Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: cherry-pick a5f54612590d from chromium #31901

Merged
merged 1 commit into from Nov 30, 2021

Conversation

ppontes
Copy link
Member

@ppontes ppontes commented Nov 18, 2021

M96: Storage Foundation: Avoid cross-thread access of DOMArrayBufferView.

blink::NativeIOFile::{read, write}() (in the Storage Foundation API
implementation) pass DOMArrayBufferView instances to
blink::NativeIOFile::Do{Read,Write}() via CrossThreadPersistent.
blink::NativeIOFile::Do{Read,Write}() accesses these instances.

CrossThreadPersistent can be used across threads to keep a garbage
collected object alive. However, accessing the object on a different
thread is not safe. cppgc::subtle::CrossThreadPersistent
(blink::CrossThreadPersistent is an alias to that) has comments
explaining that the garbage collected heap can go away while the
CrossThreadPersistent instance exists.

This CL bypasses the problem by having Do{Read,Write}() receive a
ArrayBufferContents that has the DOMArrayBufferView's backing buffer.
ArrayBufferContents is not garbage-collected, so it can be safely used
across threads.

This CL introduces a NativeIODataBuffer class that contains the logic
and state for tearing a DOMArrayBufferView apart into its components
(backing buffer, view type, view offset, view length) and putting it
back together into a new DOMArrayBufferView, after it doesn't need to be
accessed cross-thread anymore.

(cherry picked from commit 5200793c2aea5979cc79f3350a4e3d6c0795d6f2)

Bug: 1268274
Change-Id: I51588f5bfe963de96ce426e0f480e8c5b4902688
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3269366
Commit-Queue: Victor Costan pwnall@chromium.org
Reviewed-by: enne enne@chromium.org
Reviewed-by: Joshua Bell jsbell@chromium.org
Cr-Original-Commit-Position: refs/heads/main@{#940070}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3272377
Bot-Commit: Rubber Stamper rubber-stamper@appspot.gserviceaccount.com
Cr-Commit-Position: refs/branch-heads/4664@{#941}
Cr-Branched-From: 24dc4ee75e01a29d390d43c9c264372a169273a7-refs/heads/main@{#929512}

Notes: Backported fix for CVE-2021-38011.

@ppontes ppontes requested a review from as a code owner Nov 18, 2021
@ppontes ppontes added 13-x-y backport-check-skip semver/patch labels Nov 18, 2021
@electron-cation electron-cation bot added new-pr 🌱 and removed new-pr 🌱 labels Nov 18, 2021
@ppontes ppontes force-pushed the cherry-pick/13-x-y/chromium/a5f54612590d branch from 973cc23 to 873dad5 Compare Nov 20, 2021
@ppontes ppontes force-pushed the cherry-pick/13-x-y/chromium/a5f54612590d branch from 43655cf to e8f3f8b Compare Nov 26, 2021
@jkleinsc
Copy link
Contributor

@jkleinsc jkleinsc commented Nov 30, 2021

Merging as CI failures are unrelated to PR change.

@jkleinsc jkleinsc merged commit 39d55f0 into 13-x-y Nov 30, 2021
13 of 15 checks passed
@jkleinsc jkleinsc deleted the cherry-pick/13-x-y/chromium/a5f54612590d branch Nov 30, 2021
@release-clerk
Copy link

@release-clerk release-clerk bot commented Nov 30, 2021

Release Notes Persisted

Backported fix for CVE-2021-38011.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
13-x-y backport-check-skip security 🔒 semver/patch
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants