)]}' { "commit": "3578f390dfe86fda2feff18b6bf97eb81b7980d1", "tree": "704bdd632f01aff0b10210897746f8cf099201b6", "parents": [ "75fc7f81ead60d4db95beacb3ff76a315f00fccf" ], "author": { "name": "Lalit Maganti", "email": "lalitm@google.com", "time": "Wed Apr 29 17:58:53 2026 +0100" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Wed Apr 29 17:58:53 2026 +0100" }, "message": "tp: extract IncrementalState to fix CustomState UAF (#5593)\n\nFixes the use-after-free flagged in\n`PacketSequenceStateGeneration::CustomState`.\n\n## The bug\n\nPreviously, each `CustomState` held a raw `generation_` back-pointer\nthat was re-pointed every time a new generation was created via\n`OnNewTracePacketDefaults` (the `set_generation(this)` loop in the\nmulti-arg ctor). The `TraceSorter` can hold a `RefPtr` to an older\nGeneration `G1` while a newer `G2` — to which `G1`\u0027s shared CustomState\nhad been re-pointed — is dropped after `SEQ_INCREMENTAL_STATE_CLEARED`.\n`G1` stays alive (and so does the CustomState), but its `generation_`\nthen dangles to freed memory; any subsequent lookup through the\nCustomState dereferences the freed `G2`.\n\n## The fix\n\nRefactor the generation/CustomState relationship so that lifetime is\ncorrect **by construction**:\n\n- New `IncrementalState : RefCounted`. Owns the\nper-incremental-state-interval data: `interned_data_`, the array of\n`CustomState`s (now `unique_ptr` rather than `RefPtr`), and the\npersistent thread descriptor. A new `IncrementalState` is constructed\nonly on `SEQ_INCREMENTAL_STATE_CLEARED`.\n\n- `PacketSequenceStateGeneration` becomes a thin\nper-`trace_packet_defaults` snapshot: holds `RefPtr\u003cIncrementalState\u003e`\n(shared with sibling generations within the same interval), the defaults\nblob, and the validity flag. All interned-data / custom-state /\nthread-descriptor accessors are forwarders to the `IncrementalState`.\n\n- `CustomState` is no longer `RefCounted` (it\u0027s owned uniquely by its\n`IncrementalState`). Its back-pointer is `IncrementalState*` and is set\nexactly once at lazy-allocation time inside\n`IncrementalState::GetCustomState\u003cT\u003e`. Because the `IncrementalState`\nowns the `CustomState`, the pointer is stable for the entire life of the\nCustomState — UAF impossible.\n\n- `OnNewTracePacketDefaults` no longer copies the `InternedFieldMap` or\nre-points CustomStates; it constructs a new Generation that shares the\nsame `RefPtr\u003cIncrementalState\u003e`. This removes a per-defaults-change copy\nthat could be O(map-size) in the hot path.\n\n- `OnPacketLoss` walks the IncrementalState\u0027s CustomState array and\nclears any slot whose `ClearOnPacketLoss()` opted in (TES today), then\nreturns a new Generation referencing the same `IncrementalState` with\nthe validity bit cleared.\n\n---\n\n**Stack:**\n- #5588 — tp: stop mutating PacketSequenceStateGeneration on packet loss\n- #5590 — tp: split TrackEventSequenceState into descriptor + delta\nstate\n- **#5593 — tp: extract IncrementalState to fix CustomState UAF** (this\nPR)", "tree_diff": [ { "type": "modify", "old_id": "22b95d333dd168ac01a2cbedded07705a66ec5f0", "old_mode": 33188, "old_path": "Android.bp", "new_id": "bbc0c0c0e565afbc4efeaf41a488f54c07f97536", "new_mode": 33188, "new_path": "Android.bp" }, { "type": "modify", "old_id": "562ab75770f4cd4aa4dfbb8b64d40238d2ffabef", "old_mode": 33188, "old_path": "BUILD", "new_id": "af360e12600e4a002e47ecc460989840b2a42579", "new_mode": 33188, "new_path": "BUILD" }, { "type": "modify", "old_id": "ac1c75960da6f0f6f83aa3e7766bcfee990425c6", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/BUILD.gn", "new_id": "d86afed3d80776f59212e8f01a3fedc5a375e736", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/BUILD.gn" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "4d2dedb34768dc8ca20851bdbe4fa33776a69d23", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/incremental_state.cc" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "cea5a5554f1e367c7b69b63accf7842ba8981ccc", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/incremental_state.h" }, { "type": "modify", "old_id": "954c2e47e34a929c8f3ae2a9fc24962b019eb395", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/packet_sequence_state_generation.cc", "new_id": "05c6c7cba456ebf88a882d2669fd5e3d73578d4e", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/packet_sequence_state_generation.cc" }, { "type": "modify", "old_id": "702231d0a5a4402e82316ef4f6f37b4f5882cb81", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/packet_sequence_state_generation.h", "new_id": "0a0b3becd558dee99aab795175bc4fe8e2dc1261", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/packet_sequence_state_generation.h" }, { "type": "add", "old_id": "0000000000000000000000000000000000000000", "old_mode": 0, "old_path": "/dev/null", "new_id": "2a50c6655bb60cfbfa7c81ec956a0dec5b2bdd56", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/packet_sequence_state_generation_unittest.cc" }, { "type": "modify", "old_id": "5fd3bbf1de517d97d655d4962b461e874412fce1", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/profile_module.cc", "new_id": "685c507a31d2e2e3fe032fc1fc3b75b1d88ae00c", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/profile_module.cc" }, { "type": "modify", "old_id": "f0858e3ac850a13b84a89764c50a7138a6028ead", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/profile_packet_sequence_state.cc", "new_id": "4363cc6f635c82512dc38a230005bb473e61aa96", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/profile_packet_sequence_state.cc" }, { "type": "modify", "old_id": "69e4a50c119c39035b39923a6035a6553a3c02b9", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/profile_packet_sequence_state.h", "new_id": "95123ffcb86f297af585f63bbd096237fb254ba5", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/profile_packet_sequence_state.h" }, { "type": "modify", "old_id": "f5e268d5a16aea533640220209a1bd736f819826", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/profile_packet_sequence_state_unittest.cc", "new_id": "9e93432e5c1d667b879b83560e860da7a4f2a720", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/profile_packet_sequence_state_unittest.cc" }, { "type": "modify", "old_id": "0b394c53a5ef1097aa1348d06b6cee73cad16d20", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/stack_profile_sequence_state.cc", "new_id": "e42ea1213b867c13ddc50e50fc916767e42587fd", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/stack_profile_sequence_state.cc" }, { "type": "modify", "old_id": "68552da84e34208526b5132026e169da0df0077f", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/stack_profile_sequence_state.h", "new_id": "e944292ac330ab092114b483233aded60015a0bb", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/stack_profile_sequence_state.h" }, { "type": "modify", "old_id": "f1e9df97f2110aad711d78486d7e6b8b3ac7f0e2", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/track_event_event_importer.h", "new_id": "2d827ae81086727b7b68d3729c5d0908efcecc16", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/track_event_event_importer.h" }, { "type": "modify", "old_id": "a33c4b25652fcbd4fef9432a2ab90780dedf8115", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/track_event_parser.cc", "new_id": "bbc06212b7a173036eb85820c163ed7bf6a81ed6", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/track_event_parser.cc" }, { "type": "modify", "old_id": "b77d3a58b35c1d27be706f0f0adee4a81593d9e0", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/v8_module.cc", "new_id": "f74226112b7dd610f63bbdfe9aa00540f6c1cc94", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/v8_module.cc" }, { "type": "modify", "old_id": "6dd44702ebd4e27ca59f10ff3bd8348ed2b18a93", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/v8_sequence_state.cc", "new_id": "db4f40f02e1421e75b25462c0aaa17051e391af8", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/v8_sequence_state.cc" }, { "type": "modify", "old_id": "9e18f2ab30e43dad9c49d295faf7479edfa0b90e", "old_mode": 33188, "old_path": "src/trace_processor/importers/proto/v8_sequence_state.h", "new_id": "195464cd59f9b618dacb51ad6197503228a0aabe", "new_mode": 33188, "new_path": "src/trace_processor/importers/proto/v8_sequence_state.h" } ] }