Skip to content

Commit 0a00e4c

Browse files
mdboommdboom
authored
BUG: Fix use-after-free in _HelperInputVoidPtr properties (#1629)
* BUG: Fix use-after-free in _HelperInputVoidPtr properties * Revert cptr ref * Apply suggestion from @mdboom
1 parent 73e2a79 commit 0a00e4c

File tree

7 files changed

+301
-112
lines changed

7 files changed

+301
-112
lines changed

‎cuda_bindings/cuda/bindings/_lib/utils.pxd.in‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-FileCopyrightText: Copyright (c) 2021-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
1+
# SPDX-FileCopyrightText: Copyright (c) 2021-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
22
# SPDX-License-Identifier: LicenseRef-NVIDIA-SOFTWARE-LICENSE
33

44
cimport cuda.bindings.driver as driver
@@ -134,6 +134,7 @@ cdef class _HelperCUmemAllocationHandleType:
134134
{{endif}}
135135

136136
cdef class _InputVoidPtrPtrHelper:
137+
cdef object _references
137138
cdef void** _cptr
138139

139140
{{if 'CUcoredumpSettings_enum' in found_types}}

‎cuda_bindings/cuda/bindings/_lib/utils.pxi.in‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -596,6 +596,9 @@ cdef class _HelperCUmemAllocationHandleType:
596596

597597
cdef class _InputVoidPtrPtrHelper:
598598
def __cinit__(self, lst):
599+
# Hold onto references to the original buffers so they
600+
# won't be free'd behind our back
601+
self._references = lst
599602
self._cptr = <void**>_callocWrapper(len(lst), sizeof(void*))
600603
for idx in range(len(lst)):
601604
self._cptr[idx] = <void*><void_ptr>lst[idx].cptr

‎cuda_bindings/cuda/bindings/driver.pxd.in‎

Lines changed: 79 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# SPDX-FileCopyrightText: Copyright (c) 2021-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
1+
# SPDX-FileCopyrightText: Copyright (c) 2021-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
22
# SPDX-License-Identifier: LicenseRef-NVIDIA-SOFTWARE-LICENSE
33

44
# This code was automatically generated with version 13.1.0. Do not modify it directly.
@@ -1162,6 +1162,9 @@ cdef class CUaccessPolicyWindow_st:
11621162
"""
11631163
cdef cydriver.CUaccessPolicyWindow_st _pvt_val
11641164
cdef cydriver.CUaccessPolicyWindow_st* _pvt_ptr
1165+
{{if 'CUaccessPolicyWindow_st.base_ptr' in found_struct}}
1166+
cdef _HelperInputVoidPtr _cybase_ptr
1167+
{{endif}}
11651168
{{endif}}
11661169
{{if 'CUDA_KERNEL_NODE_PARAMS_st' in found_struct}}
11671170

@@ -1506,6 +1509,9 @@ cdef class CUDA_HOST_NODE_PARAMS_st:
15061509
{{if 'CUDA_HOST_NODE_PARAMS_st.fn' in found_struct}}
15071510
cdef CUhostFn _fn
15081511
{{endif}}
1512+
{{if 'CUDA_HOST_NODE_PARAMS_st.userData' in found_struct}}
1513+
cdef _HelperInputVoidPtr _cyuserData
1514+
{{endif}}
15091515
{{endif}}
15101516
{{if 'CUDA_HOST_NODE_PARAMS_v2_st' in found_struct}}
15111517

@@ -1534,6 +1540,9 @@ cdef class CUDA_HOST_NODE_PARAMS_v2_st:
15341540
{{if 'CUDA_HOST_NODE_PARAMS_v2_st.fn' in found_struct}}
15351541
cdef CUhostFn _fn
15361542
{{endif}}
1543+
{{if 'CUDA_HOST_NODE_PARAMS_v2_st.userData' in found_struct}}
1544+
cdef _HelperInputVoidPtr _cyuserData
1545+
{{endif}}
15371546
{{endif}}
15381547
{{if 'CUDA_CONDITIONAL_NODE_PARAMS' in found_struct}}
15391548

@@ -2186,6 +2195,9 @@ cdef class CUctxCigParam_st:
21862195
"""
21872196
cdef cydriver.CUctxCigParam_st _pvt_val
21882197
cdef cydriver.CUctxCigParam_st* _pvt_ptr
2198+
{{if 'CUctxCigParam_st.sharedData' in found_struct}}
2199+
cdef _HelperInputVoidPtr _cysharedData
2200+
{{endif}}
21892201
{{endif}}
21902202
{{if 'CUctxCreateParams_st' in found_struct}}
21912203

@@ -2255,6 +2267,12 @@ cdef class CUlibraryHostUniversalFunctionAndDataTable_st:
22552267
"""
22562268
cdef cydriver.CUlibraryHostUniversalFunctionAndDataTable_st _pvt_val
22572269
cdef cydriver.CUlibraryHostUniversalFunctionAndDataTable_st* _pvt_ptr
2270+
{{if 'CUlibraryHostUniversalFunctionAndDataTable_st.functionTable' in found_struct}}
2271+
cdef _HelperInputVoidPtr _cyfunctionTable
2272+
{{endif}}
2273+
{{if 'CUlibraryHostUniversalFunctionAndDataTable_st.dataTable' in found_struct}}
2274+
cdef _HelperInputVoidPtr _cydataTable
2275+
{{endif}}
22582276
{{endif}}
22592277
{{if 'CUDA_MEMCPY2D_st' in found_struct}}
22602278

@@ -2336,12 +2354,18 @@ cdef class CUDA_MEMCPY2D_st:
23362354
"""
23372355
cdef cydriver.CUDA_MEMCPY2D_st _pvt_val
23382356
cdef cydriver.CUDA_MEMCPY2D_st* _pvt_ptr
2357+
{{if 'CUDA_MEMCPY2D_st.srcHost' in found_struct}}
2358+
cdef _HelperInputVoidPtr _cysrcHost
2359+
{{endif}}
23392360
{{if 'CUDA_MEMCPY2D_st.srcDevice' in found_struct}}
23402361
cdef CUdeviceptr _srcDevice
23412362
{{endif}}
23422363
{{if 'CUDA_MEMCPY2D_st.srcArray' in found_struct}}
23432364
cdef CUarray _srcArray
23442365
{{endif}}
2366+
{{if 'CUDA_MEMCPY2D_st.dstHost' in found_struct}}
2367+
cdef _HelperInputVoidPtr _cydstHost
2368+
{{endif}}
23452369
{{if 'CUDA_MEMCPY2D_st.dstDevice' in found_struct}}
23462370
cdef CUdeviceptr _dstDevice
23472371
{{endif}}
@@ -2466,18 +2490,30 @@ cdef class CUDA_MEMCPY3D_st:
24662490
"""
24672491
cdef cydriver.CUDA_MEMCPY3D_st _pvt_val
24682492
cdef cydriver.CUDA_MEMCPY3D_st* _pvt_ptr
2493+
{{if 'CUDA_MEMCPY3D_st.srcHost' in found_struct}}
2494+
cdef _HelperInputVoidPtr _cysrcHost
2495+
{{endif}}
24692496
{{if 'CUDA_MEMCPY3D_st.srcDevice' in found_struct}}
24702497
cdef CUdeviceptr _srcDevice
24712498
{{endif}}
24722499
{{if 'CUDA_MEMCPY3D_st.srcArray' in found_struct}}
24732500
cdef CUarray _srcArray
24742501
{{endif}}
2502+
{{if 'CUDA_MEMCPY3D_st.reserved0' in found_struct}}
2503+
cdef _HelperInputVoidPtr _cyreserved0
2504+
{{endif}}
2505+
{{if 'CUDA_MEMCPY3D_st.dstHost' in found_struct}}
2506+
cdef _HelperInputVoidPtr _cydstHost
2507+
{{endif}}
24752508
{{if 'CUDA_MEMCPY3D_st.dstDevice' in found_struct}}
24762509
cdef CUdeviceptr _dstDevice
24772510
{{endif}}
24782511
{{if 'CUDA_MEMCPY3D_st.dstArray' in found_struct}}
24792512
cdef CUarray _dstArray
24802513
{{endif}}
2514+
{{if 'CUDA_MEMCPY3D_st.reserved1' in found_struct}}
2515+
cdef _HelperInputVoidPtr _cyreserved1
2516+
{{endif}}
24812517
{{endif}}
24822518
{{if 'CUDA_MEMCPY3D_PEER_st' in found_struct}}
24832519

@@ -2597,6 +2633,9 @@ cdef class CUDA_MEMCPY3D_PEER_st:
25972633
"""
25982634
cdef cydriver.CUDA_MEMCPY3D_PEER_st _pvt_val
25992635
cdef cydriver.CUDA_MEMCPY3D_PEER_st* _pvt_ptr
2636+
{{if 'CUDA_MEMCPY3D_PEER_st.srcHost' in found_struct}}
2637+
cdef _HelperInputVoidPtr _cysrcHost
2638+
{{endif}}
26002639
{{if 'CUDA_MEMCPY3D_PEER_st.srcDevice' in found_struct}}
26012640
cdef CUdeviceptr _srcDevice
26022641
{{endif}}
@@ -2606,6 +2645,9 @@ cdef class CUDA_MEMCPY3D_PEER_st:
26062645
{{if 'CUDA_MEMCPY3D_PEER_st.srcContext' in found_struct}}
26072646
cdef CUcontext _srcContext
26082647
{{endif}}
2648+
{{if 'CUDA_MEMCPY3D_PEER_st.dstHost' in found_struct}}
2649+
cdef _HelperInputVoidPtr _cydstHost
2650+
{{endif}}
26092651
{{if 'CUDA_MEMCPY3D_PEER_st.dstDevice' in found_struct}}
26102652
cdef CUdeviceptr _dstDevice
26112653
{{endif}}
@@ -3284,6 +3326,12 @@ cdef class anon_struct12:
32843326
Get memory address of class instance
32853327
"""
32863328
cdef cydriver.CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st* _pvt_ptr
3329+
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle.win32.handle' in found_struct}}
3330+
cdef _HelperInputVoidPtr _cyhandle
3331+
{{endif}}
3332+
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle.win32.name' in found_struct}}
3333+
cdef _HelperInputVoidPtr _cyname
3334+
{{endif}}
32873335
{{endif}}
32883336
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle' in found_struct}}
32893337

@@ -3313,6 +3361,9 @@ cdef class anon_union5:
33133361
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle.win32' in found_struct}}
33143362
cdef anon_struct12 _win32
33153363
{{endif}}
3364+
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle.nvSciBufObject' in found_struct}}
3365+
cdef _HelperInputVoidPtr _cynvSciBufObject
3366+
{{endif}}
33163367
{{endif}}
33173368
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st' in found_struct}}
33183369

@@ -3445,6 +3496,12 @@ cdef class anon_struct13:
34453496
Get memory address of class instance
34463497
"""
34473498
cdef cydriver.CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st* _pvt_ptr
3499+
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle.win32.handle' in found_struct}}
3500+
cdef _HelperInputVoidPtr _cyhandle
3501+
{{endif}}
3502+
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle.win32.name' in found_struct}}
3503+
cdef _HelperInputVoidPtr _cyname
3504+
{{endif}}
34483505
{{endif}}
34493506
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle' in found_struct}}
34503507

@@ -3474,6 +3531,9 @@ cdef class anon_union6:
34743531
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle.win32' in found_struct}}
34753532
cdef anon_struct13 _win32
34763533
{{endif}}
3534+
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle.nvSciSyncObj' in found_struct}}
3535+
cdef _HelperInputVoidPtr _cynvSciSyncObj
3536+
{{endif}}
34773537
{{endif}}
34783538
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st' in found_struct}}
34793539

@@ -3550,6 +3610,9 @@ cdef class anon_union7:
35503610
Get memory address of class instance
35513611
"""
35523612
cdef cydriver.CUDA_EXTERNAL_SEMAPHORE_SIGNAL_PARAMS_st* _pvt_ptr
3613+
{{if 'CUDA_EXTERNAL_SEMAPHORE_SIGNAL_PARAMS_st.params.nvSciSync.fence' in found_struct}}
3614+
cdef _HelperInputVoidPtr _cyfence
3615+
{{endif}}
35533616
{{endif}}
35543617
{{if 'CUDA_EXTERNAL_SEMAPHORE_SIGNAL_PARAMS_st.params.keyedMutex' in found_struct}}
35553618

@@ -3686,6 +3749,9 @@ cdef class anon_union8:
36863749
Get memory address of class instance
36873750
"""
36883751
cdef cydriver.CUDA_EXTERNAL_SEMAPHORE_WAIT_PARAMS_st* _pvt_ptr
3752+
{{if 'CUDA_EXTERNAL_SEMAPHORE_WAIT_PARAMS_st.params.nvSciSync.fence' in found_struct}}
3753+
cdef _HelperInputVoidPtr _cyfence
3754+
{{endif}}
36893755
{{endif}}
36903756
{{if 'CUDA_EXTERNAL_SEMAPHORE_WAIT_PARAMS_st.params.keyedMutex' in found_struct}}
36913757

@@ -4257,6 +4323,9 @@ cdef class CUmemAllocationProp_st:
42574323
{{if 'CUmemAllocationProp_st.location' in found_struct}}
42584324
cdef CUmemLocation _location
42594325
{{endif}}
4326+
{{if 'CUmemAllocationProp_st.win32HandleMetaData' in found_struct}}
4327+
cdef _HelperInputVoidPtr _cywin32HandleMetaData
4328+
{{endif}}
42604329
{{if 'CUmemAllocationProp_st.allocFlags' in found_struct}}
42614330
cdef anon_struct22 _allocFlags
42624331
{{endif}}
@@ -4416,6 +4485,9 @@ cdef class CUmemPoolProps_st:
44164485
{{if 'CUmemPoolProps_st.location' in found_struct}}
44174486
cdef CUmemLocation _location
44184487
{{endif}}
4488+
{{if 'CUmemPoolProps_st.win32SecurityAttributes' in found_struct}}
4489+
cdef _HelperInputVoidPtr _cywin32SecurityAttributes
4490+
{{endif}}
44194491
{{endif}}
44204492
{{if 'CUmemPoolPtrExportData_st' in found_struct}}
44214493

@@ -5232,6 +5304,12 @@ cdef class CUmemDecompressParams_st:
52325304
"""
52335305
cdef cydriver.CUmemDecompressParams_st _pvt_val
52345306
cdef cydriver.CUmemDecompressParams_st* _pvt_ptr
5307+
{{if 'CUmemDecompressParams_st.src' in found_struct}}
5308+
cdef _HelperInputVoidPtr _cysrc
5309+
{{endif}}
5310+
{{if 'CUmemDecompressParams_st.dst' in found_struct}}
5311+
cdef _HelperInputVoidPtr _cydst
5312+
{{endif}}
52355313
{{endif}}
52365314
{{if 'CUdevSmResource_st' in found_struct}}
52375315

0 commit comments

Comments
 (0)