[Tarantool-patches] [PATCH luajit 4/6] FFI: Fix dangling reference to CType.

[Sergey Bronnikov]

Hello, Sergey


thanks for the patch!

the test is passed with reverted fix and LuaJIT built under ASAN:


$ nm ./build/src/luajit | grep __asan_init
                  U __asan_init
$ ./build/src/luajit 
test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua
TAP version 13
1..1
ok - no heap-use-after-free in lj_cconv_ct_tv
$

On 10/23/23 12:22, Sergey Kaplun wrote:
> From: Mike Pall <mike>
>
> (cherry-picked from commit ae533e3a6c009b5df79b11cd5787d249202fa69c)
>
> During the conversion of a cdata function object to some cdata value in
> `lj_cconv_ct_tv()`, reallocation of `cts->tab` in `lj_ctype_intern()`
> may occur. In that case, the reference to the `CType` object becomes
> invalid. This patch saves the `CTypeID` of the given function and gets
> its `CType` again after possible reallocation.
>
> Sergey Kaplun:
> * added the description and the test for the problem
>
> Part of tarantool/tarantool#9145
> ---
>   src/lj_cconv.c                                |  2 +
>   .../fix-dangling-reference-to-ctype.test.lua  | 59 +++++++++++++++++++
>   2 files changed, 61 insertions(+)
>   create mode 100644 test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua
>
> diff --git a/src/lj_cconv.c b/src/lj_cconv.c
> index 37c88852..94ca93bb 100644
> --- a/src/lj_cconv.c
> +++ b/src/lj_cconv.c
> @@ -568,7 +568,9 @@ void lj_cconv_ct_tv(CTState *cts, CType *d,
>       }
>       s = ctype_raw(cts, sid);
>       if (ctype_isfunc(s->info)) {
> +      CTypeID did = ctype_typeid(cts, d);
>         sid = lj_ctype_intern(cts, CTINFO(CT_PTR, CTALIGN_PTR|sid), CTSIZE_PTR);
> +      d = ctype_get(cts, did);  /* cts->tab may have been reallocated. */
>       } else {
>         if (ctype_isenum(s->info)) s = ctype_child(cts, s);
>         goto doconv;
> diff --git a/test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua b/test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua
> new file mode 100644
> index 00000000..c0e2c07b
> --- /dev/null
> +++ b/test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua
> @@ -0,0 +1,59 @@
> +local tap = require('tap')
> +local ffi = require('ffi')
> +local test = tap.test('fix-dangling-reference-to-ctype'):skipcond({
> +  -- luacheck: no global
> +  ['Impossible to predict the value of cts->top'] = _TARANTOOL,
> +})
> +
> +test:plan(1)
> +
> +-- This test demonstrates LuaJIT's incorrect behaviour when the
> +-- reallocation of `cts->tab` strikes during the conversion of a
> +-- TValue (cdata function pointer) to a C type.
> +-- The test fails under ASAN.
> +
> +-- XXX: Just some C functions to be casted. There is no need to
> +-- declare their prototypes correctly.
> +ffi.cdef[[
> +  int malloc(void);
> +  int fprintf(void);
> +  int printf(void);
> +  int memset(void);
> +  int memcpy(void);
> +  int memmove(void);
> +  int getppid(void);
> +]]
> +
> +-- XXX: structure to set `cts->top` to 110.
> +local _ = ffi.new('struct {int a; long b; float c; double d;}', 0)
> +
> +-- Anchor table to prevent cdata objects from being collected.
> +local anchor = {}
> +-- Each call to this function grows `cts->top` by 3.
> +local function save_new_func(func)
> +  anchor[#anchor + 1] = ffi.cast('void (*)(void)', func)
> +end
> +
> +save_new_func(ffi.C.malloc)  -- `cts->top` = 110
> +save_new_func(ffi.C.fprintf) -- `cts->top` = 113
> +save_new_func(ffi.C.printf)  -- `cts->top` = 116
> +save_new_func(ffi.C.memset)  -- `cts->top` = 119
> +save_new_func(ffi.C.memcpy)  -- `cts->top` = 122
> +
> +-- Assertions to check the `cts->top` value and step between
> +-- calls.
> +assert(ffi.typeinfo(122), 'cts->top >= 122')
> +assert(not ffi.typeinfo(123), 'cts->top < 123')
> +
> +save_new_func(ffi.C.memmove) -- `cts->top` = 125
> +
> +assert(ffi.typeinfo(125), 'cts->top >= 125')
> +assert(not ffi.typeinfo(126), 'cts->top < 126')
> +
> +-- Last call to grow `cts->top` up to 128, so this causes
> +-- `cts->tab` reallocation.
> +save_new_func(ffi.C.getppid) -- `cts->top` = 128
> +
> +test:ok(true, 'no heap-use-after-free in lj_cconv_ct_tv')
> +
> +test:done(true)