Skip to content
This repository was archived by the owner on Jan 23, 2023. It is now read-only.

Commit b72ff3b

Browse files
janvorliAnipik
authored andcommitted
Port to 3.1 - Fix VirtualMemoryLogging::logRecords overflow (#27958)
when VirtualMemoryLogging::recordNumber increments from LONG_MAX, it became negative number, and the result of i % MaxRecords became a number from -127 to 0. When that happens we will ovewrite CRITICAL_SECTION virtual_critsec which are stored in bss right before logRecords with garbage data. Then most likely the process will have a GC hang with one or more GC threads stuck trying to enter or leave critical section. The fix is to ensure ULONG value are passed to modulo operation.
1 parent 8c478a8 commit b72ff3b

File tree

1 file changed

+4
-4
lines changed

1 file changed

+4
-4
lines changed

src/pal/src/map/virtual.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ namespace VirtualMemoryLogging
107107
// An entry in the in-memory log
108108
struct LogRecord
109109
{
110-
LONG RecordId;
110+
ULONG RecordId;
111111
DWORD Operation;
112112
LPVOID CurrentThread;
113113
LPVOID RequestedAddress;
@@ -118,14 +118,14 @@ namespace VirtualMemoryLogging
118118
};
119119

120120
// Maximum number of records in the in-memory log
121-
const LONG MaxRecords = 128;
121+
const ULONG MaxRecords = 128;
122122

123123
// Buffer used to store the logged data
124124
volatile LogRecord logRecords[MaxRecords];
125125

126126
// Current record number. Use (recordNumber % MaxRecords) to determine
127127
// the current position in the circular buffer.
128-
volatile LONG recordNumber = 0;
128+
volatile ULONG recordNumber = 0;
129129

130130
// Record an entry in the in-memory log
131131
void LogVaOperation(
@@ -137,7 +137,7 @@ namespace VirtualMemoryLogging
137137
IN LPVOID returnedAddress,
138138
IN BOOL result)
139139
{
140-
LONG i = InterlockedIncrement(&recordNumber) - 1;
140+
ULONG i = (ULONG)InterlockedIncrement((LONG*)&recordNumber) - 1;
141141
LogRecord* curRec = (LogRecord*)&logRecords[i % MaxRecords];
142142

143143
curRec->RecordId = i;

0 commit comments

Comments
 (0)