Skip to content

json: reject non-shareable default sort_keys proc from non-main Ractors - #1079

Closed
eightbitraptor wants to merge 1 commit into
masterfrom
mvh-fix-multi-factor-uaf
Closed

eightbitraptor wants to merge 1 commit into
masterfrom
mvh-fix-multi-factor-uaf

Conversation

@eightbitraptor

Copy link
Copy Markdown
Member

This commit fixes a bug in JSON now that addresses registered with gc_register_address are stored in per-Ractor tables rather than globally.

It was originally fixed in ruby/ruby as part of ruby/ruby#18393 - I am submitting this PR so that we can have the canonical commit here, and then the Gem sync task in Ruby will be a no-op.

Summary

JSON::State.default_sort_keys_proc is registered at extension load time so it's owned by the main Ractor.

When we implement the registration table on each Ractor storing another Ractor's unshareable Proc into that slot leaves a dangling reference when the owning Ractor runs a local GC.

This commit ensures that we won't use a shareable proc by raising a Ractor::IsolationError.

JSON::State.default_sort_keys_proc is registered at extension load time
so it's owned by the main Ractor.

When we implement the registration table on each Ractor storing another
Ractor's unshareable Proc into that slot leaves a dangling reference
when the owning Ractor runs a local GC.

This commit ensures that we won't use a shareable proc by raising a
Ractor::IsolationError.
@byroot

byroot commented Sep 26, 2026

Copy link
Copy Markdown
Member

State#default_sort_keys_proc= is purely an internal API, it's not meant to be called at all.

If we want to harden it, we can raise if we're not on the main Ractor, regardless of the proc.

byroot added a commit to byroot/json that referenced this pull request Sep 28, 2026
It's assignable from Ruby simply for the gem's own initialization,
but it should never be re-assigned later.

Fix: ruby#1079
@byroot byroot closed this in #1080 Sep 28, 2026
byroot added a commit to byroot/ruby that referenced this pull request Sep 28, 2026
It's assignable from Ruby simply for the gem's own initialization,
but it should never be re-assigned later.

Fix: ruby/json#1079

ruby/json@cc32ef5cf5
pull Bot pushed a commit to Mattlk13/json that referenced this pull request Sep 28, 2026
It's assignable from Ruby simply for the gem's own initialization,
but it should never be re-assigned later.

Fix: ruby#1079
byroot added a commit to byroot/ruby that referenced this pull request Sep 28, 2026
It's assignable from Ruby simply for the gem's own initialization,
but it should never be re-assigned later.

Fix: ruby/json#1079

ruby/json@cc32ef5cf5
byroot added a commit to ruby/ruby that referenced this pull request Sep 28, 2026
It's assignable from Ruby simply for the gem's own initialization,
but it should never be re-assigned later.

Fix: ruby/json#1079

ruby/json@cc32ef5cf5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants