Automated fix for refs/heads/rwstauner/uaf-fork-pending-events - #50
Open
github-actions[bot] wants to merge 3 commits into
Open
Automated fix for refs/heads/rwstauner/uaf-fork-pending-events#50github-actions[bot] wants to merge 3 commits into
github-actions[bot] wants to merge 3 commits into
Conversation
Epoll1Poller::Work() collected pending Epoll1EventHandle* pointers under the poller mutex, then released the mutex before draining them via ExecutePendingActions(). Handles are poller-owned memory, recycled via free_epoll1_handles_list_ and only freed in Close() (called from ~Epoll1Poller), so the unlocked drain was safe when it was introduced (grpc#30828, 2022): nothing could free a handle mid-drain. EventEngine fork support (grpc#38441, grpc#38980, grpc#39739, 2025) broke that invariant. During fork a c-ares DNS socket handle can be orphaned (~GrpcPolledFdPosix -> OrphanHandle) and the poller torn down concurrently with a Work() iteration that is still draining pending_events. The handle is freed by Close() and its slot reused, so ExecutePendingActions() dereferences recycled memory as a closure pointer. Fix: hold the poller mutex across the whole collect-and-drain sequence so a handle in pending_events cannot be freed while it is being dereferenced. This is deadlock-free: Work() never takes the handle mutex, and schedule_poll_again() only flips a bool or enqueues a thread-pool task. The poll-based poller is unaffected because it uses ref-counted handles. Adds a regression test (epoll1_poller_handle_lifetime_test) that interleaves a Work() drain with an OrphanHandle + Close(); without the fix it fails under ASan with a stack matching the production crash.
rwstauner
force-pushed
the
rwstauner/uaf-fork-pending-events
branch
from
September 10, 2026 00:24
1207d0a to
24c9cc9
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PanCakes to the rescue!
We noticed that our 'sanity' test was going to fail, but we think we can fix that automatically, so we put together this PR to do just that!
If you'd like to opt-out of these PR's, add yourself to NO_AUTOFIX_USERS in .github/workflows/pr-auto-fix.yaml