From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id A0376D1AF1B; Tue, 10 Sep 2024 17:05:20 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org A0376D1AF1B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1725977120; bh=1vo4V/tTPeZ4+g/YgOlwKeokv5nA5xFu2se8Ttp8hCM=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:Cc:From; b=I7oCtqKSVW92EUlbEVpb7EkVGnwXUeVSXUa13MaOWgvcicA7tO9j3icTt6ig3nGxB kFTSnq2DVwZT+b2gvFszZc6KbxXf+OsyKM27fK6yeXxjLAd+qlk86yi1IZ0MeC4SBl ALwnOoAeTDgQycrvPjrwvSVTL0od58jQZpz938LQ= Received: from smtp49.i.mail.ru (smtp49.i.mail.ru [95.163.41.91]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id CCC66D1AF1A for ; Tue, 10 Sep 2024 17:05:19 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org CCC66D1AF1A Received: by smtp49.i.mail.ru with esmtpa (envelope-from ) id 1so1Uc-00000003jEq-2X8E; Tue, 10 Sep 2024 17:05:19 +0300 To: Maxim Kokryashkin , Sergey Bronnikov Date: Tue, 10 Sep 2024 17:05:09 +0300 Message-ID: <20240910140509.32724-1-skaplun@tarantool.org> X-Mailer: git-send-email 2.46.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD9FD43264444B6060C9433EF2A07CEE9B0663F3D368A505C23182A05F53808504073A2A766DF067725A6D5EE0DB6E1EC8D55EA95402871A22CAE28C6CDE2166BEF2761160D39042EC4 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE79A02CDD1178524C2EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637BDA91B9D4E4EEA1D8638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D859B45729F6CB07121F4270A367C1FA644A6D7EDEC76E05EACC7F00164DA146DAFE8445B8C89999728AA50765F790063735D2385A5E2B3AC3389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC87BD21ED50D08CA4DF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA7E827F84554CEF5019E625A9149C048EE9ECD01F8117BC8BEE2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8B9149C560DC76099D75ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: 0D63561A33F958A5AD8689DF2EA79BB25002B1117B3ED696D066F5B60CCDC16DE772F934B9BCD185823CB91A9FED034534781492E4B8EEAD42E5C09891E4E6C3F36E2E0160E5C55395B8A2A0B6518DF68C46860778A80D548E8926FB43031F38 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF77DD89D51EBB7742D3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CFDADBBA37F65FC2DFDA35B4CB2FF19723D8A7999F08326175EE9AB643EDD2FB2CB0F06D2F9487D0FCBA3E0C39EEA44CB3907A62977BF66D5A1AED7BB2B0A768D568619B889DDEFD83C226CC413062362A913E6812662D5F2A5EAB5682573093F7837F15F2B5E4A70B33F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojNj77dOQFim3bb4kmQ5UEUw== X-DA7885C5: 98FBEF3ECB7E9BCCF255D290C0D534F9835CFB3F4C6A33D26014BE1AF29E9DE57DA24F6C544E7BF35B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393C6D0B12EA33CAA9B355AD3C050E312F53EC93598E6E22115D0B27022DB7B68E7E49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: [Tarantool-patches] [PATCH luajit] Fix stack allocation after on-trace stack check. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall (cherry picked from commit 204cee2c917f55f288c0b166742e56c134fe578c) It is possible that a snapshot topslot is less than the possible topslot of the Lua stack. In that case, if the Lua stack overflows in `lj_vmevent_prepare()`, the error is raised inside `lj_vm_exit_handler()`, which has no corresponding DWARF eh_frame [1], so it leads to the crash. This patch fix-ups the topslot of the snapshot on trace exit to the maximum possible one. Sergey Kaplun: * added the description and the test for the problem [1]: https://refspecs.linuxfoundation.org/LSB_3.0.0/LSB-Core-generic/LSB-Core-generic/ehframechpt.html Part of tarantool/tarantool#10199 --- Branch: https://github.com/tarantool/luajit/tree/skaplun/fix-stack-alloc-on-trace Issue: https://github.com/tarantool/tarantool/issues/10199 src/lj_trace.c | 6 ++- .../fix-stack-alloc-on-trace-exit.test.lua | 53 +++++++++++++++++++ 2 files changed, 58 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/fix-stack-alloc-on-trace-exit.test.lua diff --git a/src/lj_trace.c b/src/lj_trace.c index 20014ecb..94cb27e5 100644 --- a/src/lj_trace.c +++ b/src/lj_trace.c @@ -522,7 +522,11 @@ static void trace_stop(jit_State *J) lj_assertJ(J->parent != 0 && J->cur.root != 0, "not a side trace"); lj_asm_patchexit(J, traceref(J, J->parent), J->exitno, J->cur.mcode); /* Avoid compiling a side trace twice (stack resizing uses parent exit). */ - traceref(J, J->parent)->snap[J->exitno].count = SNAPCOUNT_DONE; + { + SnapShot *snap = &traceref(J, J->parent)->snap[J->exitno]; + snap->count = SNAPCOUNT_DONE; + if (J->cur.topslot > snap->topslot) snap->topslot = J->cur.topslot; + } /* Add to side trace chain in root trace. */ { GCtrace *root = traceref(J, J->cur.root); diff --git a/test/tarantool-tests/fix-stack-alloc-on-trace-exit.test.lua b/test/tarantool-tests/fix-stack-alloc-on-trace-exit.test.lua new file mode 100644 index 00000000..ca04e54e --- /dev/null +++ b/test/tarantool-tests/fix-stack-alloc-on-trace-exit.test.lua @@ -0,0 +1,53 @@ +local tap = require('tap') + +-- Test file to demonstrate incorrect Lua stack restoration on +-- exit from trace by the stack overflow. + +local test = tap.test('fix-stack-alloc-on-trace-exit'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +local jit_dump = require('jit.dump') + +test:plan(2) + +-- Before the patch, it is possible that a snapshot topslot is +-- less than the possible topslot of the Lua stack. In that case, +-- if the Lua stack overflows in `lj_vmevent_prepare()`, the error +-- is raised inside `lj_vm_exit_handler()`, which has no +-- corresponding DWARF eh_frame, so it leads to the crash. + +-- Need for the stack growing in `lj_vmevent_prepare`. +jit_dump.start('x', '/dev/null') + +-- Create a coroutine with a fixed stack size. +local coro = coroutine.create(function() + jit.opt.start('hotloop=1', 'hotexit=1', 'callunroll=1') + + -- `math.modf` recording is NYI. + -- Local `math_modf` simplifies `jit.dump()` output. + local math_modf = math.modf + + local function trace(n) + n = n + 1 + -- luacheck: ignore + -- Start a side trace here. + if n % 2 == 0 then end + -- Stop the recording of the side trace and a main trace, + -- stitching. + math_modf(1, 1) + -- Grow stack, avoid tail calls. + local unused = trace(n) + return unused + end + + local n = 0 + trace(n) +end) + +local result, errmsg = coroutine.resume(coro) + +test:ok(not result, 'correct status and no crash') +test:like(errmsg, 'stack overflow', 'correct error message') + +test:done(true) -- 2.46.0