Re: [Tarantool-patches] [PATCH luajit 2/3] sysprof: fix crash on a failed stream flush

[Evgeniy Temirgaleev via Tarantool-patches <tarantool-patches@dev.tarantool.org>]

Sergey! At the end of the letter for commit 1/3 I write a note on 
lj_wbuf_addn() implementation. Actually, this note and question is 
closer to this commit.

Please, see.

On 11/2/26 4:12 PM, Sergey Bronnikov wrote:
> From: Sergey Bronnikov <sergeyb@tarantool.org>
> 
> A writer may release the stream buffer and set its pointer to NULL
> on an unrecoverable error, e.g., when the file system with the
> profile is full. The write buffer stops the stream in this case,
> but a caller of `wbuf_reserve()` still writes data using the
> released buffer. This leads to a null pointer dereference inside
> `lj_utils_write_uleb128()` when the flush is triggered while
> streaming a sample.
> 
> Now `wbuf_reserve()` reports whether the stream was stopped during
> the flush. All the write functions skip writing in this case,
> including the loop pumping a large payload through the buffer.
> 
> Fixes tarantool/tarantool#11620
> ---
>   src/lj_wbuf.c                                 |  20 +-
>   .../gh-11620-sysprof-enospc-crash.test.c      | 180 ++++++++++++++++++
>   test/tarantool-c-tests/unit-wbuf.test.c       | 102 ++++++++++
>   3 files changed, 298 insertions(+), 4 deletions(-)
>   create mode 100644 test/tarantool-c-tests/gh-11620-sysprof-enospc-crash.test.c
> 
> diff --git a/src/lj_wbuf.c b/src/lj_wbuf.c
> index 0001a02e..0794b186 100644
> --- a/src/lj_wbuf.c
> +++ b/src/lj_wbuf.c
> @@ -51,11 +51,18 @@ void LJ_FASTCALL lj_wbuf_terminate(struct lj_wbuf *buf)
>     lj_wbuf_init(buf, NULL, NULL, NULL, 0);
>   }
>   
> -static LJ_AINLINE void wbuf_reserve(struct lj_wbuf *buf, size_t n)
> +/*
> +** Reserve n bytes in the buffer. Returns non-zero if the space is reserved
> +** and zero if the stream was stopped during the flush. In the latter case
> +** the writer may release the buffer (buf->buf == NULL), so it must not be
> +** used by the caller.
> +*/
> +static LJ_AINLINE int wbuf_reserve(struct lj_wbuf *buf, size_t n)
>   {
>     lj_assertX(n <= buf->size, "wbuf overflow");
>     if (LJ_UNLIKELY(wbuf_left(buf) < n))
>       lj_wbuf_flush(buf);
> +  return !lj_wbuf_test_flag(buf, STREAM_STOP);
>   }
>   
>   /* Writes a byte to the output buffer. */
> @@ -63,7 +70,8 @@ void LJ_FASTCALL lj_wbuf_addbyte(struct lj_wbuf *buf, uint8_t b)
>   {
>     if (LJ_UNLIKELY(lj_wbuf_test_flag(buf, STREAM_STOP)))
>       return;
> -  wbuf_reserve(buf, sizeof(b));
> +  if (LJ_UNLIKELY(!wbuf_reserve(buf, sizeof(b))))
> +    return;
>     *buf->pos++ = b;
>   }
>   
> @@ -72,7 +80,8 @@ void LJ_FASTCALL lj_wbuf_addu64(struct lj_wbuf *buf, uint64_t n)
>   {
>     if (LJ_UNLIKELY(lj_wbuf_test_flag(buf, STREAM_STOP)))
>       return;
> -  wbuf_reserve(buf, LEB128_U64_MAXSIZE);
> +  if (LJ_UNLIKELY(!wbuf_reserve(buf, LEB128_U64_MAXSIZE)))
> +    return;
Is it OK, if the writer report an error only, the buffer content will be 
discarded (not written), and we will success in 'pushing more data to 
the stream buffer after a hole'?

>     buf->pos += (ptrdiff_t)lj_utils_write_uleb128(buf->pos, n);
>   }
>   
> @@ -91,11 +100,14 @@ void lj_wbuf_addn(struct lj_wbuf *buf, const void *src, size_t n)
>       memcpy(buf->pos, src, left);
>       buf->pos += (ptrdiff_t)left;
>       lj_wbuf_flush(buf);
> +    if (LJ_UNLIKELY(lj_wbuf_test_flag(buf, STREAM_STOP)))
> +      return;
What would happen if writer() reports an error, but doesn't stop a stream?

>       src = (uint8_t *)src + (ptrdiff_t)left;
>       n -= left;
>     }
>   
> -  wbuf_reserve(buf, n);
> +  if (LJ_UNLIKELY(!wbuf_reserve(buf, n)))
> +    return;
>     memcpy(buf->pos, src, n);
>     buf->pos += (ptrdiff_t)n;
>   }
> diff --git a/test/tarantool-c-tests/gh-11620-sysprof-enospc-crash.test.c b/test/tarantool-c-tests/gh-11620-sysprof-enospc-crash.test.c
> new file mode 100644
> index 00000000..0f5ffe53
> --- /dev/null
> +++ b/test/tarantool-c-tests/gh-11620-sysprof-enospc-crash.test.c

<snipped>

-- 
--
Best regards,
Evgeniy Temirgaleev