Skip to content

fixed use after free with detached cpp metrics pages#413

Open
cherep58 wants to merge 2 commits into
ppfrom
cpp_metrics_uaf_fix
Open

fixed use after free with detached cpp metrics pages#413
cherep58 wants to merge 2 commits into
ppfrom
cpp_metrics_uaf_fix

Conversation

@cherep58

Copy link
Copy Markdown
Collaborator

No description provided.

@cherep58
cherep58 requested review from gshigin and u-veles-a July 16, 2026 20:47
@cherep58 cherep58 self-assigned this Jul 16, 2026
@cherep58
cherep58 requested a review from vporoshok as a code owner July 16, 2026 20:47
@cherep58 cherep58 added the bug Something isn't working label Jul 16, 2026
Add comments capturing the invariants the detached-page retention scheme
relies on, and a compile-time guard for the shared struct layout:

- cppbridge.CppMetric: note it is a memory view over C++ Go::Metric (not a
  copy) and that 'active' is the cross-language handshake gating reclamation.
- Range(): explain why the loop keeps iterating after a consumer returns false
  (per-generation stamping drives cache pruning) and what the prune loop does.
- The finalizer: spell out why the page is guaranteed alive when it writes
  'active' and why there is no ABA, plus the GC-latency tradeoff.
- MetricsPageList::remove_unused_pages(): document that it is the only place
  pages are freed and runs solely under the Go mutex, while the finalizer only
  flips the atomic flag.
- Go::Metric: add static_asserts on size/offsets so a future field change fails
  the build instead of silently corrupting the Go-mapped memory (LP64).

Co-authored-by: Cursor <cursoragent@cursor.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants