From: Maxim Kokryashkin via Tarantool-patches <tarantool-patches@dev.tarantool.org> To: tarantool-patches@dev.tarantool.org, skaplun@tarantool.org, sergeyb@tarantool.org Subject: [Tarantool-patches] [PATCH luajit] Fix memory probing allocator to check for valid end address, too. Date: Wed, 31 May 2023 16:28:04 +0300 [thread overview] Message-ID: <20230531132806.216178-1-m.kokryashkin@tarantool.org> (raw) From: Mike Pall <mike> (cherry-picked from commit 646148e747759f0af3b47f9bd287cedd7e174631) Before the patch `mmap_probe` only checked if the allocated chunk start was within the 2^LJ_ALLOC_MBITS bytes region. However, if the chunk is big enough, its end can reach outside of that region. This patch adds the corresponding check, to avoid such situations. Maxim Kokryashkin: * added the description and the test for the problem Part of tarantool/tarantool#8516 --- Branch: https://github.com/tarantool/luajit/tree/fckxorg/lj-445-fix-memory-probing-allocator PR: https://github.com/tarantool/tarantool/pull/8720 LuaJIT issue: https://github.com/LuaJIT/LuaJIT/issues/445 src/lj_alloc.c | 3 +- ...-445-fix-memory-probing-allocator.test.lua | 32 +++++++++++++++++++ 2 files changed, 34 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/lj-445-fix-memory-probing-allocator.test.lua diff --git a/src/lj_alloc.c b/src/lj_alloc.c index ffcd019b..f7039b5b 100644 --- a/src/lj_alloc.c +++ b/src/lj_alloc.c @@ -255,7 +255,8 @@ static void *mmap_probe(size_t size) for (retry = 0; retry < LJ_ALLOC_MMAP_PROBE_MAX; retry++) { void *p = mmap((void *)hint_addr, size, MMAP_PROT, MMAP_FLAGS_PROBE, -1, 0); uintptr_t addr = (uintptr_t)p; - if ((addr >> LJ_ALLOC_MBITS) == 0 && addr >= LJ_ALLOC_MMAP_PROBE_LOWER) { + if ((addr >> LJ_ALLOC_MBITS) == 0 && addr >= LJ_ALLOC_MMAP_PROBE_LOWER && + ((addr + size) >> LJ_ALLOC_MBITS) == 0) { /* We got a suitable address. Bump the hint address. */ hint_addr = addr + size; errno = olderr; diff --git a/test/tarantool-tests/lj-445-fix-memory-probing-allocator.test.lua b/test/tarantool-tests/lj-445-fix-memory-probing-allocator.test.lua new file mode 100644 index 00000000..44763e38 --- /dev/null +++ b/test/tarantool-tests/lj-445-fix-memory-probing-allocator.test.lua @@ -0,0 +1,32 @@ +local tap = require('tap') +local ffi = require('ffi') +local test = tap.test('lj-445-fix-memory-probing-allocator'):skipcond({ + ['Unlikely to hit beyond the upper bound for GC64'] = ffi.abi('gc64'), +}) + +local bit = require('bit') +local shr = bit.rshift +local uintptr_t = ffi.typeof('uintptr_t') + +-- Due to limitations in the x64 compiler backend, max memory limit is +-- two times lower when JIT is not disabled entirely. +local HAS_JIT = jit.status() +local LJ_ALLOC_MBITS = HAS_JIT and 31 or 32 +local MAX_GB = HAS_JIT and 2 or 4 + +test:plan(MAX_GB) + +-- Chomp memory in currently allocated GC space. +collectgarbage('stop') + +-- Every allocation must either result in a chunk that fits into the +-- `MAX_GB`-sized region entirely or return an OOM error. +for _ = 1, MAX_GB do + local status, result = pcall(ffi.new, 'char[?]', 1024 * 1024 * 1024) + if status then + local upper_bound = ffi.cast(uintptr_t, result) + ffi.sizeof(result) + test:ok(shr(upper_bound, LJ_ALLOC_MBITS) == 0, 'non-extended address') + else + test:ok(result == 'not enough memory', 'OOM encountered') + end +end -- 2.40.1
next reply other threads:[~2023-05-31 13:28 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2023-05-31 13:28 Maxim Kokryashkin via Tarantool-patches [this message] 2023-06-06 13:51 ` Sergey Kaplun via Tarantool-patches 2023-06-07 13:03 ` Maxim Kokryashkin via Tarantool-patches 2023-06-09 10:03 ` Sergey Kaplun via Tarantool-patches 2023-06-13 9:25 ` Maxim Kokryashkin via Tarantool-patches 2023-07-03 8:24 ` Igor Munkin via Tarantool-patches 2023-07-04 17:10 ` Igor Munkin via Tarantool-patches
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20230531132806.216178-1-m.kokryashkin@tarantool.org \ --to=tarantool-patches@dev.tarantool.org \ --cc=max.kokryashkin@gmail.com \ --cc=sergeyb@tarantool.org \ --cc=skaplun@tarantool.org \ --subject='Re: [Tarantool-patches] [PATCH luajit] Fix memory probing allocator to check for valid end address, too.' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox