From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from localhost (localhost [127.0.0.1]) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTP id 3BCD22FCCC for ; Sat, 18 May 2019 08:35:16 -0400 (EDT) Received: from turing.freelists.org ([127.0.0.1]) by localhost (turing.freelists.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yRNSCLQ82pVJ for ; Sat, 18 May 2019 08:35:16 -0400 (EDT) Received: from mail-lf1-f67.google.com (mail-lf1-f67.google.com [209.85.167.67]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTPS id D49142FCCB for ; Sat, 18 May 2019 08:35:15 -0400 (EDT) Received: by mail-lf1-f67.google.com with SMTP id q17so7194246lfo.4 for ; Sat, 18 May 2019 05:35:15 -0700 (PDT) From: Cyrill Gorcunov Subject: [tarantool-patches] [PATCH 1/3] Fix overflow of snapshot map offset. Date: Sat, 18 May 2019 15:33:54 +0300 Message-Id: <20190518123356.15780-2-gorcunov@gmail.com> In-Reply-To: <20190518123356.15780-1-gorcunov@gmail.com> References: <20190518123356.15780-1-gorcunov@gmail.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: tarantool-patches-bounce@freelists.org Errors-to: tarantool-patches-bounce@freelists.org Reply-To: tarantool-patches@freelists.org List-Help: List-Unsubscribe: List-software: Ecartis version 1.0.0 List-Id: tarantool-patches List-Subscribe: List-Owner: List-post: List-Archive: To: tml Cc: Alexander Turenko , Kirill Yukhin From: Mike Pall Thanks to Yichun Zhang. backport https://github.com/openresty/luajit2/commit/380e4409a70725df85034f02c968b6ebd7a5e513 Part-of #4171 --- src/lj_jit.h | 10 +++++----- src/lj_opt_loop.c | 8 ++++---- src/lj_snap.c | 6 +++--- 3 files changed, 12 insertions(+), 12 deletions(-) diff --git a/src/lj_jit.h b/src/lj_jit.h index 92054e3..7eb3d2a 100644 --- a/src/lj_jit.h +++ b/src/lj_jit.h @@ -160,7 +160,7 @@ typedef uint32_t MCode; /* Stack snapshot header. */ typedef struct SnapShot { - uint16_t mapofs; /* Offset into snapshot map. */ + uint32_t mapofs; /* Offset into snapshot map. */ IRRef1 ref; /* First IR ref for this snapshot. */ uint8_t nslots; /* Number of valid slots. */ uint8_t topslot; /* Maximum frame extent. */ @@ -227,8 +227,7 @@ typedef enum { /* Trace object. */ typedef struct GCtrace { GCHeader; - uint8_t topslot; /* Top stack slot already checked to be allocated. */ - uint8_t linktype; /* Type of link. */ + uint16_t nsnap; /* Number of snapshots. */ IRRef nins; /* Next IR instruction. Biased with REF_BIAS. */ #if LJ_GC64 uint32_t unused_gc64; @@ -236,8 +235,7 @@ typedef struct GCtrace { GCRef gclist; IRIns *ir; /* IR instructions/constants. Biased with REF_BIAS. */ IRRef nk; /* Lowest IR constant. Biased with REF_BIAS. */ - uint16_t nsnap; /* Number of snapshots. */ - uint16_t nsnapmap; /* Number of snapshot map elements. */ + uint32_t nsnapmap; /* Number of snapshot map elements. */ SnapShot *snap; /* Snapshot array. */ SnapEntry *snapmap; /* Snapshot map. */ GCRef startpt; /* Starting prototype. */ @@ -254,6 +252,8 @@ typedef struct GCtrace { TraceNo1 nextroot; /* Next root trace for same prototype. */ TraceNo1 nextside; /* Next side trace of same root trace. */ uint8_t sinktags; /* Trace has SINK tags. */ + uint8_t topslot; /* Top stack slot already checked to be allocated. */ + uint8_t linktype; /* Type of link. */ uint8_t unused1; #ifdef LUAJIT_USE_GDBJIT void *gdbjit_entry; /* GDB JIT entry. */ diff --git a/src/lj_opt_loop.c b/src/lj_opt_loop.c index 04c6d06..441b8ad 100644 --- a/src/lj_opt_loop.c +++ b/src/lj_opt_loop.c @@ -223,7 +223,7 @@ static void loop_subst_snap(jit_State *J, SnapShot *osnap, } J->guardemit.irt = 0; /* Setup new snapshot. */ - snap->mapofs = (uint16_t)nmapofs; + snap->mapofs = (uint32_t)nmapofs; snap->ref = (IRRef1)J->cur.nins; snap->nslots = nslots; snap->topslot = osnap->topslot; @@ -251,7 +251,7 @@ static void loop_subst_snap(jit_State *J, SnapShot *osnap, nmap += nn; while (omap < nextmap) /* Copy PC + frame links. */ *nmap++ = *omap++; - J->cur.nsnapmap = (uint16_t)(nmap - J->cur.snapmap); + J->cur.nsnapmap = (uint32_t)(nmap - J->cur.snapmap); } typedef struct LoopState { @@ -369,7 +369,7 @@ static void loop_unroll(LoopState *lps) } } if (!irt_isguard(J->guardemit)) /* Drop redundant snapshot. */ - J->cur.nsnapmap = (uint16_t)J->cur.snap[--J->cur.nsnap].mapofs; + J->cur.nsnapmap = (uint32_t)J->cur.snap[--J->cur.nsnap].mapofs; lua_assert(J->cur.nsnapmap <= J->sizesnapmap); *psentinel = J->cur.snapmap[J->cur.snap[0].nent]; /* Restore PC. */ @@ -383,7 +383,7 @@ static void loop_undo(jit_State *J, IRRef ins, SnapNo nsnap, MSize nsnapmap) SnapShot *snap = &J->cur.snap[nsnap-1]; SnapEntry *map = J->cur.snapmap; map[snap->mapofs + snap->nent] = map[J->cur.snap[0].nent]; /* Restore PC. */ - J->cur.nsnapmap = (uint16_t)nsnapmap; + J->cur.nsnapmap = (uint32_t)nsnapmap; J->cur.nsnap = nsnap; J->guardemit.irt = 0; lj_ir_rollback(J, ins); diff --git a/src/lj_snap.c b/src/lj_snap.c index bb063c2..3ff8dd4 100644 --- a/src/lj_snap.c +++ b/src/lj_snap.c @@ -161,11 +161,11 @@ static void snapshot_stack(jit_State *J, SnapShot *snap, MSize nsnapmap) nent = snapshot_slots(J, p, nslots); snap->nent = (uint8_t)nent; nent += snapshot_framelinks(J, p + nent, &snap->topslot); - snap->mapofs = (uint16_t)nsnapmap; + snap->mapofs = (uint32_t)nsnapmap; snap->ref = (IRRef1)J->cur.nins; snap->nslots = (uint8_t)nslots; snap->count = 0; - J->cur.nsnapmap = (uint16_t)(nsnapmap + nent); + J->cur.nsnapmap = (uint32_t)(nsnapmap + nent + 1 + J->framedepth); } /* Add or merge a snapshot. */ @@ -326,7 +326,7 @@ void lj_snap_shrink(jit_State *J) snap->nent = (uint8_t)m; nlim = J->cur.nsnapmap - snap->mapofs - 1; while (n <= nlim) map[m++] = map[n++]; /* Move PC + frame links down. */ - J->cur.nsnapmap = (uint16_t)(snap->mapofs + m); /* Free up space in map. */ + J->cur.nsnapmap = (uint32_t)(snap->mapofs + m); /* Free up space in map. */ } /* -- Snapshot access ----------------------------------------------------- */ -- 2.20.1