From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 3B58713E8A42; Fri, 6 Jun 2025 15:00:03 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 3B58713E8A42 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1749211203; bh=MSmCvXSUrotICYAXULwduYb0yBjrXFx89ukHeCuHVi8=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=F5YMuFfmCYsOFCyrI1Gjj5jhpNE2RIW7w8ArkUEyDeUCQKrmm++jcLcS7Qt810Gz4 TNu1W3WFXU90d5CaGUktSY4gTwrFQLURiQrFTwpX0LQilH/V0KNZh/dOv7j9+ZhTQX BSsADuGvH6ZTAiOe6w5Ti5ZU168/U42bcbHaOq+8= Received: from send240.i.mail.ru (send240.i.mail.ru [95.163.59.79]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 15F6A13E8A42 for ; Fri, 6 Jun 2025 15:00:02 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 15F6A13E8A42 Received: by exim-smtp-567cc788d4-4bdgg with esmtpa (envelope-from ) id 1uNVjs-000000006Ln-27lE; Fri, 06 Jun 2025 15:00:01 +0300 Date: Fri, 6 Jun 2025 15:00:05 +0300 To: Sergey Bronnikov Cc: tarantool-patches@dev.tarantool.org Message-ID: References: <20250605094105.21923-1-skaplun@tarantool.org> <4a506633-c1ae-41ba-8e3f-1c580303f7d4@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4a506633-c1ae-41ba-8e3f-1c580303f7d4@tarantool.org> X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: EEAE043A70213CC8 X-77F55803: 4F1203BC0FB41BD9186843A488DB0002765D3F0AFF7B15B5FB4F1AA624BDBD1F1313CFAB8367EF908E2BE116634AD74DED9831138BA8D51D2EB5D77EF37489D1F80975497461914BD22A6700AD27ECEF785316FF18B29525 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7BB17EE3498E810FEEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB5533756680FD86C7FE90CFE5AF147817E351B9E2C83696A79741CDAFB919E2BD47D5927A389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C0D9442B0B5983000E8941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B64854413538E1713FCC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB86D1867E19FE14079C09775C1D3CA48CF3D321E7403792E342EB15956EA79C166A417C69337E82CC275ECD9A6C639B01B78DA827A17800CE732FCE54C4D9A645443847C11F186F3C59DAA53EE0834AAEE X-C1DE0DAB: 0D63561A33F958A51128E808B7CAF5625002B1117B3ED6966A6BF1E60E209888E772F934B9BCD185823CB91A9FED034534781492E4B8EEAD9DB614F8F96CFA30BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADBF74143AD284FC7177DD89D51EBB7742424CF958EAFF5D571004E42C50DC4CA955A7F0CF078B5EC49A30900B95165D34D6AC337C1E637B8A65411354ED7CA8AB8318FAD55042F424BB1472672DC62E78CF93046BFCD492AD1D7E09C32AA3244C79EF4C680E08DB8277DD89D51EBB77425653240AABA18714EA455F16B58544A2E30DDF7C44BCB90DA5AE236DF995FB59829709634694AABAED6A17656DB59BCAD427812AF56FC65B X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVSykAyseJQ6/FL2Dk/iVQqc= X-DA7885C5: D7FB3B6CA56D6F58F255D290C0D534F9D48B54D22D2306473C7D626B6F5FAEEF919B8584BF3C1F625B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393FE9E42A757851DB6B89E818CF50ED9729140E1ECEC729C96024A5C18B1833D39E49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] Fix JIT slot overflow during up-recursion. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hello, Sergey! Thanks for the review! Updated the commit message as you suggested and rebased branch on the current tarantool/master. On 06.06.25, Sergey Bronnikov wrote: > Hello, Sergey, > > thanks for the patch! > > LGTM with minor comment below. > > Sergey > > On 6/5/25 12:41, Sergey Kaplun wrote: > > From: Mike Pall > > > > Reported by Sergey Kaplun. > > > > (cherry picked from commit 048972dbfdb6b441fe8a9bfe4d1f048966579ba8) > > > > In the case when LuaJIT is recording the side trace after the > > up-recursion call, there is no check that the updated `maxslot` value > > doesn't overflow the `LJ_MAX_JSLOTS` limit. If it records several huge > > returns in a row, the overflow of the aforementioned limit may occur. > > This triggers an assertion failure in `rec_check_slots()`. > > > > This patch fixes it by adding the corresponding check in the > > `lj_record_ret()`. > > > > Sergey Kaplun: > > * added the description and the test for the problem > > > > Part of tarantool/tarantool#11278 > Please add a "Closes tarantool/security#145". Added: | Resolves tarantool/security#145 > > --- > > Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1358-jslot-overflow-uprecursion > > Related issues: > > *https://github.com/tarantool/tarantool/issues/11278 > > *https://github.com/LuaJIT/LuaJIT/issues/1358 > > Also https://github.com/tarantool/security/issues/145. > > > > -- Best regards, Sergey Kaplun