Repository navigation
SGX's std::env::args function is not thread-safe #64304
Description
The args method is defined as follows.
pub fn args() -> Args {
let args = unsafe { (ARGS.load(Ordering::Relaxed) as *const ArgsStore).as_ref() };
if let Some(args) = args {
Args(args.iter())
} else {
Args([].iter())
}
}Clean-up function is defined as follows;
pub unsafe fn cleanup() {
let args = ARGS.swap(0, Ordering::Relaxed);
if args != 0 {
drop(Box::<ArgsStore>::from_raw(args as _))
}
}It is possible for another thread to use std::env::args() while the main thread quits, and access already freed memory - assuming the following sequence of events.
// Secondary thread
let args = unsafe { (ARGS.load(Ordering::Relaxed) as *const ArgsStore).as_ref() };
// Main thread
{
let args = ARGS.swap(0, Ordering::Relaxed);
if args != 0 {
drop(Box::<ArgsStore>::from_raw(args as _))
}
}
// Secondary thread
if let Some(args) = args {
Args(args.iter())
}This issue has been assigned to @Goirad via this comment.
Activity
jonas-schievink commentedon Dec 10, 2019
cc @jethrogb
(do we want an
O-fortanix-sgxlabel?)jethrogb commentedon Dec 10, 2019
I suppose we could just turn
cleanupinto a NOP. How do other platforms handle this?Goirad commentedon Feb 5, 2020
@rustbot claim
Goirad commentedon Feb 7, 2020
Looking at other implementations, the only times when this is not a NOP is for
hermitvxcodeandunixon non-apple variants. In all these cases the code is:I am inclined to just change it to a NOP. What was the motivation for the existing logic?
jethrogb commentedon Feb 10, 2020
Implement the required function
cleanupwithout knowing exactly what needs to happen.Having done some git archeology, it looks to me like the
cleanupfunction exists solely for certain platforms where the arguments may be stored on the stack of the main thread. If the main thread exits, that stack may no longer be available so other threads may not reference it.I think turning it into a nop for SGX is probably fine.
Rollup merge of rust-lang#69068 - Goirad:make-sgx-arg-cleanup-nop, r=…