Project

General

Profile

Bug #9249

Updated by Lukas Sismis 4 days ago

Two issues identified: 

 1. threads: flow manager reads thread store during startup without lock 

 

   In offline mode, the flow manager checks whether time is ready by walking the thread store without the store lock. Startup can still reallocate the store at that point, so with 27–30 autofp workers it reads freed 
   memory (ASAN heap-use-after-free in TmThreadsTimeSubsysIsReady()). Introduced by 276d625a6; 8.0.x is affected too. Fixed in 3329893a7. 

 

   2. unix-manager: commands served before threads are unpaused 

 

   The unix socket thread answers commands while the other threads are still being set up. With unix-command enabled in offline mode, list-hostbit and add-hostbit walk the thread store during a reallocation and read 
   freed memory (ASAN heap-use-after-free in TmThreadsGetMinimalTimestamp()). Fixed in 3fcf5d4b9, which makes the socket wait until the engine has started. 


 I have some on-going work needing further verification.

Back