From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id A3BB3A071CD; Wed, 7 Feb 2024 15:10:49 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org A3BB3A071CD DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1707307849; bh=60h64C1s3XQTM3Alry1RGKF+HHkP10/WselKAOwyREc=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=vMQoXM1u6/Am2uKbWgcNIV/QmMghCpL1/PhFMx4NdmsH3IBJAW2HAH3T5CdXpIC0X m1YWpcChfgWXi9Aj5JZ3ZyZNwx7nfMsvS8i4qjc47ZN6ytOPwImQeFjF2PfEzwGSGV IiMeV4BCMB+5DAnkP+JmfEAZLCQGNyFAVkNumj1s= Received: from smtp54.i.mail.ru (smtp54.i.mail.ru [95.163.41.89]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id A81DC770301 for ; Wed, 7 Feb 2024 15:10:48 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org A81DC770301 Received: by smtp54.i.mail.ru with esmtpa (envelope-from ) id 1rXglK-00000004nuM-40VP; Wed, 07 Feb 2024 15:10:47 +0300 To: Maxim Kokryashkin , Sergey Bronnikov Date: Wed, 7 Feb 2024 15:06:48 +0300 Message-ID: <20240207120648.12416-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.43.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: 78E4E2B564C1792B X-77F55803: 4F1203BC0FB41BD94C460F083DF69F515295F69A3DCCED9A0936A66FF5CEBD44182A05F5380850401151007F58F99442D4FF92D56319F1979891BD731A37422FAF6B9A2A795158013A0542435AA8B4D9 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7F10646C0E1989908EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637C0EA1E34B58229798638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D8577F1E70BA0CD0BC59C82921FB2AA7C19AD5C78F633D0BCCCC7F00164DA146DAFE8445B8C89999728AA50765F790063710E79982F6CB68F9389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC82D01283D1ACF37BAF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA73AA81AA40904B5D9A18204E546F3947C1E1736EDDE8D47906136E347CC761E074AD6D5ED66289B523666184CF4C3C14F6136E347CC761E07725E5C173C3A84C36DF1F3F6B22E83C7BA3038C0950A5D36B5C8C57E37DE458B330BD67F2E7D9AF16D1867E19FE14079C09775C1D3CA48CFED8438A78DFE0A9E1DD303D21008E298D5E8D9A59859A8B6B372FE9A2E580EFC725E5C173C3A84C3A27B50A64E76B53235872C767BF85DA2F004C90652538430E4A6367B16DE6309 X-C1DE0DAB: 0D63561A33F958A539808F045503883B5002B1117B3ED6960672B76D4A2C33B622DFD5397F446790823CB91A9FED034534781492E4B8EEADE0C144949FACE77EC79554A2A72441328621D336A7BC284946AD531847A6065A535571D14F44ED41 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF77DD89D51EBB7742D3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF6FB9D630C4435A7DBEF7C8AA99BE5607463ECA4F7E4EEF905E2A4A3A5C3CD7A12E7DF6377D6407AA807D692F32DC70320DA6A11E8FBF4FF8A32965A89043AA0407D7D3EEC785385CC226CC413062362A913E6812662D5F2A5EAB5682573093F7837F15F2B5E4A70B33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojlN/n4z3iVuQPaTjcmMZjoQ== X-Mailru-Sender: 11C2EC085EDE56FAC07928AF2646A769A22D7585137B6D18D4FF92D56319F1979891BD731A37422FB7CBEF92542CD7C88B0A2698F12F5C9EC77752E0C033A69E86920BD37369036789A8C6A0E60D2BB63A5DB60FBEB33A8A0DA7A0AF5A3A8387 X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] Avoid out-of-range number of results when compiling select(k, ...). X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall The interpreter will throw and abort the trace, anyway. (cherry picked from commit 6ca580155b035fd369f193cdee59391b594a5028) The `recff_select()` sets the amount of `RecordFFData` structure even for a negative first argument when trace is not recording (since the interpreter will throw an error anyway). This leads to excess IR emission and possible reads of dirty memory. This patch updates the `rd->nres` only in the case when a trace will be recorded. Sergey Kaplun: * added the description and the test for the problem Part of tarantool/tarantool#9595 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/fix-ff-select-recording Tarantool PR: https://github.com/tarantool/tarantool/pull/9659 Related issue: https://github.com/tarantool/tarantool/issues/9595 src/lj_ffrecord.c | 2 +- .../fix-ff-select-recording.test.lua | 44 +++++++++++++++++++ 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/fix-ff-select-recording.test.lua diff --git a/src/lj_ffrecord.c b/src/lj_ffrecord.c index 99a6b918..cbba9524 100644 --- a/src/lj_ffrecord.c +++ b/src/lj_ffrecord.c @@ -317,9 +317,9 @@ static void LJ_FASTCALL recff_select(jit_State *J, RecordFFData *rd) ptrdiff_t n = (ptrdiff_t)J->maxslot; if (start < 0) start += n; else if (start > n) start = n; - rd->nres = n - start; if (start >= 1) { ptrdiff_t i; + rd->nres = n - start; for (i = 0; i < n - start; i++) J->base[i] = J->base[start+i]; } /* else: Interpreter will throw. */ diff --git a/test/tarantool-tests/fix-ff-select-recording.test.lua b/test/tarantool-tests/fix-ff-select-recording.test.lua new file mode 100644 index 00000000..8e0b4983 --- /dev/null +++ b/test/tarantool-tests/fix-ff-select-recording.test.lua @@ -0,0 +1,44 @@ +local tap = require('tap') +local test = tap.test('fix-ff-select-recording'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(2) + +jit.opt.start('hotloop=1') + +-- XXX: simplify `jit.dump()` output. +local select = select + +local recording = false + +-- `start` is the constant on trace, see below. +local function varg_frame(start, ...) + select(start, ...) +end + +local LJ_MAX_JSLOTS = 250 + +local function varg_frame_wp() + -- XXX: Need some constant negative value as the first argument + -- of `select()` when recording the trace. + -- Also, it should be huge enough to be greater than + -- `J->maxslot`. The value on the first iteration is ignored. + -- This will fail under ASAN due to a heap buffer overflow. + varg_frame(recording and -(LJ_MAX_JSLOTS + 1) or 1) +end + +jit.opt.start('hotloop=1') + +-- Make the function hot. +varg_frame_wp() + +-- Try to record `select()` with a negative first argument. +recording = true +local res, err = pcall(varg_frame_wp) + +test:ok(not res, 'correct status') +test:like(err, "bad argument #1 to 'select' %(index out of range%)", + 'correct error message') + +test:done(true) -- 2.43.0