From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id AC72213E8CFB; Fri, 6 Jun 2025 16:40:37 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org AC72213E8CFB DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1749217237; bh=hEMOpzwL2jatOWDJ4sMRaLTqUQ/+auxGeTzunPvkDUE=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=w3B4OEdtthGlyU5xRYCnxXww7kD9tvR6F0AbbgBgCbRmm41HkOogvZVjcDhXzU0js jzhtJwm3qvTKk5gNlpHnlIeVvjUTCMcOKA48YYRP5OyDsxOF/1OvKghLK/Vzz7Os7w LKViLRqPovMcDu5UQJKc9jfFnGFfmlpM/931DVwc= Received: from send196.i.mail.ru (send196.i.mail.ru [95.163.59.35]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 3886C13E8CFB for ; Fri, 6 Jun 2025 16:40:36 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 3886C13E8CFB Received: by exim-smtp-567cc788d4-4nlhn with esmtpa (envelope-from ) id 1uNXJD-00000000GGi-0XHh; Fri, 06 Jun 2025 16:40:35 +0300 Date: Fri, 6 Jun 2025 16:40:39 +0300 To: Sergey Bronnikov Cc: tarantool-patches@dev.tarantool.org Message-ID: References: <20250425134215.8184-1-skaplun@tarantool.org> <4c846b1b-e15e-49a8-86a7-da857c7a5a5b@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4c846b1b-e15e-49a8-86a7-da857c7a5a5b@tarantool.org> X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD95E97EA1894635BC3BC13A85A717E8CF3B126AF7628A7E77F182A05F5380850403A2E3AE9CF7E527A3DE06ABAFEAF6705509F3C2EBDF46FBB2B9C6D42F51226CAC9EA2F84C7A79467 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE70D278D70F8433719EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB5533756680FD86C7FE90CFE5C17452A379846444C02408DEE36DBD1E4B14E1EBE8BB2681389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C0A3E989B1926288338941B15DA834481FCF19DD082D7633A0EF3E4896CB9E6436389733CBF5DBD5E9D5E8D9A59859A8B636DA1BED736F9328CC7F00164DA146DA6F5DAA56C3B73B237318B6A418E8EAB86D1867E19FE14079C09775C1D3CA48CF3D321E7403792E342EB15956EA79C166A417C69337E82CC275ECD9A6C639B01B78DA827A17800CE7D151390FFDBF6399731C566533BA786AA5CC5B56E945C8DA X-C1DE0DAB: 0D63561A33F958A5C4109A7E93534C895002B1117B3ED696793819B9B58E239C8B25839F35DFE037823CB91A9FED034534781492E4B8EEADB73CFAAED92B6E13BDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADBF74143AD284FC7177DD89D51EBB7742424CF958EAFF5D571004E42C50DC4CA955A7F0CF078B5EC49A30900B95165D348BE83DFD8AFB1CAC82A3B9926D2EF6D178FEA36D081D7E55F755D736FEBFD533DEEFEC3FD623C7B71D7E09C32AA3244C85418338BB117FAF77DD89D51EBB77423B2E6CF6795E237BEA455F16B58544A2E30DDF7C44BCB90DA5AE236DF995FB59829709634694AABAED6A17656DB59BCAD427812AF56FC65B X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVSykAyseJQ6/azw+eBMogQI= X-DA7885C5: F7B5A790C42DC3DEF255D290C0D534F979DF6C57D875F3591C0992FCFF949D36290E47F6820D31F25B1A4C17EAA7BC4BEF2421ABFA55128DAF83EF9164C44C7E X-Mailru-Sender: 689FA8AB762F7393FE9E42A757851DB60B29C650603CF3A363D9B8E34E1152A89584DA9C8D2AE85AE49D44BB4BD9522A059A1ED8796F048DB274557F927329BE89D5A3BC2B10C37545BD1C3CC395C826B4A721A3011E896F X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] Rework stack overflow handling. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Kaplun via Tarantool-patches Reply-To: Sergey Kaplun Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Sergey! Thanks for the review! Please, consider my answers below. On 06.06.25, Sergey Bronnikov wrote: > Hello, Sergey, > > thanks for the patch! See my comments below. > > Sergey > > On 4/25/25 16:42, Sergey Kaplun wrote: > > From: Mike Pall > > > > Reported by pwnhacker0x18. Fixed by Peter Cawley. > > > > (cherry picked from commit defe61a56751a0db5f00ff3ab7b8f45436ba74c8) > > > > In case of the Lua stack overflow error, LuaJIT restores the `L->top` > > value and pushes the error message above. It is possible that the > > restored value is greater than `L->maxstack`, so pushing the error > > message causes dirty write out-of-bounds. > > > > This patch prevents it by overwriting stack overflow handling machinery. > > Now, in the aforementioned case, the last frame is replaced with a dummy > > frame to avoid dirty writes. > > > > Sergey Kaplun: > > * added the description and the test for the problem > > > > Part of tarantool/tarantool#11278 > > --- > > > > Related issues: > > *https://github.com/LuaJIT/LuaJIT/issues/1152 > > *https://github.com/tarantool/tarantool/issues/11278 > > Branch:https://github.com/tarantool/luajit/tree/skaplun/lj-1152-stack-buffer-overflow-on-error > > > > The CI is red due to CMake minimum required version in c-dt module in > > Tarantool. > These problems are already fixed, please re-push the branch. Done. > > > > The cherry-pick also included a part fixed in the merge commit: > > https://github.com/LuaJIT/LuaJIT/commit/0d313b243 > > > > src/lj_debug.c | 1 + > > src/lj_err.c | 23 +++++- > > src/lj_err.h | 1 + > > src/lj_state.c | 58 +++++++++----- > > test/LuaJIT-tests/lang/stackov.lua | 8 +- > > ...52-stack-buffer-overflow-on-error.test.lua | 79 +++++++++++++++++++ > > test/tarantool-tests/utils/CMakeLists.txt | 1 + > > 7 files changed, 148 insertions(+), 23 deletions(-) > > create mode 100644 test/tarantool-tests/lj-1152-stack-buffer-overflow-on-error.test.lua > > > > diff --git a/test/LuaJIT-tests/lang/stackov.lua b/test/LuaJIT-tests/lang/stackov.lua > > index 8afa86b4..b052ad80 100644 > > --- a/test/LuaJIT-tests/lang/stackov.lua > > +++ b/test/LuaJIT-tests/lang/stackov.lua > I don't get why we need this change. With reverted patch this test is > passed. With reverted -- yes. But after reworking the stack overflow handling, it is possible that there is no place on the stack to call the error handler (in that case, `debug.traceback`). Since this thing looks like implementation-defined behaviour, I prefer to make the test less strict. > > @@ -31,13 +31,17 @@ end > > do --- Base test. > > local err, s = xpcall(f, debug.traceback) > > assert(err == false) > > - test_error_msg(f, s) > > + -- There is no place on the stack to invoke the handler. > > + -- Just test the error reason. > > + assert(string.match(s, "stack overflow")) > > end > > > > do --- Stack overflow with non-empty arg list. > > local err, s = xpcall(g, debug.traceback, 1) > > assert(err == false) > > - test_error_msg(g, s) > > + -- There is no place on the stack to invoke the handler. > > + -- Just test the error reason. > > + assert(string.match(s, "stack overflow")) > > end > > > > do --- Vararg tail call with non-empty arg list. +slow -- Best regards, Sergey Kaplun