From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 6A732BFBA5F; Wed, 10 Jul 2024 16:13:32 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 6A732BFBA5F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1720617212; bh=OHhFs4UHfy0ZIwXP4rJG/PtQ+x+OE0GADmduiIlUxsc=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=qLJL68deKkv3Mul3+NXvaneU+XDayKxV/3Q3lMjBdtBOeW7qNe8rdHYZrUDQ2QdkU RPODbn1VraYKsFfWEamPcivOs63JJ0jmUHWWboivKp+XvKgQ2x3FDW5GSSoSr9uZzg XtYVuqQNmCbBeXgNwMWi+W9/vDyaVmEtXHeKSzEk= Received: from smtp61.i.mail.ru (smtp61.i.mail.ru [95.163.41.99]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id BEECDBFBA5E for ; Wed, 10 Jul 2024 16:13:31 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org BEECDBFBA5E Received: by smtp61.i.mail.ru with esmtpa (envelope-from ) id 1sRX8U-00000003xfe-2Ary; Wed, 10 Jul 2024 16:13:30 +0300 Date: Wed, 10 Jul 2024 16:13:22 +0300 To: Sergey Bronnikov Cc: Sergey Bronnikov , tarantool-patches@dev.tarantool.org Message-ID: References: <48e2f924db3e2bdac356cefd9aae21e42556514b.1720521873.git.sergeyb@tarantool.org> <87f6aec7-c27b-4dde-8c2a-132eff77e048@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <87f6aec7-c27b-4dde-8c2a-132eff77e048@tarantool.org> X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 78E4E2B564C1792B X-77F55803: 4F1203BC0FB41BD9985AA43F8E1EDB6EEC59B9083150EABC08C5E91897BA4EDB00894C459B0CD1B91882B05483AA159B0C341ADA96B860986EB7E9900427F8C329ACD8D2A98CF7D64787F701E02FBF3D X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7FCFCB92DA8654BB0EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637FB2D77E6174520AE8638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D88BA319F47B35BDD165B3BBCE367BF96162A35ED6093B81ECCC7F00164DA146DAFE8445B8C89999728AA50765F790063783E00425F71A4181389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC81D471462564A2E19F6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA7E827F84554CEF5019E625A9149C048EE9ECD01F8117BC8BEE2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8BB9CEE4F2B4A90F8475ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: 0D63561A33F958A56C43DE949DF46D625002B1117B3ED696486D0ABD0911D556715D9AB585B0EB04823CB91A9FED034534781492E4B8EEAD9CFA8CFAC159CE19BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADBF74143AD284FC7177DD89D51EBB7742424CF958EAFF5D571004E42C50DC4CA955A7F0CF078B5EC49A30900B95165D345C064E16D8ABF335B35A927B1415BF1A64587D458BFF5412F4309870D02C9BF3B3362C6FB9BCA23B1D7E09C32AA3244C688B3703993B2A6E921CC9A31F9C4781FB5EED90356D268DEA455F16B58544A2557BDE0DD54B3590A5AE236DF995FB59829709634694AABAED6A17656DB59BCAD427812AF56FC65B X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojYxP1dNBoSZnoDVz6HTjkBA== X-DA7885C5: F00C39DBE1FED9DAF255D290C0D534F9711FA5E5A28CED1319B573CA2CDA4635AA3D8B02FE7EC5635B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393C6D0B12EA33CAA9B77E7A56B221AC918488ACD46E85B9A30758DAA144BBE63B5E49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit 1/2][v2] FFI: Treat cdata finalizer table as a GC root. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Sergey! Thanks for the fixes! Please consider my minor nits about comments below. On 09.07.24, Sergey Bronnikov wrote: > Hi, Sergey, > > thanks for review. Fixes applied and force-pushed. > > Sergey > > > On 09.07.2024 14:52, Sergey Kaplun via Tarantool-patches wrote: > > Hi, Sergey! > > Thanks for the patch! > > Please consider my comments below. > > > > On 09.07.24, Sergey Bronnikov wrote: > >> From: Mike Pall > >> > >> Thanks to Sergey Bronnikov. > >> > >> (cherry picked from commit dda1ac273ad946387088d91039a8ae319359903d) > >> > >> There is a table `CTState->finalizer` that contains cdata finalizers. > >> This table is created on initialization of the `ffi` module > > I suppose we may drop the first sentence and start like the following: > > > > | The finalizers table is created... > > Updated. > > > > > >> by calling the functions `luaopen_ffi` and `ffi_finalizer`. In some > > I suggest the following rewording: > > | by calling the `ffi_finalizer()` routine in the `luaopen_ffi()` > > Updated. | The finalizers table is created on initialization of the `ffi` | module by calling the `ffi_finalizer()` routine in the | `luaopen_ffi()`. Here it is good to say that usually `ffi.gc()` is anchored somewhere on the stack via the ffi library, so the finalizer table is anchored as well. | But, there is no FFI module table anywhere to Minor: s/But,/If/ [*] | anchor the `ffi.gc` itself, and the `lua_State` object was marked Typo: s/,// | before the function is placed on it. Hence, after the atomic [*] s/./, then the finalier table isn't marked./ It is more correct to say, that "`lua_State` is marked after the function is removed from it" (since we stop the GC before chunk loading and starts after). Also, we can say `lua_State` is marked when `ffi.gc()` is not on it. | phase, the table is considered dead and collected. Since the table | is collected, the usage of its nodes in the `lj_gc_finalize_cdata` | leads to heap-use-after-free. > > > > > >> circumstances, this table could be collected by GC and then accessed by > >> the function `lj_gc_finalize_cdata`. This leads to a heap-use-after-free > > Please describe more verbosely why this table isn't marked and has > > become garbage collected. How is it marked before the patch? > > > >> problem. The patch fixes the problem. > > How does the patch fix the problem? > > > > Also, it is worth mentioning that the problem was partially solved, the > > complete fix will be applied in the next patch. Please, add its description to the commit message too. > > > >> Sergey Bronnikov: > >> * added the description and the tests for the problem > >> > >> Part of tarantool/tarantool#10199 > >> --- > >> src/lj_gc.c | 3 + > >> ...free-on-access-to-CTState-finalizer.test.c | 66 +++++++++++++++++++ > >> ...ee-on-access-to-CTState-finalizer.test.lua | 18 +++++ > >> 3 files changed, 87 insertions(+) > >> create mode 100644 test/tarantool-c-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.c > >> create mode 100644 test/tarantool-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.lua > > > > > >> + * has the finalizer table as its environment. But, there is no > >> + * FFI module table anywhere to anchor the `ffi.gc` itself, and > >> + * the `lua_State` object was marked before the function is It is more correct to say, that "`lua_State` is marked after the function is removed from it" (since we stop the GC before chunk loading and starts after). > >> + * placed on it. Hence, after the atomic phase, the table > > >> +{ > >> + /* Shared Lua state is not needed. */ > >> + (void)test_state; > >> + > >> + if (luaL_loadbufferx(L, buff, sizeof(buff) - 1, "chunk", "t") != LUA_OK) > > Why do we need to omit the ending zero byte? I see no related comment on the branch. > >> diff --git a/test/tarantool-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.lua b/test/tarantool-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.lua > >> new file mode 100644 > >> index 00000000..fca5ec76 > >> --- /dev/null > >> +++ b/test/tarantool-tests/lj-1168-heap-use-after-free-on-access-to-CTState-finalizer.test.lua > >> @@ -0,0 +1,18 @@ > > > >> +-- or removing some of the functionality of it and then calls > >> +-- `collectgarbage`. > >> +-- Seehttps://github.com/LuaJIT/LuaJIT/issues/1168 for details. > >> +local test = tap.test('lj-1168-heap-use-after-free-on-access-to-CTState-finalizer') > > Code line is longer than 80 symbols. > > Don't to update this testname after renaming of the file. > Updated. | +-- This test demonstrates LuaJIT's heap-use-after-free on | +-- on cleaning of resources during shoutdown. Test simulates Typo: s/on// Typo: s/Test/The test/ | +-- "unloading" of the library, or removing some of the Typo: s/the functionality of it/its functionality/ | +-- functionality of it and then calls `collectgarbage`. | +-- See https://github.com/LuaJIT/LuaJIT/issues/1168 for details. > > > >> -- > >> 2.34.1 > >> -- Best regards, Sergey Kaplun