From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 2B903EA19E8; Tue, 9 Jul 2024 13:46:54 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 2B903EA19E8 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1720522014; bh=zwkeFYjHTGHqcvj0ioD0Y3KZzKNtxf03OruFDjhoiio=; h=To:Date:In-Reply-To:References:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To: From; b=hfzexfa+fFcy22jHnNtLYbPkANxka5B/Q9ANeIi2xbqH/uRiaDr2UVxr6Hg3Fk5Le cGe9iJNFZJw7hEf2KlmGJ3MtdRsjxcgkEco5gF6U/uHXuE+1A5HA7HaDrQnrlYu2dJ uww+iEUqqoab0eD7pkPuk8HdHShs5fTyH6a6pGE0= Received: from mail-lj1-f179.google.com (mail-lj1-f179.google.com [209.85.208.179]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 523A4EA19E8 for ; Tue, 9 Jul 2024 13:46:41 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 523A4EA19E8 Received: by mail-lj1-f179.google.com with SMTP id 38308e7fff4ca-2ee90f56e02so49202601fa.2 for ; Tue, 09 Jul 2024 03:46:41 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720522000; x=1721126800; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=YF0J1hKb5v/v/cOYJ1/lWr02Ojsr+Nior8EcaldBWTQ=; b=jdE9VjlvACotbPTDVjg2o3osk+fowOdmczpUNoUr4Vs95BbfwmjD2g5XBSsK98ZnQb wy7vboyfECDgMBjfthvpu0hMekCseHWtNAUkXgkRuJazSPQgG1dnMOiYXyYTAPr9XBkH ZDkWiDRggt7MZoMcc9Lfaz52IfGP9V97ei4R8EWpr6Fe5wwO61F6l/wTPHNeXQr7j+j5 Ia5A3dd5UYrCkljNKn/eJxVcqI1/IAu9dq6cijTKqj7u3XbiuScLQlLIr/IHS74WRQi0 RMcpgD8b/WgqWWeucBC7dwWTVIzBeCVTR3I1xDn/8UH+qw3NtrLHg6d53w1yY7cYFs09 NWjw== X-Gm-Message-State: AOJu0YxwSanT/DAt3+NfGugZi8PzEroX7QlCqZvN8XyllC3Z2vifJGPb pKX1/75dUxgRRlxkFKCDlDiZljSoCyL8jchmyABtv46pFuu5YE9xl9CfqyPa X-Google-Smtp-Source: AGHT+IGkMLfyRb3HJ3Eg8G3wIsdJGont3+BZsUUOQ5rBn3RWK48k1z8Ufp0eRS6sBvp3MZ7z+f3Uow== X-Received: by 2002:a2e:82d0:0:b0:2ee:493b:a4ee with SMTP id 38308e7fff4ca-2eeb30fcb53mr14126161fa.24.1720522000121; Tue, 09 Jul 2024 03:46:40 -0700 (PDT) Received: from pony.bronevichok.ru ([79.164.223.111]) by smtp.gmail.com with ESMTPSA id 38308e7fff4ca-2eeb34751cesm1712771fa.93.2024.07.09.03.46.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 09 Jul 2024 03:46:39 -0700 (PDT) To: tarantool-patches@dev.tarantool.org, Sergey Kaplun , Maxim Kokryashkin Date: Tue, 9 Jul 2024 13:45:48 +0300 Message-Id: <48e2f924db3e2bdac356cefd9aae21e42556514b.1720521873.git.sergeyb@tarantool.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [Tarantool-patches] [PATCH luajit 1/2][v2] FFI: Treat cdata finalizer table as a GC root. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" From: Mike Pall Thanks to Sergey Bronnikov. (cherry picked from commit dda1ac273ad946387088d91039a8ae319359903d) There is a table `CTState->finalizer` that contains cdata finalizers. This table is created on initialization of the `ffi` module by calling the functions `luaopen_ffi` and `ffi_finalizer`. In some circumstances, this table could be collected by GC and then accessed by the function `lj_gc_finalize_cdata`. This leads to a heap-use-after-free problem. The patch fixes the problem. Sergey Bronnikov: * added the description and the tests for the problem Part of tarantool/tarantool#10199 --- src/lj_gc.c | 3 + ...free-on-access-to-CTState-finalizer.test.c | 66 +++++++++++++++++++ ...ee-on-access-to-CTState-finalizer.test.lua | 18 +++++ 3 files changed, 87 insertions(+) create mode 100644 test/tarantool-c-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.c create mode 100644 test/tarantool-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.lua diff --git a/src/lj_gc.c b/src/lj_gc.c index 591862b3..42348a34 100644 --- a/src/lj_gc.c +++ b/src/lj_gc.c @@ -99,6 +99,9 @@ static void gc_mark_start(global_State *g) gc_markobj(g, tabref(mainthread(g)->env)); gc_marktv(g, &g->registrytv); gc_mark_gcroot(g); +#if LJ_HASFFI + if (ctype_ctsG(g)) gc_markobj(g, ctype_ctsG(g)->finalizer); +#endif g->gc.state = GCSpropagate; } diff --git a/test/tarantool-c-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.c b/test/tarantool-c-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.c new file mode 100644 index 00000000..c388c6a7 --- /dev/null +++ b/test/tarantool-c-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.c @@ -0,0 +1,66 @@ +#include + +#include "lua.h" +#include "lauxlib.h" + +#include "test.h" + +/* + * This test demonstrates LuaJIT's incorrect behaviour on + * loading Lua chunk. + * See https://github.com/LuaJIT/LuaJIT/issues/1168 for details. + * + * The GC is driving forward during parsing of the Lua chunk (`chunk`). + * The chunk contains plenty of global objects, and the parsing + * of this creates a lot of strings to be used as keys in `_G`. + * Also, it contains several imaginary numbers (1i, 4i, 8i). + * That leads to the opening of the FFI library on-demand during the + * parsing of these numbers. After the FFI library is open, `ffi.gc` + * has the finalizer table as its environment. But, there is no + * FFI module table anywhere to anchor the `ffi.gc` itself, and + * the `lua_State` object was marked before the function is + * placed on it. Hence, after the atomic phase, the table + * is considered dead and collected. Since the table is collected, + * the usage of its nodes in the `lj_gc_finalize_cdata` leads + * to heap-use-after-free. + */ + +const char buff[] = "return 1LL"; + +/* + * lua_close is a part of testcase, so testcase creates + * it's own Lua state and closes it at the end. + */ +static int unmarked_finalizer_tab_gcstart(void *test_state) +{ + /* Shared Lua state is not needed. */ + (void)test_state; + + /* Setup. */ + lua_State *L = luaL_newstate(); + + /* Set GC at the start. */ + lua_gc(L, LUA_GCCOLLECT, 0); + + if (luaL_loadbufferx(L, buff, sizeof(buff) - 1, "chunk", "t") != LUA_OK) + printf("Err: %s\n", lua_tostring(L, -1)); + + /* Finish GC cycle. */ + while (!lua_gc(L, LUA_GCSTEP, -1)); + + /* Teardown. */ + lua_settop(L, 0); + lua_close(L); + + return TEST_EXIT_SUCCESS; +} + +int main(void) +{ + const struct test_unit tgroup[] = { + test_unit_def(unmarked_finalizer_tab_gcstart), + }; + const int test_result = test_run_group(tgroup, NULL); + + return test_result; +} diff --git a/test/tarantool-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.lua b/test/tarantool-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.lua new file mode 100644 index 00000000..fca5ec76 --- /dev/null +++ b/test/tarantool-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.lua @@ -0,0 +1,18 @@ +local tap = require('tap') + +-- This test demonstrates LuaJIT's heap-use-after-free +-- on collecting garbage. Test simulates "unloading" of the library, +-- or removing some of the functionality of it and then calls +-- `collectgarbage`. +-- See https://github.com/LuaJIT/LuaJIT/issues/1168 for details. +local test = tap.test('lj-1168-heap-use-after-free-on-access-to-CTState-finalizer') +test:plan(1) + +local ffi = require('ffi') + +ffi.gc = nil +collectgarbage() + +test:ok(true, 'no heap use after free') + +test:done(true) -- 2.34.1