Skip to content

Unsoundness: Cloning rcublas::Context leads to DF and possibly UAF #212

@t1mlange

Description

@t1mlange

Describe the bug

rcublass::Context::clone() copies the pointer but the Context is also owned. Thus, the first Context frees the underlying C object and all other cloned contexts exhibit UB afterwards.

To Reproduce

fn main() -> anyhow::Result<()> {
    let _outer;
    {
        let inner = rcublas::Context::new()?;
        _outer = inner.clone();
    }

    Ok(())
}

Expected behavior

Either should not compile or be safe.

Screenshots

$ ./rcublas-repro/target/debug/rcublas-repro
free(): double free detected in tcache 2
Aborted (core dumped)

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething doesn't quite look right

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions