Skip to content

fix(x86_64/mmio): use after free - #2619

Merged
mkroening merged 4 commits into
mainfrom
x86_64-mmio-use_after_free
Aug 10, 2026
Merged

fix(x86_64/mmio): use after free#2619
mkroening merged 4 commits into
mainfrom
x86_64-mmio-use_after_free

Conversation

@mkroening

Copy link
Copy Markdown
Member

786d4e9 introduced a use-after-free bug since PageBox deallocates the page range on drop even though the device still uses the memory. This has only worked accidentally since. I found this while working on #2615. This is fixed by reverting the change and leaking the page range.

This also resolves another issue where multiple existing devices could be mapped to multiple pages, but the code only maintains a single page. This is resolved by identity-mapping the devices instead, which should make things much more reliable.

@mkroening mkroening self-assigned this Aug 10, 2026

@github-actions github-actions Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Benchmark Results

Details
Benchmark Current: 4fbf00e Previous: 2e23902 Performance Ratio
startup_benchmark Build Time 81.57 s 80.34 s 1.02
startup_benchmark File Size 0.76 MB 0.80 MB 0.96
Startup Time - 1 core 0.76 s (±0.03 s) 0.75 s (±0.02 s) 1.02
Startup Time - 2 cores 0.76 s (±0.02 s) 0.74 s (±0.02 s) 1.03
Startup Time - 4 cores 0.76 s (±0.02 s) 0.74 s (±0.02 s) 1.02
multithreaded_benchmark Build Time 84.73 s 82.11 s 1.03
multithreaded_benchmark File Size 0.87 MB 0.86 MB 1.02
Multithreaded Pi Efficiency - 2 Threads 90.89 % (±5.29 %) 85.89 % (±6.61 %) 1.06
Multithreaded Pi Efficiency - 4 Threads 43.81 % (±2.65 %) 43.43 % (±2.56 %) 1.01
Multithreaded Pi Efficiency - 8 Threads 25.69 % (±1.46 %) 25.76 % (±1.53 %) 1.00
micro_benchmarks Build Time 77.38 s 80.40 s 0.96
micro_benchmarks File Size 0.88 MB 0.86 MB 1.02
Scheduling time - 1 thread 64.08 ticks (±2.94 ticks) 62.65 ticks (±4.06 ticks) 1.02
Scheduling time - 2 threads 34.81 ticks (±5.12 ticks) 34.08 ticks (±4.10 ticks) 1.02
Micro - Time for syscall (getpid) 3.49 ticks (±0.55 ticks) 3.45 ticks (±0.58 ticks) 1.01
Memcpy speed - (built_in) block size 4096 85499.72 MByte/s (±59065.11 MByte/s) 82448.38 MByte/s (±56997.13 MByte/s) 1.04
Memcpy speed - (built_in) block size 1048576 30481.65 MByte/s (±24574.13 MByte/s) 30585.98 MByte/s (±24707.84 MByte/s) 1.00
Memcpy speed - (built_in) block size 16777216 29310.67 MByte/s (±24103.32 MByte/s) 26340.06 MByte/s (±21720.96 MByte/s) 1.11
Memset speed - (built_in) block size 4096 85608.51 MByte/s (±59143.95 MByte/s) 82292.76 MByte/s (±56891.50 MByte/s) 1.04
Memset speed - (built_in) block size 1048576 31213.00 MByte/s (±25004.56 MByte/s) 31323.85 MByte/s (±25145.86 MByte/s) 1.00
Memset speed - (built_in) block size 16777216 30073.41 MByte/s (±24540.42 MByte/s) 27104.68 MByte/s (±22209.94 MByte/s) 1.11
Memcpy speed - (rust) block size 4096 76124.66 MByte/s (±53210.14 MByte/s) 74097.96 MByte/s (±51811.44 MByte/s) 1.03
Memcpy speed - (rust) block size 1048576 30324.94 MByte/s (±24518.41 MByte/s) 30361.60 MByte/s (±24602.37 MByte/s) 1.00
Memcpy speed - (rust) block size 16777216 29141.46 MByte/s (±23943.15 MByte/s) 27625.34 MByte/s (±22806.88 MByte/s) 1.05
Memset speed - (rust) block size 4096 76841.30 MByte/s (±53687.49 MByte/s) 74373.47 MByte/s (±51976.48 MByte/s) 1.03
Memset speed - (rust) block size 1048576 31071.70 MByte/s (±24954.19 MByte/s) 31110.89 MByte/s (±25033.24 MByte/s) 1.00
Memset speed - (rust) block size 16777216 29901.25 MByte/s (±24382.29 MByte/s) 28386.93 MByte/s (±23265.03 MByte/s) 1.05
alloc_benchmarks Build Time 76.40 s 74.76 s 1.02
alloc_benchmarks File Size 0.84 MB 0.87 MB 0.96
Allocations - Allocation success 91.34 % 91.31 % 1.00
Allocations - Deallocation success 100.00 % 100.00 % 1
Allocations - Pre-fail Allocations 61.54 % 61.44 % 1.00
Allocations - Average Allocation time 5163.35 Ticks (±119.04 Ticks) 5860.58 Ticks (±98.43 Ticks) 0.88
Allocations - Average Allocation time (no fail) 5904.94 Ticks (±119.62 Ticks) 6554.81 Ticks (±92.86 Ticks) 0.90
Allocations - Average Deallocation time 1520.80 Ticks (±312.04 Ticks) 1805.01 Ticks (±250.35 Ticks) 0.84
mutex_benchmark Build Time 76.77 s 79.82 s 0.96
mutex_benchmark File Size 0.88 MB 0.86 MB 1.02
Mutex Stress Test Average Time per Iteration - 1 Threads 12.12 ns (±0.38 ns) 12.10 ns (±0.41 ns) 1.00
Mutex Stress Test Average Time per Iteration - 2 Threads 40.26 ns (±2.26 ns) 40.26 ns (±1.68 ns) 1.00

This comment was automatically generated by workflow using github-action-benchmark.

This should avoid any issues from remapping and does not leak an allocated virtual page range.
@mkroening
mkroening force-pushed the x86_64-mmio-use_after_free branch from 2ddf2be to 4fbf00e Compare August 10, 2026 12:13
@mkroening
mkroening enabled auto-merge August 10, 2026 12:27
@mkroening
mkroening added this pull request to the merge queue Aug 10, 2026
Merged via the queue into main with commit eeadae7 Aug 10, 2026
21 checks passed
@mkroening
mkroening deleted the x86_64-mmio-use_after_free branch August 10, 2026 13:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant