGFRKicwYjZB+?= =?us-ascii?Q?dkZTR50H8yuNd9EEA=3D?= To: ruby-core@ruby-lang.org X-Entity-ID: b/2+PoftWZ6GuOu3b0IycA== X-ML-Name: ruby-core X-Mail-Count: 103526 Subject: [ruby-core:103526] [Ruby master Bug#17807] "Segmentation fault at 0x0000000000000008" crash when accessing instance variables of Process::Waiter instances (Ruby 2.3 to 2.6) X-BeenThere: ruby-core@ruby-lang.org X-Mailman-Version: 2.1.15 Precedence: list Reply-To: Ruby developers List-Id: Ruby developers List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: ruby-core-bounces@ruby-lang.org Sender: "ruby-core" Issue #17807 has been updated by jeremyevans0 (Jeremy Evans). Status changed from Open to Closed Thank you for the report! I don't think this is a security issue, and since Ruby 2.6 is in security maintenance mode and Ruby 2.7+ is not affected, I'm going to close this. ---------------------------------------- Bug #17807: "Segmentation fault at 0x0000000000000008" crash when accessing instance variables of Process::Waiter instances (Ruby 2.3 to 2.6) https://bugs.ruby-lang.org/issues/17807#change-91627 * Author: ivoanjo (Ivo Anjo) * Status: Closed * Priority: Normal * ruby -v: ruby 2.6.7p197 (2021-04-05 revision 67941) [x86_64-linux] * Backport: 2.6: UNKNOWN, 2.7: UNKNOWN, 3.0: UNKNOWN ---------------------------------------- Hey there! I'm in [Datadog's ddtrace gem](https://github.com/DataDog/dd-trace-rb) team and one of our customers was running into this crash. Reproducing it is trivial: `ruby -e 'Process.detach(fork {}); Thread.list.last.instance_variable_get(:@kaboom)'`. The issue seems to be that some of the internal structures of the `Process::Waiter` are not properly initialized, and so trying to access instance variables on an instance of that very special class triggers the crash. This seems to affect Ruby from 2.3 up to 2.6, on both Linux and macOS. I've attached a crash log, but probably running the reproducer example is faster :) As I said above, this crash is gone on 2.7 and 3.0. I could not find any mention of this crash, so I suspect the fix may have been a happy side effect of some refactoring, rather than a deliberate thing. Furthermore, I know that out of the affected versions, only 2.6 is the only one still not EOL, and I am not sure if this can be qualified as a security issue. I decided to report it anyway, in the spirit of documenting what I learned. Feel free to close the ticket if indeed there's no plans of fixing it. Finally, here's some hints, if someone out there also needs to work around this issue: * `defined?` (from inside the class) or `instance_variable_defined?` (from the outside) seem to work, so if you "look before you jump", you can avoid the crash * Writing once to any instance variable on any instance of a `Process::Waiter` seems to initialize whatever was missing; afterwards, any instance of this class will behave correctly * You can always check the `.class` of the thread to see if you should skip whatever you were trying to do with it ---Files-------------------------------- crash-log.txt (16 KB) -- https://bugs.ruby-lang.org/