Skip to content

Comments

[libstore]: Fix a heap-use-after-free bug#14772

Merged
xokdvium merged 1 commit intoNixOS:masterfrom
GrahamDennis:gdennis/fix-heap-use-after-free
Dec 13, 2025
Merged

[libstore]: Fix a heap-use-after-free bug#14772
xokdvium merged 1 commit intoNixOS:masterfrom
GrahamDennis:gdennis/fix-heap-use-after-free

Conversation

@GrahamDennis
Copy link
Contributor

@GrahamDennis GrahamDennis commented Dec 11, 2025 •
edited
Loading

Motivation

Under high build load, we were seeing the nix daemon segfault around here. Further investigation suggested that this was a heap-use-after-free issue where the initialOutputs field referenced data in an activation frame that had since gone out of scope.

I believe the issue is caused by going through this while loop 3+ times:

  1. The DerivationBuilder is constructed taking a reference to initialOutputs. The build doesn't complete but hits this continue statement here. Importantly, the DerivationBuilder is stored in the DerivationBuildingGoal
  2. The number of current builds is greater or equal to the maximum number of builds and we call co_return tryToBuild() here. Importantly, I believe co_return of this form is implemented like a tail call, so the current tryToBuild activation frame is destroyed and hence initialOutputs referenced by the builder is destroyed too.
  3. Inside builder->startBuild() triggers the heap-use-after-free issue.

There are a few other ways this could be fixed:

  • by deleting this line and instead performing the build with another iteration of the while loop. Edit: This would cause a nix build without path locks. That would be bad.
  • by inserting builder.reset() around this line.

Context

Add 👍 to pull requests you find important.

The Nix maintainer team uses a GitHub project board to schedule and track reviews.

@edolstra edolstra added backport 2.32-maintenance Automatically creates a PR against the branch backport 2.33-maintenance Automatically creates a PR against the branch labels Dec 12, 2025
@edolstra
Copy link
Member

edolstra commented Dec 12, 2025

I guess this started happening because a30bf96 changed initialOutputs from a member of the goal object (which should outlive DerivationBuilderParams) to a local variable.

Another fix would be to allocate initialOutputs on the heap using make_ref and storing a ref<const std::map<...>> in DerivationBuilderParams. That avoids copying the map.

@xokdvium xokdvium added this pull request to the merge queue Dec 13, 2025
@xokdvium
Copy link
Contributor

xokdvium commented Dec 13, 2025

on the heap using make_ref and storing a ref<const std::map<...>> in DerivationBuilderParams. That avoids copying the map.

With coroutines this seems like a safer bet in terms of ownership. We can do this in a follow-up on master, but I doubt we should ever be worrying about copying a pretty small map anyway.

Merged via the queue into NixOS:master with commit 8358409 Dec 13, 2025
19 checks passed
@internal-nix-ci
Copy link

internal-nix-ci bot commented Dec 13, 2025

Successfully created backport PR for 2.32-maintenance:

@internal-nix-ci internal-nix-ci bot mentioned this pull request Dec 13, 2025
Merged
@internal-nix-ci
Copy link

internal-nix-ci bot commented Dec 13, 2025

Successfully created backport PR for 2.33-maintenance:

@internal-nix-ci internal-nix-ci bot mentioned this pull request Dec 13, 2025
Merged
@Ericson2314
Copy link
Member

Ericson2314 commented Dec 14, 2025

This is good fora backport, but I hope for #14788 we can go in the other direction of having a simpler lifetime for the builder instead.

philiptaron added a commit to philiptaron/nixpkgs that referenced this pull request Jan 5, 2026
@philiptaron
nixVersions.nix_2_32: 2.32.4 -> 2.32.5
85a694a 
- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

  Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.

- **Fix segfault when querying non-existent derivation files** ([NixOS#14571](NixOS/nix#14571), [NixOS#14572](NixOS/nix#14572))

  Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.

- **Fix RestrictedStore::addDependency crash** ([NixOS#14729](NixOS/nix#14729))

  Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.

- **Fix "dynamic attributes not allowed in let" regression** ([NixOS#14642](NixOS/nix#14642), [NixOS#14646](NixOS/nix#14646))

  Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.

- **Fix fetchGit with `ref = "HEAD"` regression** ([NixOS#13948](NixOS/nix#13948), [NixOS#14672](NixOS/nix#14672))

  `fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".

- **Fix unnecessary substituter queries** ([NixOS#14836](NixOS/nix#14836), [NixOS#14837](NixOS/nix#14837))

  Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.

- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([NixOS#14792](NixOS/nix#14792))

  When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".

- **Fix file system race conditions in store optimization** ([NixOS#14676](NixOS/nix#14676), [NixOS#7273](NixOS/nix#7273))

  Multiple fixes to `optimizePath_`:
  - Actually call `remove()` when `rename()` fails
  - Propagate error codes in `createSymlink()`
  - Make `AutoDelete` non-copyable and non-movable to prevent use-after-free

- **Include path in world-writable error messages** ([NixOS#14785](NixOS/nix#14785))

  The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.

- **Documentation: correct `build-dir` error information** ([NixOS#14745](NixOS/nix#14745))

  Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.

- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues

---

Diff: NixOS/nix@2.32.4...2.32.5
philiptaron added a commit to philiptaron/nixpkgs that referenced this pull request Jan 5, 2026
@philiptaron
nixVersions.nix_2_32: 2.32.4 -> 2.32.5
dad8d3a 
# Changelog: Nix 2.32.5

## Bug Fixes

### Critical Crashes Fixed

- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

  Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.

- **Fix segfault when querying non-existent derivation files** ([NixOS#14571](NixOS/nix#14571), [NixOS#14572](NixOS/nix#14572))

  Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.

- **Fix RestrictedStore::addDependency crash** ([NixOS#14729](NixOS/nix#14729))

  Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.

### Regressions Fixed

- **Fix "dynamic attributes not allowed in let" regression** ([NixOS#14642](NixOS/nix#14642), [NixOS#14646](NixOS/nix#14646))

  Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.

- **Fix fetchGit with `ref = "HEAD"` regression** ([NixOS#13948](NixOS/nix#13948), [NixOS#14672](NixOS/nix#14672))

  `fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".

- **Fix unnecessary substituter queries** ([NixOS#14836](NixOS/nix#14836), [NixOS#14837](NixOS/nix#14837))

  Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.

### Platform-Specific Fixes

- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([NixOS#14792](NixOS/nix#14792))

  When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".

### Store & File System Fixes

- **Fix file system race conditions in store optimization** ([NixOS#14676](NixOS/nix#14676), [NixOS#7273](NixOS/nix#7273))

  Multiple fixes to `optimizePath_`:
  - Actually call `remove()` when `rename()` fails
  - Propagate error codes in `createSymlink()`
  - Make `AutoDelete` non-copyable and non-movable to prevent use-after-free

## Improvements

- **Include path in world-writable error messages** ([NixOS#14785](NixOS/nix#14785))

  The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.

- **Documentation: correct `build-dir` error information** ([NixOS#14745](NixOS/nix#14745))

  Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.

## Maintenance

- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues
- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

---

Diff: NixOS/nix@2.32.4...2.32.5
@philiptaron philiptaron mentioned this pull request Jan 5, 2026
Merged
13 tasks
vdemeester pushed a commit to vdemeester/nixpkgs that referenced this pull request Jan 8, 2026
@philiptaron @vdemeester
nixVersions.nix_2_32: 2.32.4 -> 2.32.5
984e80b 
# Changelog: Nix 2.32.5

## Bug Fixes

### Critical Crashes Fixed

- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

  Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.

- **Fix segfault when querying non-existent derivation files** ([NixOS#14571](NixOS/nix#14571), [NixOS#14572](NixOS/nix#14572))

  Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.

- **Fix RestrictedStore::addDependency crash** ([NixOS#14729](NixOS/nix#14729))

  Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.

### Regressions Fixed

- **Fix "dynamic attributes not allowed in let" regression** ([NixOS#14642](NixOS/nix#14642), [NixOS#14646](NixOS/nix#14646))

  Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.

- **Fix fetchGit with `ref = "HEAD"` regression** ([NixOS#13948](NixOS/nix#13948), [NixOS#14672](NixOS/nix#14672))

  `fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".

- **Fix unnecessary substituter queries** ([NixOS#14836](NixOS/nix#14836), [NixOS#14837](NixOS/nix#14837))

  Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.

### Platform-Specific Fixes

- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([NixOS#14792](NixOS/nix#14792))

  When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".

### Store & File System Fixes

- **Fix file system race conditions in store optimization** ([NixOS#14676](NixOS/nix#14676), [NixOS#7273](NixOS/nix#7273))

  Multiple fixes to `optimizePath_`:
  - Actually call `remove()` when `rename()` fails
  - Propagate error codes in `createSymlink()`
  - Make `AutoDelete` non-copyable and non-movable to prevent use-after-free

## Improvements

- **Include path in world-writable error messages** ([NixOS#14785](NixOS/nix#14785))

  The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.

- **Documentation: correct `build-dir` error information** ([NixOS#14745](NixOS/nix#14745))

  Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.

## Maintenance

- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues
- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

---

Diff: NixOS/nix@2.32.4...2.32.5
vdemeester pushed a commit to vdemeester/nixpkgs that referenced this pull request Jan 9, 2026
@philiptaron @vdemeester
nixVersions.nix_2_32: 2.32.4 -> 2.32.5
854a3bb 
# Changelog: Nix 2.32.5

## Bug Fixes

### Critical Crashes Fixed

- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

  Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.

- **Fix segfault when querying non-existent derivation files** ([NixOS#14571](NixOS/nix#14571), [NixOS#14572](NixOS/nix#14572))

  Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.

- **Fix RestrictedStore::addDependency crash** ([NixOS#14729](NixOS/nix#14729))

  Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.

### Regressions Fixed

- **Fix "dynamic attributes not allowed in let" regression** ([NixOS#14642](NixOS/nix#14642), [NixOS#14646](NixOS/nix#14646))

  Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.

- **Fix fetchGit with `ref = "HEAD"` regression** ([NixOS#13948](NixOS/nix#13948), [NixOS#14672](NixOS/nix#14672))

  `fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".

- **Fix unnecessary substituter queries** ([NixOS#14836](NixOS/nix#14836), [NixOS#14837](NixOS/nix#14837))

  Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.

### Platform-Specific Fixes

- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([NixOS#14792](NixOS/nix#14792))

  When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".

### Store & File System Fixes

- **Fix file system race conditions in store optimization** ([NixOS#14676](NixOS/nix#14676), [NixOS#7273](NixOS/nix#7273))

  Multiple fixes to `optimizePath_`:
  - Actually call `remove()` when `rename()` fails
  - Propagate error codes in `createSymlink()`
  - Make `AutoDelete` non-copyable and non-movable to prevent use-after-free

## Improvements

- **Include path in world-writable error messages** ([NixOS#14785](NixOS/nix#14785))

  The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.

- **Documentation: correct `build-dir` error information** ([NixOS#14745](NixOS/nix#14745))

  Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.

## Maintenance

- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues
- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

---

Diff: NixOS/nix@2.32.4...2.32.5
vdemeester pushed a commit to vdemeester/nixpkgs that referenced this pull request Jan 10, 2026
@philiptaron @vdemeester
nixVersions.nix_2_32: 2.32.4 -> 2.32.5
3308e0d 
# Changelog: Nix 2.32.5

## Bug Fixes

### Critical Crashes Fixed

- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

  Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.

- **Fix segfault when querying non-existent derivation files** ([NixOS#14571](NixOS/nix#14571), [NixOS#14572](NixOS/nix#14572))

  Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.

- **Fix RestrictedStore::addDependency crash** ([NixOS#14729](NixOS/nix#14729))

  Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.

### Regressions Fixed

- **Fix "dynamic attributes not allowed in let" regression** ([NixOS#14642](NixOS/nix#14642), [NixOS#14646](NixOS/nix#14646))

  Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.

- **Fix fetchGit with `ref = "HEAD"` regression** ([NixOS#13948](NixOS/nix#13948), [NixOS#14672](NixOS/nix#14672))

  `fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".

- **Fix unnecessary substituter queries** ([NixOS#14836](NixOS/nix#14836), [NixOS#14837](NixOS/nix#14837))

  Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.

### Platform-Specific Fixes

- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([NixOS#14792](NixOS/nix#14792))

  When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".

### Store & File System Fixes

- **Fix file system race conditions in store optimization** ([NixOS#14676](NixOS/nix#14676), [NixOS#7273](NixOS/nix#7273))

  Multiple fixes to `optimizePath_`:
  - Actually call `remove()` when `rename()` fails
  - Propagate error codes in `createSymlink()`
  - Make `AutoDelete` non-copyable and non-movable to prevent use-after-free

## Improvements

- **Include path in world-writable error messages** ([NixOS#14785](NixOS/nix#14785))

  The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.

- **Documentation: correct `build-dir` error information** ([NixOS#14745](NixOS/nix#14745))

  Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.

## Maintenance

- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues
- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

---

Diff: NixOS/nix@2.32.4...2.32.5
vdemeester pushed a commit to vdemeester/nixpkgs that referenced this pull request Jan 11, 2026
@philiptaron @vdemeester
nixVersions.nix_2_32: 2.32.4 -> 2.32.5
896cc48 
# Changelog: Nix 2.32.5

## Bug Fixes

### Critical Crashes Fixed

- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

  Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.

- **Fix segfault when querying non-existent derivation files** ([NixOS#14571](NixOS/nix#14571), [NixOS#14572](NixOS/nix#14572))

  Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.

- **Fix RestrictedStore::addDependency crash** ([NixOS#14729](NixOS/nix#14729))

  Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.

### Regressions Fixed

- **Fix "dynamic attributes not allowed in let" regression** ([NixOS#14642](NixOS/nix#14642), [NixOS#14646](NixOS/nix#14646))

  Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.

- **Fix fetchGit with `ref = "HEAD"` regression** ([NixOS#13948](NixOS/nix#13948), [NixOS#14672](NixOS/nix#14672))

  `fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".

- **Fix unnecessary substituter queries** ([NixOS#14836](NixOS/nix#14836), [NixOS#14837](NixOS/nix#14837))

  Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.

### Platform-Specific Fixes

- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([NixOS#14792](NixOS/nix#14792))

  When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".

### Store & File System Fixes

- **Fix file system race conditions in store optimization** ([NixOS#14676](NixOS/nix#14676), [NixOS#7273](NixOS/nix#7273))

  Multiple fixes to `optimizePath_`:
  - Actually call `remove()` when `rename()` fails
  - Propagate error codes in `createSymlink()`
  - Make `AutoDelete` non-copyable and non-movable to prevent use-after-free

## Improvements

- **Include path in world-writable error messages** ([NixOS#14785](NixOS/nix#14785))

  The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.

- **Documentation: correct `build-dir` error information** ([NixOS#14745](NixOS/nix#14745))

  Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.

## Maintenance

- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues
- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

---

Diff: NixOS/nix@2.32.4...2.32.5
vdemeester pushed a commit to vdemeester/nixpkgs that referenced this pull request Jan 12, 2026
@philiptaron @vdemeester
nixVersions.nix_2_32: 2.32.4 -> 2.32.5
e7154e3 
# Changelog: Nix 2.32.5

## Bug Fixes

### Critical Crashes Fixed

- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

  Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.

- **Fix segfault when querying non-existent derivation files** ([NixOS#14571](NixOS/nix#14571), [NixOS#14572](NixOS/nix#14572))

  Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.

- **Fix RestrictedStore::addDependency crash** ([NixOS#14729](NixOS/nix#14729))

  Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.

### Regressions Fixed

- **Fix "dynamic attributes not allowed in let" regression** ([NixOS#14642](NixOS/nix#14642), [NixOS#14646](NixOS/nix#14646))

  Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.

- **Fix fetchGit with `ref = "HEAD"` regression** ([NixOS#13948](NixOS/nix#13948), [NixOS#14672](NixOS/nix#14672))

  `fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".

- **Fix unnecessary substituter queries** ([NixOS#14836](NixOS/nix#14836), [NixOS#14837](NixOS/nix#14837))

  Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.

### Platform-Specific Fixes

- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([NixOS#14792](NixOS/nix#14792))

  When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".

### Store & File System Fixes

- **Fix file system race conditions in store optimization** ([NixOS#14676](NixOS/nix#14676), [NixOS#7273](NixOS/nix#7273))

  Multiple fixes to `optimizePath_`:
  - Actually call `remove()` when `rename()` fails
  - Propagate error codes in `createSymlink()`
  - Make `AutoDelete` non-copyable and non-movable to prevent use-after-free

## Improvements

- **Include path in world-writable error messages** ([NixOS#14785](NixOS/nix#14785))

  The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.

- **Documentation: correct `build-dir` error information** ([NixOS#14745](NixOS/nix#14745))

  Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.

## Maintenance

- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues
- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

---

Diff: NixOS/nix@2.32.4...2.32.5
vdemeester pushed a commit to vdemeester/nixpkgs that referenced this pull request Jan 13, 2026
@philiptaron @vdemeester
nixVersions.nix_2_32: 2.32.4 -> 2.32.5
80cc66a 
# Changelog: Nix 2.32.5

## Bug Fixes

### Critical Crashes Fixed

- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

  Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.

- **Fix segfault when querying non-existent derivation files** ([NixOS#14571](NixOS/nix#14571), [NixOS#14572](NixOS/nix#14572))

  Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.

- **Fix RestrictedStore::addDependency crash** ([NixOS#14729](NixOS/nix#14729))

  Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.

### Regressions Fixed

- **Fix "dynamic attributes not allowed in let" regression** ([NixOS#14642](NixOS/nix#14642), [NixOS#14646](NixOS/nix#14646))

  Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.

- **Fix fetchGit with `ref = "HEAD"` regression** ([NixOS#13948](NixOS/nix#13948), [NixOS#14672](NixOS/nix#14672))

  `fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".

- **Fix unnecessary substituter queries** ([NixOS#14836](NixOS/nix#14836), [NixOS#14837](NixOS/nix#14837))

  Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.

### Platform-Specific Fixes

- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([NixOS#14792](NixOS/nix#14792))

  When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".

### Store & File System Fixes

- **Fix file system race conditions in store optimization** ([NixOS#14676](NixOS/nix#14676), [NixOS#7273](NixOS/nix#7273))

  Multiple fixes to `optimizePath_`:
  - Actually call `remove()` when `rename()` fails
  - Propagate error codes in `createSymlink()`
  - Make `AutoDelete` non-copyable and non-movable to prevent use-after-free

## Improvements

- **Include path in world-writable error messages** ([NixOS#14785](NixOS/nix#14785))

  The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.

- **Documentation: correct `build-dir` error information** ([NixOS#14745](NixOS/nix#14745))

  Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.

## Maintenance

- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues
- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

---

Diff: NixOS/nix@2.32.4...2.32.5
vdemeester pushed a commit to vdemeester/nixpkgs that referenced this pull request Jan 14, 2026
@philiptaron @vdemeester
nixVersions.nix_2_32: 2.32.4 -> 2.32.5
cc46ce9 
# Changelog: Nix 2.32.5

## Bug Fixes

### Critical Crashes Fixed

- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

  Fixed a daemon segfault that could occur under high build load. The issue was caused by the `initialOutputs` field referencing data from an activation frame that had gone out of scope during coroutine tail-call optimization in the build scheduler.

- **Fix segfault when querying non-existent derivation files** ([NixOS#14571](NixOS/nix#14571), [NixOS#14572](NixOS/nix#14572))

  Running `nix derivation show /nix/store/...-doesnotexist.drv` would crash with a segfault. Now properly returns an "invalid store path" error.

- **Fix RestrictedStore::addDependency crash** ([NixOS#14729](NixOS/nix#14729))

  Fixed a crash caused by incorrect non-virtual interface pattern implementation that led to bad recursion/UB in `addDependencyPrep`.

### Regressions Fixed

- **Fix "dynamic attributes not allowed in let" regression** ([NixOS#14642](NixOS/nix#14642), [NixOS#14646](NixOS/nix#14646))

  Expressions like `let a = 1; "b" = 2; ${"c"} = 3; in [ a b c ]` that worked in 2.30 would incorrectly fail in 2.32.x. This was caused by the ExprString arena optimization, which has been reverted.

- **Fix fetchGit with `ref = "HEAD"` regression** ([NixOS#13948](NixOS/nix#13948), [NixOS#14672](NixOS/nix#14672))

  `fetchGit { url = "..."; ref = "HEAD"; }` was broken and returned "revspec 'HEAD' not found".

- **Fix unnecessary substituter queries** ([NixOS#14836](NixOS/nix#14836), [NixOS#14837](NixOS/nix#14837))

  Fixed a regression where Nix would query all substituters (including `cache.nixos.org`) even when a higher-priority local substituter already had the path. This caused unnecessary network traffic.

### Platform-Specific Fixes

- **Fix curl with c-ares failing DNS resolution in macOS sandbox** ([NixOS#14792](NixOS/nix#14792))

  When curl is built with c-ares (as in recent nixpkgs), DNS resolution would fail inside the Nix build sandbox on macOS with "Could not contact DNS servers".

### Store & File System Fixes

- **Fix file system race conditions in store optimization** ([NixOS#14676](NixOS/nix#14676), [NixOS#7273](NixOS/nix#7273))

  Multiple fixes to `optimizePath_`:
  - Actually call `remove()` when `rename()` fails
  - Propagate error codes in `createSymlink()`
  - Make `AutoDelete` non-copyable and non-movable to prevent use-after-free

## Improvements

- **Include path in world-writable error messages** ([NixOS#14785](NixOS/nix#14785))

  The error message for world-writable directory checks now includes the specific path that failed, making debugging easier.

- **Documentation: correct `build-dir` error information** ([NixOS#14745](NixOS/nix#14745))

  Fixed out-of-date information in the manual about `build-dir` errors and added links to relevant settings.

## Maintenance

- CI improvements: added `upload-release.yml` workflow, improved Docker push workflow configurability, updated magic-nix-cache with post-build-hook fix
- Documented maintainer git tag signing process
- Fixed lowdown override compatibility with newer nixpkgs
- Removed mdbook-linkcheck and added support for mdbook 0.5.x
- Remove static data from headers to fix compilation issues
- **Fix heap-use-after-free crash under high build load** ([NixOS#14772](NixOS/nix#14772))

---

Diff: NixOS/nix@2.32.4...2.32.5
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@edolstra edolstra edolstra approved these changes

@Ericson2314 Ericson2314 Awaiting requested review from Ericson2314 Ericson2314 is a code owner

Assignees

No one assigned

Labels

backport 2.32-maintenance Automatically creates a PR against the branch backport 2.33-maintenance Automatically creates a PR against the branch

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@GrahamDennis @edolstra @xokdvium @Ericson2314