]> Cypherpunks repositories - gostls13.git/commit
runtime: fix dangling pointer in readyExecute
authorAustin Clements <austin@google.com>
Mon, 13 Apr 2015 20:50:20 +0000 (16:50 -0400)
committerAustin Clements <austin@google.com>
Fri, 17 Apr 2015 17:59:14 +0000 (17:59 +0000)
commitc1c667542cb831303d332f3699a9cf32dfa490e1
tree0b410ce2095211af3263a96076badf8f4d6731e3
parent6302641c98603f51b09c5974e7a3680b00e9c107
runtime: fix dangling pointer in readyExecute

readyExecute passes a closure to mcall that captures an argument to
readyExecute. Since mcall is marked noescape, this closure lives on
the stack of the calling goroutine. However, the closure puts the
calling goroutine on the run queue (and switches to a new
goroutine). If the calling goroutine gets scheduled before the mcall
returns, this stack-allocated closure will become invalid while it's
still executing. One consequence of this we've observed is that the
captured gp variable can get overwritten before the call to
execute(gp), causing execute(gp) to segfault.

Fix this by passing the currently captured gp variable through a field
in the calling goroutine's g struct so that the func is no longer a
closure.

To prevent problems like this in the future, this change also removes
the go:noescape annotation from mcall. Due to a compiler bug, this
will currently cause a func closure passed to mcall to be implicitly
allocated rather than refusing the implicit allocation. However, this
is okay because there are no other closures passed to mcall right now
and the compiler bug will be fixed shortly.

Fixes #10428.

Change-Id: I49b48b85de5643323b89e9eaa4df63854e968c32
Reviewed-on: https://go-review.googlesource.com/8866
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: David Chase <drchase@google.com>
Reviewed-by: Russ Cox <rsc@golang.org>
src/runtime/proc1.go
src/runtime/runtime2.go
src/runtime/stubs.go