From sergeyb at tarantool.org  Tue Jul  1 11:53:14 2025
From: sergeyb at tarantool.org (Sergey Bronnikov)
Date: Tue, 1 Jul 2025 11:53:14 +0300
Subject: [Tarantool-patches] [PATCH luajit] ARM64: Fix LDP/STP fusing
 for unaligned accesses.
In-Reply-To: <aGI8IIVX8HfKci7G@root>
References: <20250626151224.27925-1-skaplun@tarantool.org>
 <63170032-dc7a-47e4-ad84-9627a02070e0@tarantool.org> <aGI8IIVX8HfKci7G@root>
Message-ID: <667dfdf8-5fe0-4656-89d0-b6eaf0cb8836@tarantool.org>

Thanks! LGTM

On 6/30/25 10:26, Sergey Kaplun wrote:
> Hi, Sergey!
> Thanks for the review!
> Fixed your comments and force-pushed the branch.
>
> On 27.06.25, Sergey Bronnikov wrote:
>> Hi, Sergey,
>>
>> thanks for the patch! LGTM with a minor two comments below.
>>
>> Sergey
>>
>> On 6/26/25 18:12, Sergey Kaplun wrote:
>>> From: Mike Pall <mike>
>>>
>>> Thanks to Peter Cawley.
>>>
>>> (cherry picked from commit 0fa2f1cbcf023ad0549f1428809e506fa2c78552)
>>>
>>> The arm64 emitting of load/store operation works incorrectly in the
>>> case when at least one offset of load/store to be fused into ldp/stp is
>>> misaligned. In this case this misaligning is ignored, and instructions
>>> are fused, which leads to loading/storing from/to at least one incorrect
>>> address.
>>>
>>> For example, the following instructions:
>>> | stur  w0, [x1, #17]
>>> | stur  w0, [x1, #21]
>>>
>>> May be fused to the following:
>>> | stp   w0, w0, [x1, #16]
>>>
>>> This patch prevents fusion in this case by testing the alignment with
>>> the help of bitwise ROR by the alignment value. In case of misaligned
>>> offset, the value overflows the 7-bit length mask in the check.
>>>
>>> The negative immediate (7-bit width including sign bit) is limited by
>>> the corresponding addition of `64 << sc` (it is harmless in the case of
>>> positive values).
>>>
>>> Sergey Kaplun:
>>> * added the description and the test for the problem
>>>
>>> Part of tarantool/tarantool#11278
>>> ---
>>>
>>> Related issues:
>>> *https://github.com/LuaJIT/LuaJIT/issues/1056
>>> *https://github.com/tarantool/tarantool/issues/11278
>>> Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1056-arm64-ldp-sdp-misaligned-fusing
>>>
>>>    src/lj_emit_arm64.h                           |  2 +-
>>>    ...6-arm64-ldp-sdp-misaligned-fusing.test.lua | 98 +++++++++++++++++++
>>>    2 files changed, 99 insertions(+), 1 deletion(-)
>>>    create mode 100644 test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua
>>>
>>> diff --git a/src/lj_emit_arm64.h b/src/lj_emit_arm64.h
>>> index 30cd3505..5c1bc372 100644
>>> --- a/src/lj_emit_arm64.h
>>> +++ b/src/lj_emit_arm64.h
> <snipped>
>
>>> diff --git a/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua b/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua
>>> new file mode 100644
>>> index 00000000..5d03097e
>>> --- /dev/null
>>> +++ b/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua
>>> @@ -0,0 +1,98 @@
>>> +local tap = require('tap')
>>> +local ffi = require('ffi')
>>> +
>>> +-- This test demonstrates LuaJIT's incorrect emitting of LDP/STP
>>> +-- instructions from LDUR/STUR instructions with misaligned offset
>>> +-- on arm64.
>>> +-- Seealsohttps://github.com/LuaJIT/LuaJIT/issue/1056.
>> s/issue/issues/
> Fixed, thanks!
>
> ===================================================================
> diff --git a/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua b/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua
> index 815da15d..5ff040e7 100644
> --- a/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua
> +++ b/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua
> @@ -4,7 +4,7 @@ local ffi = require('ffi')
>   -- This test demonstrates LuaJIT's incorrect emitting of LDP/STP
>   -- instructions from LDUR/STUR instructions with misaligned offset
>   -- on arm64.
> --- See alsohttps://github.com/LuaJIT/LuaJIT/issue/1056.
> +-- See alsohttps://github.com/LuaJIT/LuaJIT/issues/1056.
>   local test = tap.test('lj-1056-arm64-ldp-sdp-misaligned-fusing'):skipcond({
>     ['Test requires JIT enabled'] = not jit.status(),
>   })
> ===================================================================
>
>>> +local test = tap.test('lj-1056-arm64-ldp-sdp-misaligned-fusing'):skipcond({
>>> +  ['Test requires JIT enabled'] = not jit.status(),
>>> +})
>>> +
> <snipped>
>
>>> +
>>> +test:is(resl, 0x4030201, 'pair of misaligned loads, left')
>>> +test:is(resr, 0x8070605, 'pair of misaligned loads, right')
>> What does mean these magic numbers? Please add a comment or
>>
>> use a variable with self-explained name. Here and below.
> Added the comments nearby, see the corresponding patch below:
>
> ===================================================================
> diff --git a/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua b/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua
> index 5d03097e..815da15d 100644
> --- a/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua
> +++ b/test/tarantool-tests/lj-1056-arm64-ldp-sdp-misaligned-fusing.test.lua
> @@ -81,6 +81,8 @@ for _ = 1, N_ITERATIONS do
>     resr = ffi.cast('int32_t *', ptr + 5)[0]
>   end
>   
> +-- Values are resulted from the `init_buf()` function with the
> +-- corresponding offset.
>   test:is(resl, 0x4030201, 'pair of misaligned loads, left')
>   test:is(resr, 0x8070605, 'pair of misaligned loads, right')
>   
> @@ -92,6 +94,8 @@ for _ = 1, N_ITERATIONS do
>     resl = ffi.cast('int32_t *', ptr)[0]
>   end
>   
> +-- Values are resulted from the `init_buf()` function with the
> +-- corresponding offset.
>   test:is(resl, 0x3020100, 'aligned / misaligned load, aligned')
>   test:is(resr, 0x8070605, 'aligned / misaligned load, misaligned')
>   
> ===================================================================
>
> <snipped>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.tarantool.org/pipermail/tarantool-patches/attachments/20250701/e64a4166/attachment.htm>

From sergeyb at tarantool.org  Tue Jul  1 17:58:47 2025
From: sergeyb at tarantool.org (Sergey Bronnikov)
Date: Tue, 1 Jul 2025 17:58:47 +0300
Subject: [Tarantool-patches] [PATCH luajit] Fix error generation in
 load*.
In-Reply-To: <20250610155947.27340-1-skaplun@tarantool.org>
References: <20250610155947.27340-1-skaplun@tarantool.org>
Message-ID: <948ca0df-1cd7-4740-a20b-b1fa26ca92d0@tarantool.org>

Hi, Sergey!

thanks for the patch! LGTM

Sergey

On 6/10/25 18:59, Sergey Kaplun wrote:
> From: Mike Pall <mike>
>
> Reported by Sergey Kaplun.
>
> (cherry picked from commit e76bb50d44702f601ec5dd167b03b475ed53860c)
>
> The chunkname pointer to the "@filename" is put on the Lua stack
> before the `lua_loadx()` and is removed right before the next
> `lua_pushfstring()` in case of the error. If the GC takes the step
> right at this moment inside `lua_pushfstring()` the string may be
> collected, and the next read from this `chunkname + 1` is from the
> deallocated memory.
>
> This patch fixes this by using the source string (or the constant one)
> instead.
>
> Sergey Kaplun:
> * added the description and the test for the problem
>
> Part of tarantool/tarantool#11278
> ---
>
> Related issues:
> *https://github.com/LuaJIT/LuaJIT/issues/1353
> *https://github.com/tarantool/tarantool/issues/11278
> Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1353-loadfile-err-use-after-free
>
>
>   src/lj_load.c                                 |  3 +-
>   ...-1353-loadfile-err-use-after-free.test.lua | 39 +++++++++++++++++++
>   2 files changed, 41 insertions(+), 1 deletion(-)
>   create mode 100644 test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua
>
> diff --git a/src/lj_load.c b/src/lj_load.c
> index fdbc54cb..205686bb 100644
> --- a/src/lj_load.c
> +++ b/src/lj_load.c
> @@ -108,8 +108,9 @@ LUALIB_API int luaL_loadfilex(lua_State *L, const char *filename,
>       copyTV(L, L->top-1, L->top);
>     }
>     if (err) {
> +    const char *fname = filename ? filename : "stdin";
>       L->top--;
> -    lua_pushfstring(L, "cannot read %s: %s", chunkname+1, strerror(err));
> +    lua_pushfstring(L, "cannot read %s: %s", fname, strerror(err));
>       return LUA_ERRFILE;
>     }
>     return status;
> diff --git a/test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua b/test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua
> new file mode 100644
> index 00000000..3aa02f3b
> --- /dev/null
> +++ b/test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua
> @@ -0,0 +1,39 @@
> +local tap = require('tap')
> +
> +-- Test file to demonstrate LuaJIT use-after-free in case of the
> +-- error in `loadfile()`.
> +-- See also:https://github.com/LuaJIT/LuaJIT/issues/1353.
> +local test = tap.test('lj-1353-loadfile-err-use-after-free'):skipcond({
> +  ['Too many GC objects on start'] = _TARANTOOL,
> +})
> +
> +test:plan(1)
> +
> +-- Determine the GC step size to finish the GC cycle in one step.
> +local full_step = 1
> +while true do
> +  collectgarbage('collect')
> +  collectgarbage('setpause', 0)
> +  collectgarbage('setstepmul', full_step)
> +  if collectgarbage('step') then break end
> +  full_step = full_step + 1
> +end
> +
> +-- Check all possible GC step sizes.
> +for i = 1, full_step do
> +  collectgarbage('collect')
> +  collectgarbage('setpause', 0)
> +  collectgarbage('setstepmul', i)
> +  repeat
> +    -- On Linux-like systems this always returns `nil`, with the
> +    -- error: "cannot read .: Is a directory"
> +    -- The string for the filename "@." may be collected during
> +    -- the call, and later the pointer to the "." from that string
> +    -- is used after the string is free.
> +    loadfile('.')
> +  until collectgarbage('step')
> +end
> +
> +test:ok(true, 'no use-after-free error')
> +
> +test:done(true)
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.tarantool.org/pipermail/tarantool-patches/attachments/20250701/d8f9557a/attachment.htm>