[Tarantool-patches] [PATCH v3] lua: assert in lua_gettop() in case of negative stack size

[Igor Munkin]

I'll add more info for Nikita and Sergos since they are also involved
to the investigation and the patch review.

On 22.07.20, Ilya Kosarev wrote:
> 
> Right, error fixed and now we found more details.

Here are the details:
| (gdb) p ((struct port_lua *)&port)->L
| $1 = (lua_State *) 0x41b8fa08
| (gdb) p ((struct port_lua *)&port)
| $2 = (port_lua *) 0x7ef54107fe30
| (gdb) p ((struct port_lua *)&port)->vtab
| $3 = (const port_vtab *) 0x708d60 <port_lua_vtab>
| (gdb) p ((struct port_lua *)&port)->ref
| $4 = 181

port->ref value is rotten since port->L is removed from Lua registry
within <port_destroy> (i.e. <port_lua_destroy>) function. But the
pointer to port->L is fine.

| (gdb) p ((struct port_lua *)&port)->size
| $5 = -1

size value is initialized to -1 prior to encoding loop, so there is no
<luamp_encode> call.

| (gdb) p ((struct port_lua *)&port)->out
| $6 = (obuf *) 0x7f00098692e8
| (gdb) p ((struct port_lua *)&port)->L->top
| $7 = (TValue *) 0x4107fa08
| (gdb) p ((struct port_lua *)&port)->L->base
| $8 = (TValue *) 0x4107fa10

size value is initialized properly since L->base is greater than L->top
(guest stack addresses grow downwards). Oops...

> Now the best assumption is that lua_State is somehow being broken by
> user-called function (which name we now know).

The port (and ergo port->L coroutine) is created in scope of
<box_process_lua> call. Considering the message type (IPROTO_CALL)
<execute_lua_call> handler is called. Both Ilya and me found nothing
suspicious there: the function to be called is found by its name and
then execution enters Lua space.

Considering the results (<box_process_call> rc is 0) the call succeeds
and execution proceeds with reply packing. There is also nothing
corrupting port->L coroutine internal structure prior to the place
port->size is initialized to -1.

> Now we will look into user code.

For now I see no reason to add even the assert, since Ilya's assumptions
are confirmed.


<snipped>

>  
> --
> Ilya Kosarev
>  

-- 
Best regards,
IM