Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make iree.compiler.api.Output.map_memory() retain its backing reference. #15975

Merged
merged 5 commits into from
Dec 20, 2023

Conversation

stellaraccident
Copy link
Collaborator

Depending on the precise structure of the code and state of the garbage collector, this could cause very long-range crashes that appeared to have nothing to do with the allocation mechanism.

  • Adds a retaining finalizer to the map_memory() pointer return.
  • Adds a test that grinds two patterns that I found which produce bugs.
  • Fixes VmModule::WrapBuffer to close over its Py_buffer. I noticed this when auditing and it is subtly wrong: it will not break in this specific case but in cases where the backing memory has to be copied or re-organized, it could result in a use-after-free.

Fixes #15407

Depending on the precise structure of the code and state of the garbage collector, this could cause very long-range crashes that appeared to have nothing to do with the allocation mechanism.

* Adds a retaining finalizer to the map_memory() pointer return.
* Adds a test that grinds two patterns that I found which produce bugs.
* Fixes VmModule::WrapBuffer to close over its Py_buffer. I noticed this when auditing and it is subtly wrong: it will not break in this specific case but in cases where the backing memory has to be copied or re-organized, it could result in a use-after-free.

Fixes #15407
@stellaraccident stellaraccident merged commit 92df2b4 into main Dec 20, 2023
59 of 60 checks passed
@stellaraccident stellaraccident deleted the fix_output_ref branch December 20, 2023 01:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Suspected shutdown race on use of ireert.VmModule.wrap_buffer
2 participants