From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 5C1CB45FC10; Tue, 1 Jul 2025 17:58:50 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 5C1CB45FC10 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1751381930; bh=uCrL3JdZRD6MXcjuLN1Eyyk5sKJD6+F65vKH6a0L5gs=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=o3HtNBheQU0BR0ayL3tld3bhoMJBcS4oxiWtLX9d8yCprrs37hL0Mnwf56cFEV+yH oKCAH/Xzn2s9+fa93JBINI5dRcaGGAaw+wyWDzbphkFutRFJbTvoziib1xhCcNLZRY 81haKhCse5sRBIX//A0rQ5Z207x4p24AG0fQRYCQ= Received: from send36.i.mail.ru (send36.i.mail.ru [89.221.237.131]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 7149145FC10 for ; Tue, 1 Jul 2025 17:58:48 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 7149145FC10 Received: by exim-smtp-6c74f64b69-bn6r4 with esmtpa (envelope-from ) id 1uWcRb-00000000ATR-2EhN; Tue, 01 Jul 2025 17:58:47 +0300 Content-Type: multipart/alternative; boundary="------------ln585VqSZAm5Bhz3H0nwF1bb" Message-ID: <948ca0df-1cd7-4740-a20b-b1fa26ca92d0@tarantool.org> Date: Tue, 1 Jul 2025 17:58:47 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org References: <20250610155947.27340-1-skaplun@tarantool.org> Content-Language: en-US In-Reply-To: <20250610155947.27340-1-skaplun@tarantool.org> X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD93BC787D97D52D8395045BCDE25BF1301CDAE5A148177EFC4182A05F53808504095BEFA7E761C3EF93DE06ABAFEAF670551ECAAE0FA64CA6FCBDB4E38220D209A377EF39409332766 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7BC08626EA5717D14EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB55337566560991A0683723AB4C9DA8D6C8B53F3577B05D9948DA62635A64CAD5B2E4BB5C389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C0DEC8C2C8BCD2534D8941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B6AEEA5BB16A939343CC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB8D32BA5DBAC0009BE9E8FC8737B5C2249B899183D4666AAE776E601842F6C81A12EF20D2F80756B5FB606B96278B59C4276E601842F6C81A127C277FBC8AE2E8B89C074F960B19C4B3AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC72CEEB2601E22B093A03B725D353964B0B7D0EA88DDEDAC722CA9DD8327EE4930A3850AC1BE2E7352B32DCB92A8600C6C4224003CC83647689D4C264860C145E X-C1DE0DAB: 0D63561A33F958A5E7E5FB6B5CE4C7325002B1117B3ED696E2C64B8058C4BDE869995D676B7B4CBE823CB91A9FED034534781492E4B8EEAD220496FFA5CD4785BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CFE4410E6336B09FDF2D5B397109FC21D5135CD9A2F9074641F2B29A986E45E7439B332213384B53538FB9FA48424C73672F02B26172FF31535EDAC9922CE19269DD31640893DFD8DC111DC66A97D0BFE2913E6812662D5F2AB9AF64DB4688768036DF5FE9C0001AF333F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVV45pMz5J5bNeBlrHZtr3sM= X-Mailru-Sender: 520A125C2F17F0B1E52FEF5D219D6140BA6ED0AA19CD76D8C591814E25D11F9F52647BB52AF37A6E0152A3D17938EB451EB5A0BCEC6A560B3DDE9B364B0DF289BE2DA36745F2EEB5CEBA01FB949A1F1EEAB4BC95F72C04283CDA0F3B3F5B9367 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] Fix error generation in load*. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" This is a multi-part message in MIME format. --------------ln585VqSZAm5Bhz3H0nwF1bb Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hi, Sergey! thanks for the patch! LGTM Sergey On 6/10/25 18:59, Sergey Kaplun wrote: > From: Mike Pall > > Reported by Sergey Kaplun. > > (cherry picked from commit e76bb50d44702f601ec5dd167b03b475ed53860c) > > The chunkname pointer to the "@filename" is put on the Lua stack > before the `lua_loadx()` and is removed right before the next > `lua_pushfstring()` in case of the error. If the GC takes the step > right at this moment inside `lua_pushfstring()` the string may be > collected, and the next read from this `chunkname + 1` is from the > deallocated memory. > > This patch fixes this by using the source string (or the constant one) > instead. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#11278 > --- > > Related issues: > *https://github.com/LuaJIT/LuaJIT/issues/1353 > *https://github.com/tarantool/tarantool/issues/11278 > Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1353-loadfile-err-use-after-free > > > src/lj_load.c | 3 +- > ...-1353-loadfile-err-use-after-free.test.lua | 39 +++++++++++++++++++ > 2 files changed, 41 insertions(+), 1 deletion(-) > create mode 100644 test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua > > diff --git a/src/lj_load.c b/src/lj_load.c > index fdbc54cb..205686bb 100644 > --- a/src/lj_load.c > +++ b/src/lj_load.c > @@ -108,8 +108,9 @@ LUALIB_API int luaL_loadfilex(lua_State *L, const char *filename, > copyTV(L, L->top-1, L->top); > } > if (err) { > + const char *fname = filename ? filename : "stdin"; > L->top--; > - lua_pushfstring(L, "cannot read %s: %s", chunkname+1, strerror(err)); > + lua_pushfstring(L, "cannot read %s: %s", fname, strerror(err)); > return LUA_ERRFILE; > } > return status; > diff --git a/test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua b/test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua > new file mode 100644 > index 00000000..3aa02f3b > --- /dev/null > +++ b/test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua > @@ -0,0 +1,39 @@ > +local tap = require('tap') > + > +-- Test file to demonstrate LuaJIT use-after-free in case of the > +-- error in `loadfile()`. > +-- See also:https://github.com/LuaJIT/LuaJIT/issues/1353. > +local test = tap.test('lj-1353-loadfile-err-use-after-free'):skipcond({ > + ['Too many GC objects on start'] = _TARANTOOL, > +}) > + > +test:plan(1) > + > +-- Determine the GC step size to finish the GC cycle in one step. > +local full_step = 1 > +while true do > + collectgarbage('collect') > + collectgarbage('setpause', 0) > + collectgarbage('setstepmul', full_step) > + if collectgarbage('step') then break end > + full_step = full_step + 1 > +end > + > +-- Check all possible GC step sizes. > +for i = 1, full_step do > + collectgarbage('collect') > + collectgarbage('setpause', 0) > + collectgarbage('setstepmul', i) > + repeat > + -- On Linux-like systems this always returns `nil`, with the > + -- error: "cannot read .: Is a directory" > + -- The string for the filename "@." may be collected during > + -- the call, and later the pointer to the "." from that string > + -- is used after the string is free. > + loadfile('.') > + until collectgarbage('step') > +end > + > +test:ok(true, 'no use-after-free error') > + > +test:done(true) --------------ln585VqSZAm5Bhz3H0nwF1bb Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Hi, Sergey!

thanks for the patch! LGTM

Sergey

On 6/10/25 18:59, Sergey Kaplun wrote:
From: Mike Pall <mike>

Reported by Sergey Kaplun.

(cherry picked from commit e76bb50d44702f601ec5dd167b03b475ed53860c)

The chunkname pointer to the "@filename" is put on the Lua stack
before the `lua_loadx()` and is removed right before the next
`lua_pushfstring()` in case of the error. If the GC takes the step
right at this moment inside `lua_pushfstring()` the string may be
collected, and the next read from this `chunkname + 1` is from the
deallocated memory.

This patch fixes this by using the source string (or the constant one)
instead.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#11278
---

Related issues:
* https://github.com/LuaJIT/LuaJIT/issues/1353
* https://github.com/tarantool/tarantool/issues/11278
Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1353-loadfile-err-use-after-free


 src/lj_load.c                                 |  3 +-
 ...-1353-loadfile-err-use-after-free.test.lua | 39 +++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua

diff --git a/src/lj_load.c b/src/lj_load.c
index fdbc54cb..205686bb 100644
--- a/src/lj_load.c
+++ b/src/lj_load.c
@@ -108,8 +108,9 @@ LUALIB_API int luaL_loadfilex(lua_State *L, const char *filename,
     copyTV(L, L->top-1, L->top);
   }
   if (err) {
+    const char *fname = filename ? filename : "stdin";
     L->top--;
-    lua_pushfstring(L, "cannot read %s: %s", chunkname+1, strerror(err));
+    lua_pushfstring(L, "cannot read %s: %s", fname, strerror(err));
     return LUA_ERRFILE;
   }
   return status;
diff --git a/test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua b/test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua
new file mode 100644
index 00000000..3aa02f3b
--- /dev/null
+++ b/test/tarantool-tests/lj-1353-loadfile-err-use-after-free.test.lua
@@ -0,0 +1,39 @@
+local tap = require('tap')
+
+-- Test file to demonstrate LuaJIT use-after-free in case of the
+-- error in `loadfile()`.
+-- See also: https://github.com/LuaJIT/LuaJIT/issues/1353.
+local test = tap.test('lj-1353-loadfile-err-use-after-free'):skipcond({
+  ['Too many GC objects on start'] = _TARANTOOL,
+})
+
+test:plan(1)
+
+-- Determine the GC step size to finish the GC cycle in one step.
+local full_step = 1
+while true do
+  collectgarbage('collect')
+  collectgarbage('setpause', 0)
+  collectgarbage('setstepmul', full_step)
+  if collectgarbage('step') then break end
+  full_step = full_step + 1
+end
+
+-- Check all possible GC step sizes.
+for i = 1, full_step do
+  collectgarbage('collect')
+  collectgarbage('setpause', 0)
+  collectgarbage('setstepmul', i)
+  repeat
+    -- On Linux-like systems this always returns `nil`, with the
+    -- error: "cannot read .: Is a directory"
+    -- The string for the filename "@." may be collected during
+    -- the call, and later the pointer to the "." from that string
+    -- is used after the string is free.
+    loadfile('.')
+  until collectgarbage('step')
+end
+
+test:ok(true, 'no use-after-free error')
+
+test:done(true)
--------------ln585VqSZAm5Bhz3H0nwF1bb--