SIGN IN SIGN UP

Fix use-after-free in socket pluginStackRW single-block CGO calls

When calling cgo.Read, cgo.Write, and cgo.Sendto with a single-block BlockSeq,
the backing slice address was converted to uintptr via Addr(). Because Go's
garbage collector does not recognize uintptr as a live pointer reference, the
underlying backing array could be collected or reused during the CGO call.
This adds runtime.KeepAlive on the BlockSeq arguments after each single-block
CGO call in ReadToBlocks and WriteFromBlocks.

PiperOrigin-RevId: 968029244
Z
Zach Koopmans committed
8c6bfc8a8fd039547ec65096e673427b75f12de4
Parent: ed1b001
Committed by gVisor bot <gvisor-bot@google.com> on 8/20/2026, 8:45:38 PM