• Russ Cox's avatar
    runtime: stack split + garbage collection bug · 370276a3
    Russ Cox authored
    The g->sched.sp saved stack pointer and the
    g->stackbase and g->stackguard stack bounds
    can change even while "the world is stopped",
    because a goroutine has to call functions (and
    therefore might split its stack) when exiting a
    system call to check whether the world is stopped
    (and if so, wait until the world continues).
    
    That means the garbage collector cannot access
    those values safely (without a race) for goroutines
    executing system calls.  Instead, save a consistent
    triple in g->gcsp, g->gcstack, g->gcguard during
    entersyscall and have the garbage collector refer
    to those.
    
    The old code was occasionally seeing (because of
    the race) an sp and stk that did not correspond to
    each other, so that stk - sp was not the number of
    stack bytes following sp.  In that case, if sp < stk
    then the call scanblock(sp, stk - sp) scanned too
    many bytes (anything between the two pointers,
    which pointed into different allocation blocks).
    If sp > stk then stk - sp wrapped around.
    On 32-bit, stk - sp is a uintptr (uint32) converted
    to int64 in the call to scanblock, so a large (~4G)
    but positive number.  Scanblock would try to scan
    that many bytes and eventually fault accessing
    unmapped memory.  On 64-bit, stk - sp is a uintptr (uint64)
    promoted to int64 in the call to scanblock, so a negative
    number.  Scanblock would not scan anything, possibly
    causing in-use blocks to be freed.
    
    In short, 32-bit platforms would have seen either
    ineffective garbage collection or crashes during garbage
    collection, while 64-bit platforms would have seen
    either ineffective or incorrect garbage collection.
    You can see the invalid arguments to scanblock in the
    stack traces in issue 1620.
    
    Fixes #1620.
    Fixes #1746.
    
    R=iant, r
    CC=golang-dev
    https://golang.org/cl/4437075
    370276a3
Name
Last commit
Last update
..
archive Loading commit data...
asn1 Loading commit data...
big Loading commit data...
bufio Loading commit data...
bytes Loading commit data...
cmath Loading commit data...
compress Loading commit data...
container Loading commit data...
crypto Loading commit data...
debug Loading commit data...
ebnf Loading commit data...
encoding Loading commit data...
exec Loading commit data...
exp Loading commit data...
expvar Loading commit data...
flag Loading commit data...
fmt Loading commit data...
go Loading commit data...
gob Loading commit data...
hash Loading commit data...
html Loading commit data...
http Loading commit data...
image Loading commit data...
index/suffixarray Loading commit data...
io Loading commit data...
json Loading commit data...
log Loading commit data...
math Loading commit data...
mime Loading commit data...
net Loading commit data...
netchan Loading commit data...
os Loading commit data...
patch Loading commit data...
path Loading commit data...
rand Loading commit data...
reflect Loading commit data...
regexp Loading commit data...
rpc Loading commit data...
runtime Loading commit data...
scanner Loading commit data...
smtp Loading commit data...
sort Loading commit data...
strconv Loading commit data...
strings Loading commit data...
sync Loading commit data...
syscall Loading commit data...
syslog Loading commit data...
tabwriter Loading commit data...
template Loading commit data...
testing Loading commit data...
time Loading commit data...
try Loading commit data...
unicode Loading commit data...
unsafe Loading commit data...
utf16 Loading commit data...
utf8 Loading commit data...
websocket Loading commit data...
xml Loading commit data...
Makefile Loading commit data...
deps.bash Loading commit data...