[Tarantool-patches] [PATCH luajit 4/6] FFI: Fix dangling reference to CType.
Sergey Kaplun
skaplun at tarantool.org
Mon Oct 23 12:22:04 MSK 2023
From: Mike Pall <mike>
(cherry-picked from commit ae533e3a6c009b5df79b11cd5787d249202fa69c)
During the conversion of a cdata function object to some cdata value in
`lj_cconv_ct_tv()`, reallocation of `cts->tab` in `lj_ctype_intern()`
may occur. In that case, the reference to the `CType` object becomes
invalid. This patch saves the `CTypeID` of the given function and gets
its `CType` again after possible reallocation.
Sergey Kaplun:
* added the description and the test for the problem
Part of tarantool/tarantool#9145
---
src/lj_cconv.c | 2 +
.../fix-dangling-reference-to-ctype.test.lua | 59 +++++++++++++++++++
2 files changed, 61 insertions(+)
create mode 100644 test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua
diff --git a/src/lj_cconv.c b/src/lj_cconv.c
index 37c88852..94ca93bb 100644
--- a/src/lj_cconv.c
+++ b/src/lj_cconv.c
@@ -568,7 +568,9 @@ void lj_cconv_ct_tv(CTState *cts, CType *d,
}
s = ctype_raw(cts, sid);
if (ctype_isfunc(s->info)) {
+ CTypeID did = ctype_typeid(cts, d);
sid = lj_ctype_intern(cts, CTINFO(CT_PTR, CTALIGN_PTR|sid), CTSIZE_PTR);
+ d = ctype_get(cts, did); /* cts->tab may have been reallocated. */
} else {
if (ctype_isenum(s->info)) s = ctype_child(cts, s);
goto doconv;
diff --git a/test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua b/test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua
new file mode 100644
index 00000000..c0e2c07b
--- /dev/null
+++ b/test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua
@@ -0,0 +1,59 @@
+local tap = require('tap')
+local ffi = require('ffi')
+local test = tap.test('fix-dangling-reference-to-ctype'):skipcond({
+ -- luacheck: no global
+ ['Impossible to predict the value of cts->top'] = _TARANTOOL,
+})
+
+test:plan(1)
+
+-- This test demonstrates LuaJIT's incorrect behaviour when the
+-- reallocation of `cts->tab` strikes during the conversion of a
+-- TValue (cdata function pointer) to a C type.
+-- The test fails under ASAN.
+
+-- XXX: Just some C functions to be casted. There is no need to
+-- declare their prototypes correctly.
+ffi.cdef[[
+ int malloc(void);
+ int fprintf(void);
+ int printf(void);
+ int memset(void);
+ int memcpy(void);
+ int memmove(void);
+ int getppid(void);
+]]
+
+-- XXX: structure to set `cts->top` to 110.
+local _ = ffi.new('struct {int a; long b; float c; double d;}', 0)
+
+-- Anchor table to prevent cdata objects from being collected.
+local anchor = {}
+-- Each call to this function grows `cts->top` by 3.
+local function save_new_func(func)
+ anchor[#anchor + 1] = ffi.cast('void (*)(void)', func)
+end
+
+save_new_func(ffi.C.malloc) -- `cts->top` = 110
+save_new_func(ffi.C.fprintf) -- `cts->top` = 113
+save_new_func(ffi.C.printf) -- `cts->top` = 116
+save_new_func(ffi.C.memset) -- `cts->top` = 119
+save_new_func(ffi.C.memcpy) -- `cts->top` = 122
+
+-- Assertions to check the `cts->top` value and step between
+-- calls.
+assert(ffi.typeinfo(122), 'cts->top >= 122')
+assert(not ffi.typeinfo(123), 'cts->top < 123')
+
+save_new_func(ffi.C.memmove) -- `cts->top` = 125
+
+assert(ffi.typeinfo(125), 'cts->top >= 125')
+assert(not ffi.typeinfo(126), 'cts->top < 126')
+
+-- Last call to grow `cts->top` up to 128, so this causes
+-- `cts->tab` reallocation.
+save_new_func(ffi.C.getppid) -- `cts->top` = 128
+
+test:ok(true, 'no heap-use-after-free in lj_cconv_ct_tv')
+
+test:done(true)
--
2.42.0
More information about the Tarantool-patches
mailing list