From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 90984B8018D; Thu, 4 Apr 2024 12:38:50 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 90984B8018D DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1712223530; bh=p2iKmThJ3AOTW3/J4B4GSfStKanH50o3SCdBV2UHt2s=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=wyxWaipci1i55Ot6c4qdoIVe70bKIDOg6pQBLIG7te+02m05SBaY8V8rCIjuacW6V Cb3RNUxpoRHIJnVdnmEFCUCifagK0X8iV0UCAvVP72L6DCL3dhVtlEtJRvtXUHC15Q yYFuWcUWPaSpwouVjn/2LHZJUQZMqDLS/NIeiyyw= Received: from smtp50.i.mail.ru (smtp50.i.mail.ru [95.163.41.92]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 03127B80180 for ; Thu, 4 Apr 2024 12:38:50 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 03127B80180 Received: by smtp50.i.mail.ru with esmtpa (envelope-from ) id 1rsJYW-00000003NeX-41ls; Thu, 04 Apr 2024 12:38:49 +0300 Message-ID: <63e24648-192d-4241-a037-3579acf0dbcf@tarantool.org> Date: Thu, 4 Apr 2024 12:38:48 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: Sergey Kaplun , Maxim Kokryashkin Cc: tarantool-patches@dev.tarantool.org References: <20240311103701.24502-1-skaplun@tarantool.org> Content-Language: en-US In-Reply-To: <20240311103701.24502-1-skaplun@tarantool.org> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD96441E77B1D9F2D07F770E317D3DAD57A9495E77BC8B99A93182A05F538085040D700E683E995C152A6D5EE0DB6E1EC8D0490CDA137DE93316CF7265072AC9BDD97B3F93076A4A5D8 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7196003627DEC9496EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637ABBE65DF69007335EA1F7E6F0F101C6723150C8DA25C47586E58E00D9D99D84E1BDDB23E98D2D38B73AB1701401CD871A5DDB23EA940FD72BD12727A9E118343F220A8B8BC8F8E2EA471835C12D1D9774AD6D5ED66289B5278DA827A17800CE74A95F4E53E8DCE969FA2833FD35BB23D2EF20D2F80756B5F868A13BD56FB6657A471835C12D1D977725E5C173C3A84C34964A708C60C975A117882F4460429728AD0CFFFB425014E868A13BD56FB6657D81D268191BDAD3DC09775C1D3CA48CF6547EA7E5E4EA608BA3038C0950A5D36C8A9BA7A39EFB766D91E3A1F190DE8FDBA3038C0950A5D36D5E8D9A59859A8B655281DF774F2FA1676E601842F6C81A1F004C906525384303E02D724532EE2C3F43C7A68FF6260569E8FC8737B5C22494854413538E1713FE827F84554CEF50127C277FBC8AE2E8BAE9A1BBD95851C5BAAAE862A0553A39223F8577A6DFFEA7CCB718973C3B1084543847C11F186F3C59DAA53EE0834AAEE X-C1DE0DAB: 0D63561A33F958A57E8887453545A9C15002B1117B3ED696469C94D423F2D203B91D2EB2DEE3878C823CB91A9FED034534781492E4B8EEAD21D4E6D365FE45D1BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF71427421671DF84890E2951A4ABC9C9B7EE29A9DD61E20D47CCC16BC34DA4A9E212E5196DFD6A13FE2B85D705C0AC83B492CF34807B7C4A4D31245D61525B4AA9FF681277D59957B5F4332CA8FE04980913E6812662D5F2AB9AF64DB4688768036DF5FE9C0001AF333F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojXDAMXEVBmzuWltJOPbIK2g== X-Mailru-Sender: 520A125C2F17F0B1A9638AD358559B59F4949ABC619141C7A6D5EE0DB6E1EC8D0490CDA137DE9331B7CBEF92542CD7C8795FA72BAB74744FC77752E0C033A69EA16A481184E8BB1C9B38E6EA4F046BE03A5DB60FBEB33A8A0DA7A0AF5A3A8387 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] Handle stack reallocation in debug.setmetatable() and lua_setmetatable(). X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Sergey! thanks for the patch! LGTM On 3/11/24 13:37, Sergey Kaplun wrote: > From: Mike Pall > > Thanks to Sergey Kaplun. > > (cherry picked from commit 88ed9fdbbba632d174a473a0a97c914089c2916d) > > When we use the aforementioned functions to set a metatable for types > with one shared metatable, we must flush all traces since they are > specialized to base metatables. If we have enabled vmevent handlers, > they invoke a callback on trace flushing. This callback may reallocate > the Lua stack. Thus invalidates the reference to the `TValue *` object > `o` by the given index in the `lua_setmetatable()` and leads to a > heap-use-after-free error. > > This patch fixes the behaviour by recalculating the address by the given > index after possible stack reallocation. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#9595 > --- > > Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1172-debug-handling-ref > Tarantool PR: https://github.com/tarantool/tarantool/pull/9786 > Related issues: > * https://github.com/tarantool/tarantool/issues/9595 > * https://github.com/LuaJIT/LuaJIT/issues/1172 > > > src/lj_api.c | 1 + > .../lj-1172-debug-handling-ref.test.lua | 30 +++++++++++++++++++ > 2 files changed, 31 insertions(+) > create mode 100644 test/tarantool-tests/lj-1172-debug-handling-ref.test.lua > > diff --git a/src/lj_api.c b/src/lj_api.c > index 3bacad33..2e915306 100644 > --- a/src/lj_api.c > +++ b/src/lj_api.c > @@ -1067,6 +1067,7 @@ LUA_API int lua_setmetatable(lua_State *L, int idx) > /* Flush cache, since traces specialize to basemt. But not during __gc. */ > if (lj_trace_flushall(L)) > lj_err_caller(L, LJ_ERR_NOGCMM); > + o = index2adr(L, idx); /* Stack may have been reallocated. */ > if (tvisbool(o)) { > /* NOBARRIER: basemt is a GC root. */ > setgcref(basemt_it(g, LJ_TTRUE), obj2gco(mt)); > diff --git a/test/tarantool-tests/lj-1172-debug-handling-ref.test.lua b/test/tarantool-tests/lj-1172-debug-handling-ref.test.lua > new file mode 100644 > index 00000000..cac1c223 > --- /dev/null > +++ b/test/tarantool-tests/lj-1172-debug-handling-ref.test.lua > @@ -0,0 +1,30 @@ > +local tap = require('tap') > + > +-- Test file to demonstrate the heap-use-after-free, error for > +-- `debug.setmetatable()` and enabled `jit.dump()`. > +-- The test fails under ASAN. > +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1172. > + > +local test = tap.test('lj-1172-debug-handling-ref'):skipcond({ > + ['Test requires JIT enabled'] = not jit.status(), > +}) > + > +local jdump = require('jit.dump') > + > +test:plan(1) > + > +jdump.start('t', '/dev/null') > + > +-- Use `coroutine.wrap()` to create a new Lua stack with a minimum > +-- number of stack slots. > +coroutine.wrap(function() > + -- "TRACE flush" event handler causes stack reallocation and > + -- leads to heap-use-after-free. This event handler is called > + -- because all traces are specialized to base metatables, so > + -- if we update any base metatable, we must flush all traces. > + debug.setmetatable(1, {}) > +end)() > + > +test:ok(true, 'no heap-use-after-free error') > + > +test:done(true)