Skip to content
This repository was archived by the owner on Jan 23, 2023. It is now read-only.

Commit 111e182

Browse files
janvorliAnipik
authored andcommitted
Port to 2.1 - Fix VirtualMemoryLogging::logRecords overflow (#27967)
when VirtualMemoryLogging::recordNumber increments from LONG_MAX, it became negative number, and the result of i % MaxRecords became a number from -127 to 0. When that happens we will ovewrite CRITICAL_SECTION virtual_critsec which are stored in bss right before logRecords with garbage data. Then most likely the process will have a GC hang with one or more GC threads stuck trying to enter or leave critical section. The fix is to ensure ULONG value are passed to modulo operation.
1 parent f9974d8 commit 111e182

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

src/pal/src/map/virtual.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ namespace VirtualMemoryLogging
106106
// An entry in the in-memory log
107107
struct LogRecord
108108
{
109-
LONG RecordId;
109+
ULONG RecordId;
110110
DWORD Operation;
111111
LPVOID CurrentThread;
112112
LPVOID RequestedAddress;
@@ -117,14 +117,14 @@ namespace VirtualMemoryLogging
117117
};
118118

119119
// Maximum number of records in the in-memory log
120-
const LONG MaxRecords = 128;
120+
const ULONG MaxRecords = 128;
121121

122122
// Buffer used to store the logged data
123123
volatile LogRecord logRecords[MaxRecords];
124124

125125
// Current record number. Use (recordNumber % MaxRecords) to determine
126126
// the current position in the circular buffer.
127-
volatile LONG recordNumber = 0;
127+
volatile ULONG recordNumber = 0;
128128

129129
// Record an entry in the in-memory log
130130
void LogVaOperation(
@@ -136,7 +136,7 @@ namespace VirtualMemoryLogging
136136
IN LPVOID returnedAddress,
137137
IN BOOL result)
138138
{
139-
LONG i = InterlockedIncrement(&recordNumber) - 1;
139+
ULONG i = (ULONG)InterlockedIncrement((LONG*)&recordNumber) - 1;
140140
LogRecord* curRec = (LogRecord*)&logRecords[i % MaxRecords];
141141

142142
curRec->RecordId = i;

0 commit comments

Comments
 (0)