Skip to content

Crashed at Inner::try_wake() #2

@black-binary

Description

@black-binary

My code crashed after switching from smol::lock::Mutex to fast-async-mutex::mutex::Mutex. I'm not familiar with the unsafe code so I'm not sure if it's a bug or I'm using it in the wrong way.

pub(crate) fn try_wake(&self, waker_ptr: *mut Waker) {
let cur_waker_ptr = self.waker.swap(waker_ptr, Ordering::Relaxed);
if !cur_waker_ptr.is_null() {
let cur_waker = unsafe { Box::from_raw(cur_waker_ptr) };
if waker_ptr.is_null() || !cur_waker.will_wake(unsafe { &*waker_ptr }) {
cur_waker.wake();
}
} else if !waker_ptr.is_null() {
unsafe { &*waker_ptr }.wake_by_ref();
}
}

I need to lock the mutex in a non-async function. So what I'm doing is

  • calling lock.lock_owned() to generate a future fut

  • calling fut.poll(cx) trying to lock the mutex immediately

  • if poll() returns Pending, store the future in my struct, and wait for the next polling

Here is the original code

https://github.com/black-binary/ap-kcp/blob/ce0605523be63e8e68176847fc63c59a54b8918b/src/async_kcp.rs#L46-L73

And it crashed in the benchmark. I failed to reproduce this crash in debug mode, so I had to use gdb and IDA to find what happened.

The calling stack looks like this. The RIP register was zero (called a null pointer?)

bt

IDA shows that the crash happened after calling Inner::try_wake()

disasm

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions