[Backport] CVE-2021-30541: Use after free in V8

Manual backport of patch originally reviewed on https://chromium-review.googlesource.com/c/v8/v8/+/2993033: Merged: [JSON] Fix GC issue in BuildJsonObject We must ensure that the sweeper is not running or has already swept mutable_double_buffer. Otherwise the GC can add it to the free list. Change-Id: If0fc7617acdb6690f0567215b78f8728e1643ec0 No-Try: true No-Presubmit: true No-Tree-Checks: true Bug: v8:11837, chromium:1214842 Reviewed-by: Michael Lippautz <[email protected]> Reviewed-by: Toon Verwaest <[email protected]> Commit-Queue: Victor Gomes <[email protected]> Cr-Commit-Position: refs/branch-heads/9.1@{#75} Cr-Branched-From: 0e4ac64a8cf298b14034a22f9fe7b085d2cb238d-refs/heads/9.1.269@{#1} Cr-Branched-From: f565e72d5ba88daae35a59d0f978643e2343e912-refs/heads/master@{#73847} Reviewed-by: Michal Klocek <[email protected]>
qt · Aug 12, 2021 · d2679df · d2679df
1 parent c49a1b4
commit d2679df
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 0 deletions.
diff --git a/chromium/v8/src/heap/heap.cc b/chromium/v8/src/heap/heap.cc
@@ -2222,6 +2222,10 @@ void Heap::RecomputeLimits(GarbageCollector collector) {
   }
 }
 
+void Heap::EnsureSweepingCompleted() {
+  mark_compact_collector()->EnsureSweepingCompleted();
+}
+
 void Heap::CallGCPrologueCallbacks(GCType gc_type, GCCallbackFlags flags) {
   RuntimeCallTimerScope runtime_timer(
       isolate(), RuntimeCallCounterId::kGCPrologueCallback);

diff --git a/chromium/v8/src/heap/heap.h b/chromium/v8/src/heap/heap.h
@@ -1065,6 +1065,8 @@ class Heap {
       Reservation* reservations, const std::vector<HeapObject>& large_objects,
       const std::vector<Address>& maps);
 
+  void EnsureSweepingCompleted();
+
   IncrementalMarking* incremental_marking() {
     return incremental_marking_.get();
   }

diff --git a/chromium/v8/src/json/json-parser.cc b/chromium/v8/src/json/json-parser.cc
@@ -633,6 +633,11 @@ Handle<Object> JsonParser<Char>::BuildJsonObject(
         DCHECK_EQ(mutable_double_address, end);
       }
 #endif
+      // Before setting the length of mutable_double_buffer back to zero, we
+      // must ensure that the sweeper is not running or has already swept the
+      // object's page. Otherwise the GC can add the contents of
+      // mutable_double_buffer to the free list.
+      isolate()->heap()->EnsureSweepingCompleted();
       mutable_double_buffer->set_length(0);
     }
   }