From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id A33C36F186A; Wed, 29 Nov 2023 18:00:23 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org A33C36F186A DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1701270023; bh=rTMWOiPn3iYhFyfcyZFVYVE3QkRBIHEMAYGP+zfXnUU=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=vdk4ALQlaj21hz0Dt4O6k9tiIiwIRQOqECdm8RoZxz8jZnymcPgFhjGUw4+cNjHNM kr/jmUhrrASdXeY4q1JVi2TSnbtPEkoVQN+q08aSCYQEt0fQjryj3j9P147gg5ACdC 93w6HEYyJpvMYIVJQ//Co8hkPSiwuUMOSqpCADJM= Received: from smtp59.i.mail.ru (smtp59.i.mail.ru [95.163.41.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id EA02E6F1841 for ; Wed, 29 Nov 2023 18:00:22 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org EA02E6F1841 Received: by smtp59.i.mail.ru with esmtpa (envelope-from ) id 1r8M32-00Aijz-23; Wed, 29 Nov 2023 18:00:21 +0300 Message-ID: <4ab3a515-f70e-4d9c-96c6-955c551434c4@tarantool.org> Date: Wed, 29 Nov 2023 18:00:20 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Sergey Kaplun , Maxim Kokryashkin Cc: tarantool-patches@dev.tarantool.org References: In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD9D2A6479154BC7F41A126550EFD29F2664D8B4428834D7431182A05F53808504036386978C69536A806D5F1D18E5201A4153868B5FF10DCC86E06568DB585C9B2 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7E50EC9128971FD6EEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637680B37D8C6EC627A8638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D8DBD0D54F40D7898F699E8A2B0119F572117882F4460429724CE54428C33FAD305F5C1EE8F4F765FCAE9A1BBD95851C5BA471835C12D1D9774AD6D5ED66289B52BA9C0B312567BB23117882F446042972877693876707352033AC447995A7AD186FD1C55BDD38FC3FD2E47CDBA5A96583BA9C0B312567BB2376E601842F6C81A19E625A9149C048EE26055571C92BF10FE0F2381F647739FAD8FC6C240DEA76429C9F4D5AE37F343AA9539A8B242431040A6AB1C7CE11FEE32D01283D1ACF37BA6136E347CC761E07C4224003CC836476E2F48590F00D11D6E2021AF6380DFAD1A18204E546F3947CB861051D4BA689FC2E808ACE2090B5E1725E5C173C3A84C3C5EA940A35A165FF2DBA43225CD8A89F0A35B161A8BF67C1156CCFE7AF13BCA4B5C8C57E37DE458BEDA766A37F9254B7 X-C1DE0DAB: 0D63561A33F958A53736634D5FED256BEA9AB1112587F3F1F14EACCBD8745D1AF87CCE6106E1FC07E67D4AC08A07B9B0034D30FDF2F620DBCB5012B2E24CD356 X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF405EBE91674D1E48AAAD911C988757AE6F403150C6CA67FA1A4CB022417806A99E78A6DB75C3D486153AE024B6FD0844F225B4BEFF5EFBD5551CE0EB5B435D0FE48CAC7CA610320002C26D483E81D6BE0DBAE6F56676BC7117BB6831D7356A2DEC5B5AD62611EEC62B5AFB4261A09AF0 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojxXIty/pLbaib/LD5zo3UfQ== X-Mailru-Sender: 11C2EC085EDE56FAC07928AF2646A76906CE76B4DDFF447206D5F1D18E5201A4F7F5837242FA16B2EBA65886582A37BD66FEC6BF5C9C28D98A98C1125256619760D574B6FC815AB872D6B4FCE48DF648AE208404248635DF X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit 4/6] FFI: Fix dangling reference to CType. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hello, Sergey thanks for the patch! the test is passed with reverted fix and LuaJIT built under ASAN: $ nm ./build/src/luajit | grep __asan_init                  U __asan_init $ ./build/src/luajit test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua TAP version 13 1..1 ok - no heap-use-after-free in lj_cconv_ct_tv $ On 10/23/23 12:22, Sergey Kaplun wrote: > From: Mike Pall > > (cherry-picked from commit ae533e3a6c009b5df79b11cd5787d249202fa69c) > > During the conversion of a cdata function object to some cdata value in > `lj_cconv_ct_tv()`, reallocation of `cts->tab` in `lj_ctype_intern()` > may occur. In that case, the reference to the `CType` object becomes > invalid. This patch saves the `CTypeID` of the given function and gets > its `CType` again after possible reallocation. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#9145 > --- > src/lj_cconv.c | 2 + > .../fix-dangling-reference-to-ctype.test.lua | 59 +++++++++++++++++++ > 2 files changed, 61 insertions(+) > create mode 100644 test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua > > diff --git a/src/lj_cconv.c b/src/lj_cconv.c > index 37c88852..94ca93bb 100644 > --- a/src/lj_cconv.c > +++ b/src/lj_cconv.c > @@ -568,7 +568,9 @@ void lj_cconv_ct_tv(CTState *cts, CType *d, > } > s = ctype_raw(cts, sid); > if (ctype_isfunc(s->info)) { > + CTypeID did = ctype_typeid(cts, d); > sid = lj_ctype_intern(cts, CTINFO(CT_PTR, CTALIGN_PTR|sid), CTSIZE_PTR); > + d = ctype_get(cts, did); /* cts->tab may have been reallocated. */ > } else { > if (ctype_isenum(s->info)) s = ctype_child(cts, s); > goto doconv; > diff --git a/test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua b/test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua > new file mode 100644 > index 00000000..c0e2c07b > --- /dev/null > +++ b/test/tarantool-tests/fix-dangling-reference-to-ctype.test.lua > @@ -0,0 +1,59 @@ > +local tap = require('tap') > +local ffi = require('ffi') > +local test = tap.test('fix-dangling-reference-to-ctype'):skipcond({ > + -- luacheck: no global > + ['Impossible to predict the value of cts->top'] = _TARANTOOL, > +}) > + > +test:plan(1) > + > +-- This test demonstrates LuaJIT's incorrect behaviour when the > +-- reallocation of `cts->tab` strikes during the conversion of a > +-- TValue (cdata function pointer) to a C type. > +-- The test fails under ASAN. > + > +-- XXX: Just some C functions to be casted. There is no need to > +-- declare their prototypes correctly. > +ffi.cdef[[ > + int malloc(void); > + int fprintf(void); > + int printf(void); > + int memset(void); > + int memcpy(void); > + int memmove(void); > + int getppid(void); > +]] > + > +-- XXX: structure to set `cts->top` to 110. > +local _ = ffi.new('struct {int a; long b; float c; double d;}', 0) > + > +-- Anchor table to prevent cdata objects from being collected. > +local anchor = {} > +-- Each call to this function grows `cts->top` by 3. > +local function save_new_func(func) > + anchor[#anchor + 1] = ffi.cast('void (*)(void)', func) > +end > + > +save_new_func(ffi.C.malloc) -- `cts->top` = 110 > +save_new_func(ffi.C.fprintf) -- `cts->top` = 113 > +save_new_func(ffi.C.printf) -- `cts->top` = 116 > +save_new_func(ffi.C.memset) -- `cts->top` = 119 > +save_new_func(ffi.C.memcpy) -- `cts->top` = 122 > + > +-- Assertions to check the `cts->top` value and step between > +-- calls. > +assert(ffi.typeinfo(122), 'cts->top >= 122') > +assert(not ffi.typeinfo(123), 'cts->top < 123') > + > +save_new_func(ffi.C.memmove) -- `cts->top` = 125 > + > +assert(ffi.typeinfo(125), 'cts->top >= 125') > +assert(not ffi.typeinfo(126), 'cts->top < 126') > + > +-- Last call to grow `cts->top` up to 128, so this causes > +-- `cts->tab` reallocation. > +save_new_func(ffi.C.getppid) -- `cts->top` = 128 > + > +test:ok(true, 'no heap-use-after-free in lj_cconv_ct_tv') > + > +test:done(true)