Skip to content

BUG: Fix use-after-free in _HelperInputVoidPtr properties #1629

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mdboom merged 4 commits into from
Feb 17, 2026
+301 −112
Merged

BUG: Fix use-after-free in _HelperInputVoidPtr properties #1629

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
051af88
BUG: Fix use-after-free in _HelperInputVoidPtr properties
mdboom Feb 17, 2026
37a37c6
Revert cptr ref
mdboom Feb 17, 2026
8ca7ff7
Apply suggestion from @mdboom
mdboom Feb 17, 2026
bba19c5
Merge branch 'main' into fix-dangling-ref-helper-input-void-ptr
mdboom Feb 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion cuda_bindings/cuda/bindings/_lib/utils.pxd.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# SPDX-FileCopyrightText: Copyright (c) 2021-2024 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-FileCopyrightText: Copyright (c) 2021-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: LicenseRef-NVIDIA-SOFTWARE-LICENSE

cimport cuda.bindings.driver as driver
Expand Down Expand Up @@ -134,6 +134,7 @@ cdef class _HelperCUmemAllocationHandleType:
{{endif}}

cdef class _InputVoidPtrPtrHelper:
cdef object _references
cdef void** _cptr

{{if 'CUcoredumpSettings_enum' in found_types}}
Expand Down
3 changes: 3 additions & 0 deletions cuda_bindings/cuda/bindings/_lib/utils.pxi.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -596,6 +596,9 @@ cdef class _HelperCUmemAllocationHandleType:

cdef class _InputVoidPtrPtrHelper:
def __cinit__(self, lst):
# Hold onto references to the original buffers so they
# won't be free'd behind our back
self._references = lst
Copy link
Contributor

@cpcloud cpcloud Feb 17, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be worth a comment if possible, so that humans and bots don't think this code is dead code.

self._cptr = <void**>_callocWrapper(len(lst), sizeof(void*))
for idx in range(len(lst)):
self._cptr[idx] = <void*><void_ptr>lst[idx].cptr
Expand Down
80 changes: 79 additions & 1 deletion cuda_bindings/cuda/bindings/driver.pxd.in
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# SPDX-FileCopyrightText: Copyright (c) 2021-2025 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-FileCopyrightText: Copyright (c) 2021-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: LicenseRef-NVIDIA-SOFTWARE-LICENSE

# This code was automatically generated with version 13.1.0. Do not modify it directly.
Expand Down Expand Up @@ -1162,6 +1162,9 @@ cdef class CUaccessPolicyWindow_st:
"""
cdef cydriver.CUaccessPolicyWindow_st _pvt_val
cdef cydriver.CUaccessPolicyWindow_st* _pvt_ptr
{{if 'CUaccessPolicyWindow_st.base_ptr' in found_struct}}
cdef _HelperInputVoidPtr _cybase_ptr
{{endif}}
{{endif}}
{{if 'CUDA_KERNEL_NODE_PARAMS_st' in found_struct}}

Expand Down Expand Up @@ -1506,6 +1509,9 @@ cdef class CUDA_HOST_NODE_PARAMS_st:
{{if 'CUDA_HOST_NODE_PARAMS_st.fn' in found_struct}}
cdef CUhostFn _fn
{{endif}}
{{if 'CUDA_HOST_NODE_PARAMS_st.userData' in found_struct}}
cdef _HelperInputVoidPtr _cyuserData
{{endif}}
{{endif}}
{{if 'CUDA_HOST_NODE_PARAMS_v2_st' in found_struct}}

Expand Down Expand Up @@ -1534,6 +1540,9 @@ cdef class CUDA_HOST_NODE_PARAMS_v2_st:
{{if 'CUDA_HOST_NODE_PARAMS_v2_st.fn' in found_struct}}
cdef CUhostFn _fn
{{endif}}
{{if 'CUDA_HOST_NODE_PARAMS_v2_st.userData' in found_struct}}
cdef _HelperInputVoidPtr _cyuserData
{{endif}}
{{endif}}
{{if 'CUDA_CONDITIONAL_NODE_PARAMS' in found_struct}}

Expand Down Expand Up @@ -2186,6 +2195,9 @@ cdef class CUctxCigParam_st:
"""
cdef cydriver.CUctxCigParam_st _pvt_val
cdef cydriver.CUctxCigParam_st* _pvt_ptr
{{if 'CUctxCigParam_st.sharedData' in found_struct}}
cdef _HelperInputVoidPtr _cysharedData
{{endif}}
{{endif}}
{{if 'CUctxCreateParams_st' in found_struct}}

Expand Down Expand Up @@ -2255,6 +2267,12 @@ cdef class CUlibraryHostUniversalFunctionAndDataTable_st:
"""
cdef cydriver.CUlibraryHostUniversalFunctionAndDataTable_st _pvt_val
cdef cydriver.CUlibraryHostUniversalFunctionAndDataTable_st* _pvt_ptr
{{if 'CUlibraryHostUniversalFunctionAndDataTable_st.functionTable' in found_struct}}
cdef _HelperInputVoidPtr _cyfunctionTable
{{endif}}
{{if 'CUlibraryHostUniversalFunctionAndDataTable_st.dataTable' in found_struct}}
cdef _HelperInputVoidPtr _cydataTable
{{endif}}
{{endif}}
{{if 'CUDA_MEMCPY2D_st' in found_struct}}

Expand Down Expand Up @@ -2336,12 +2354,18 @@ cdef class CUDA_MEMCPY2D_st:
"""
cdef cydriver.CUDA_MEMCPY2D_st _pvt_val
cdef cydriver.CUDA_MEMCPY2D_st* _pvt_ptr
{{if 'CUDA_MEMCPY2D_st.srcHost' in found_struct}}
cdef _HelperInputVoidPtr _cysrcHost
{{endif}}
{{if 'CUDA_MEMCPY2D_st.srcDevice' in found_struct}}
cdef CUdeviceptr _srcDevice
{{endif}}
{{if 'CUDA_MEMCPY2D_st.srcArray' in found_struct}}
cdef CUarray _srcArray
{{endif}}
{{if 'CUDA_MEMCPY2D_st.dstHost' in found_struct}}
cdef _HelperInputVoidPtr _cydstHost
{{endif}}
{{if 'CUDA_MEMCPY2D_st.dstDevice' in found_struct}}
cdef CUdeviceptr _dstDevice
{{endif}}
Expand Down Expand Up @@ -2466,18 +2490,30 @@ cdef class CUDA_MEMCPY3D_st:
"""
cdef cydriver.CUDA_MEMCPY3D_st _pvt_val
cdef cydriver.CUDA_MEMCPY3D_st* _pvt_ptr
{{if 'CUDA_MEMCPY3D_st.srcHost' in found_struct}}
cdef _HelperInputVoidPtr _cysrcHost
{{endif}}
{{if 'CUDA_MEMCPY3D_st.srcDevice' in found_struct}}
cdef CUdeviceptr _srcDevice
{{endif}}
{{if 'CUDA_MEMCPY3D_st.srcArray' in found_struct}}
cdef CUarray _srcArray
{{endif}}
{{if 'CUDA_MEMCPY3D_st.reserved0' in found_struct}}
cdef _HelperInputVoidPtr _cyreserved0
{{endif}}
{{if 'CUDA_MEMCPY3D_st.dstHost' in found_struct}}
cdef _HelperInputVoidPtr _cydstHost
{{endif}}
{{if 'CUDA_MEMCPY3D_st.dstDevice' in found_struct}}
cdef CUdeviceptr _dstDevice
{{endif}}
{{if 'CUDA_MEMCPY3D_st.dstArray' in found_struct}}
cdef CUarray _dstArray
{{endif}}
{{if 'CUDA_MEMCPY3D_st.reserved1' in found_struct}}
cdef _HelperInputVoidPtr _cyreserved1
{{endif}}
{{endif}}
{{if 'CUDA_MEMCPY3D_PEER_st' in found_struct}}

Expand Down Expand Up @@ -2597,6 +2633,9 @@ cdef class CUDA_MEMCPY3D_PEER_st:
"""
cdef cydriver.CUDA_MEMCPY3D_PEER_st _pvt_val
cdef cydriver.CUDA_MEMCPY3D_PEER_st* _pvt_ptr
{{if 'CUDA_MEMCPY3D_PEER_st.srcHost' in found_struct}}
cdef _HelperInputVoidPtr _cysrcHost
{{endif}}
{{if 'CUDA_MEMCPY3D_PEER_st.srcDevice' in found_struct}}
cdef CUdeviceptr _srcDevice
{{endif}}
Expand All @@ -2606,6 +2645,9 @@ cdef class CUDA_MEMCPY3D_PEER_st:
{{if 'CUDA_MEMCPY3D_PEER_st.srcContext' in found_struct}}
cdef CUcontext _srcContext
{{endif}}
{{if 'CUDA_MEMCPY3D_PEER_st.dstHost' in found_struct}}
cdef _HelperInputVoidPtr _cydstHost
{{endif}}
{{if 'CUDA_MEMCPY3D_PEER_st.dstDevice' in found_struct}}
cdef CUdeviceptr _dstDevice
{{endif}}
Expand Down Expand Up @@ -3284,6 +3326,12 @@ cdef class anon_struct12:
Get memory address of class instance
"""
cdef cydriver.CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st* _pvt_ptr
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle.win32.handle' in found_struct}}
cdef _HelperInputVoidPtr _cyhandle
{{endif}}
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle.win32.name' in found_struct}}
cdef _HelperInputVoidPtr _cyname
{{endif}}
{{endif}}
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle' in found_struct}}

Expand Down Expand Up @@ -3313,6 +3361,9 @@ cdef class anon_union5:
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle.win32' in found_struct}}
cdef anon_struct12 _win32
{{endif}}
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st.handle.nvSciBufObject' in found_struct}}
cdef _HelperInputVoidPtr _cynvSciBufObject
{{endif}}
{{endif}}
{{if 'CUDA_EXTERNAL_MEMORY_HANDLE_DESC_st' in found_struct}}

Expand Down Expand Up @@ -3445,6 +3496,12 @@ cdef class anon_struct13:
Get memory address of class instance
"""
cdef cydriver.CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st* _pvt_ptr
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle.win32.handle' in found_struct}}
cdef _HelperInputVoidPtr _cyhandle
{{endif}}
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle.win32.name' in found_struct}}
cdef _HelperInputVoidPtr _cyname
{{endif}}
{{endif}}
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle' in found_struct}}

Expand Down Expand Up @@ -3474,6 +3531,9 @@ cdef class anon_union6:
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle.win32' in found_struct}}
cdef anon_struct13 _win32
{{endif}}
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st.handle.nvSciSyncObj' in found_struct}}
cdef _HelperInputVoidPtr _cynvSciSyncObj
{{endif}}
{{endif}}
{{if 'CUDA_EXTERNAL_SEMAPHORE_HANDLE_DESC_st' in found_struct}}

Expand Down Expand Up @@ -3550,6 +3610,9 @@ cdef class anon_union7:
Get memory address of class instance
"""
cdef cydriver.CUDA_EXTERNAL_SEMAPHORE_SIGNAL_PARAMS_st* _pvt_ptr
{{if 'CUDA_EXTERNAL_SEMAPHORE_SIGNAL_PARAMS_st.params.nvSciSync.fence' in found_struct}}
cdef _HelperInputVoidPtr _cyfence
{{endif}}
{{endif}}
{{if 'CUDA_EXTERNAL_SEMAPHORE_SIGNAL_PARAMS_st.params.keyedMutex' in found_struct}}

Expand Down Expand Up @@ -3686,6 +3749,9 @@ cdef class anon_union8:
Get memory address of class instance
"""
cdef cydriver.CUDA_EXTERNAL_SEMAPHORE_WAIT_PARAMS_st* _pvt_ptr
{{if 'CUDA_EXTERNAL_SEMAPHORE_WAIT_PARAMS_st.params.nvSciSync.fence' in found_struct}}
cdef _HelperInputVoidPtr _cyfence
{{endif}}
{{endif}}
{{if 'CUDA_EXTERNAL_SEMAPHORE_WAIT_PARAMS_st.params.keyedMutex' in found_struct}}

Expand Down Expand Up @@ -4257,6 +4323,9 @@ cdef class CUmemAllocationProp_st:
{{if 'CUmemAllocationProp_st.location' in found_struct}}
cdef CUmemLocation _location
{{endif}}
{{if 'CUmemAllocationProp_st.win32HandleMetaData' in found_struct}}
cdef _HelperInputVoidPtr _cywin32HandleMetaData
{{endif}}
{{if 'CUmemAllocationProp_st.allocFlags' in found_struct}}
cdef anon_struct22 _allocFlags
{{endif}}
Expand Down Expand Up @@ -4416,6 +4485,9 @@ cdef class CUmemPoolProps_st:
{{if 'CUmemPoolProps_st.location' in found_struct}}
cdef CUmemLocation _location
{{endif}}
{{if 'CUmemPoolProps_st.win32SecurityAttributes' in found_struct}}
cdef _HelperInputVoidPtr _cywin32SecurityAttributes
{{endif}}
{{endif}}
{{if 'CUmemPoolPtrExportData_st' in found_struct}}

Expand Down Expand Up @@ -5232,6 +5304,12 @@ cdef class CUmemDecompressParams_st:
"""
cdef cydriver.CUmemDecompressParams_st _pvt_val
cdef cydriver.CUmemDecompressParams_st* _pvt_ptr
{{if 'CUmemDecompressParams_st.src' in found_struct}}
cdef _HelperInputVoidPtr _cysrc
{{endif}}
{{if 'CUmemDecompressParams_st.dst' in found_struct}}
cdef _HelperInputVoidPtr _cydst
{{endif}}
{{endif}}
{{if 'CUdevSmResource_st' in found_struct}}

Expand Down
Loading
Loading