Update crossbeam-channel and adopt jemalloc - #73
Open
aniketfuryrocks wants to merge 2 commits into
Open
Conversation
Two hardening changes after two in-production glibc heap-corruption
aborts ("corrupted size vs. prev_size" 2026-07-05, malloc.c:2601
sysmalloc assertion 2026-07-09), each after hours of sustained
~30k packets/s:
- Bump crossbeam-channel 0.5.14 -> 0.5.15. 0.5.12-0.5.14 are
vulnerable to RUSTSEC-2025-0024 / CVE-2025-4574, a race in
Channel::drop / discard_all_messages that double-frees a heap
block and corrupts allocator metadata. This was the only known
memory-corruption defect in the dependency closure (OSV sweep of
the remaining hot-path crates came back clean), and the hot path
pushes every shred batch through this crate.
- Use jemalloc as the global allocator, mirroring agave's binaries.
The proxy was the only piece of this solana stack running glibc
malloc; agave runs jemalloc fleet-wide, so glibc-only heap-layout
fragility in shared code paths detonates here first.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
crossbeam-channelfrom 0.5.14 to 0.5.15, resolving RUSTSEC-2025-0024 / CVE-2025-4574Production validation
This build has run for more than eight days under the same sustained production workload without another heap-corruption abort or crash. Because the dependency upgrade and allocator change were deployed together, the soak result does not isolate which change prevented recurrence.
Testing
cargo fmt --all -- --checkcargo clippy --all-features --all-targets --tests -- -D warningscargo test --workspace --all-features(14 proxy tests pass; three unrelated deshred/UDP tests fail identically onorigin/masteron macOS)Fixes #72