From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 5DE9713EB619; Fri, 6 Jun 2025 17:47:03 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 5DE9713EB619 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1749221223; bh=65g40lxhI7JsU7+mz4cR3pGap+GWxt1cIiCZdp30FGs=; h=Date:To:Cc:References:In-Reply-To:Subject:List-Id: List-Unsubscribe:List-Archive:List-Post:List-Help:List-Subscribe: From:Reply-To:From; b=IlyT+J5BZMMTaCyzf/Gy57kCh6PChz0ST+coTvhVQ6lrbavuPiYCymR1Kc1mILBAS Ppfri/BfSzjexlSnLNbPGHXwJsFjRO+SxNax9Bqe4AXd/05EjZNR+LpfRIaVi7HjDt uIJJgGA5GblrCYWqa9L+WM74t7gG8qoIApaCzGbU= Received: from send263.i.mail.ru (send263.i.mail.ru [95.163.59.102]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 8F5F513EB618 for ; Fri, 6 Jun 2025 17:47:01 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 8F5F513EB618 Received: by exim-smtp-567cc788d4-zjfrs with esmtpa (envelope-from ) id 1uNYLU-000000000vu-2gxU; Fri, 06 Jun 2025 17:47:01 +0300 Content-Type: multipart/alternative; boundary="------------CJlt0tgEkQOgvSQgaGXThOHx" Message-ID: Date: Fri, 6 Jun 2025 17:47:00 +0300 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Content-Language: en-US To: Sergey Kaplun Cc: tarantool-patches@dev.tarantool.org References: <5720c23a8dd4dbd5e2879b1ea163b7d140b0faf9.1749101434.git.skaplun@tarantool.org> In-Reply-To: <5720c23a8dd4dbd5e2879b1ea163b7d140b0faf9.1749101434.git.skaplun@tarantool.org> X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 646B95376F6C166E X-77F55803: 4F1203BC0FB41BD95E97EA1894635BC3FEB5EEB80E1D5722A88A554520ED6044182A05F5380850408F362D4B2B8639BC3DE06ABAFEAF670527ECF76A11E4211F144D4D864074489C090598096E5E7227 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7DECE8D0A5E25C0FCEA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637AC83A81C8FD4AD23D82A6BABE6F325AC2E85FA5F3EDFCBAA7353EFBB5533756680FD86C7FE90CFE5946D7F58467F63C2F04E87AC7A0BDEBC89ED1C12D06DD7AE389733CBF5DBD5E913377AFFFEAFD269176DF2183F8FC7C0C26CFBAC0749D213D2E47CDBA5A96583BD4B6F7A4D31EC0BC014FD901B82EE079FA2833FD35BB23D27C277FBC8AE2E8B55B19328CBC4F849A471835C12D1D977C4224003CC836476EB9C4185024447017B076A6E789B0E975F5C1EE8F4F765FC6A4E49BB0F3BA1413AA81AA40904B5D9CF19DD082D7633A0C84D3B47A649675F3AA81AA40904B5D98AA50765F79006371C58C39218EE08BCD81D268191BDAD3D3666184CF4C3C14F3FC91FA280E0CE3D1A620F70A64A45A98AA50765F79006372E808ACE2090B5E1725E5C173C3A84C3C5EA940A35A165FF2DBA43225CD8A89F616AD31D0D18CD5C57739F23D657EF2BB5C8C57E37DE458BEDA766A37F9254B7 X-C1DE0DAB: 0D63561A33F958A58A0AE1CD120060285002B1117B3ED69675C05504534DF7CA92212597CCBD6D77823CB91A9FED034534781492E4B8EEADA91A6E18C88C5E2F X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CFE112F291337EE64E677E5DE03560C514328E19045D4C829B2FD77C047499698F6DD3C4C1BE61872B4322DC41441C31F07A4B7039109C4FE02BD8D3F6AD9A7FB3EA9C8A9F21364398111DC66A97D0BFE2913E6812662D5F2AB9AF64DB4688768036DF5FE9C0001AF333F2C28C22F508233FCF178C6DD14203 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu53w8ahmwBjZKM/YPHZyZHvz5uv+WouB9+ObcCpyrx6l7KImUglyhkEat/+ysWwi0gdhEs0JGjl6ggRWTy1haxBpVdbIX1nthFXMZebaIdHP2ghjoIc/363UZI6Kf1ptIMVSykAyseJQ6/SSFR2D9Rgvg= X-Mailru-Sender: 520A125C2F17F0B1E52FEF5D219D61405CE223E1CD2130113DE06ABAFEAF670550E358771F683F460152A3D17938EB451EB5A0BCEC6A560B3DDE9B364B0DF289BE2DA36745F2EEB5CEBA01FB949A1F1EEAB4BC95F72C04283CDA0F3B3F5B9367 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit 2/3] Fix potential file descriptor leak in luaL_loadfile*(). X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" This is a multi-part message in MIME format. --------------CJlt0tgEkQOgvSQgaGXThOHx Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Hello, Sergey, the test is passed when CMake option -DLUAJIT_USE_VALGRIND=ON is used and patch with fix is reverted. Sergey On 6/5/25 08:44, Sergey Kaplun wrote: > From: Mike Pall > > Reported by Assumeru. > > (cherry picked from commit 19db4e9b7c5e19398286adb4d953a4874cc39ae0) > > `loadfile()` doesn't close the fd in case when `fopen()` results > successfully, but the call `lua_pushfstring()` raises the "not enough > memory" error on creation of the filename string (started with @). > > This patch fixes that behaviour by moving the string creation before the > `fopen()` call to avoid descriptor leak. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#11278 > --- > src/lj_load.c | 3 ++- > .../lj-1249-loadfile-fd-leak.test.lua | 27 +++++++++++++++++++ > test/tarantool-tests/utils/CMakeLists.txt | 1 + > 3 files changed, 30 insertions(+), 1 deletion(-) > create mode 100644 test/tarantool-tests/lj-1249-loadfile-fd-leak.test.lua > > diff --git a/src/lj_load.c b/src/lj_load.c > index 19ac6ba2..a6d0b464 100644 > --- a/src/lj_load.c > +++ b/src/lj_load.c > @@ -88,12 +88,13 @@ LUALIB_API int luaL_loadfilex(lua_State *L, const char *filename, > int status; > const char *chunkname; > if (filename) { > + chunkname = lua_pushfstring(L, "@%s", filename); > ctx.fp = fopen(filename, "rb"); > if (ctx.fp == NULL) { > + L->top--; > lua_pushfstring(L, "cannot open %s: %s", filename, strerror(errno)); > return LUA_ERRFILE; > } > - chunkname = lua_pushfstring(L, "@%s", filename); > } else { > ctx.fp = stdin; > chunkname = "=stdin"; > diff --git a/test/tarantool-tests/lj-1249-loadfile-fd-leak.test.lua b/test/tarantool-tests/lj-1249-loadfile-fd-leak.test.lua > new file mode 100644 > index 00000000..c1a45724 > --- /dev/null > +++ b/test/tarantool-tests/lj-1249-loadfile-fd-leak.test.lua > @@ -0,0 +1,27 @@ > +local tap = require('tap') > + > +-- Test file to demonstrate fd leakage in case of OOM during the > +-- `loadfile()` call. The test fails before the patch when run > +-- under Valgrind with the `--track-fds=yes` option. > +-- See also,https://github.com/LuaJIT/LuaJIT/issues/1249. > +local test = tap.test('lj-1249-loadfile-fd-leak') > + > +test:plan(2) > + > +local allocinject = require('allocinject') > + > +allocinject.enable_null_alloc() > + > +-- Just use the /dev/null as the surely available file. > +-- OOM is due to the creation of the string "@/dev/null" as the > +-- filename to be stored. > +local res, errmsg = pcall(loadfile, '/dev/null') > + > +allocinject.disable() > + > +-- Sanity checks. > +test:ok(not res, 'correct status, OOM on filename creation') > +test:like(errmsg, 'not enough memory', > + 'correct error message, OOM on filename creation') > + > +test:done(true) > diff --git a/test/tarantool-tests/utils/CMakeLists.txt b/test/tarantool-tests/utils/CMakeLists.txt > index 15871934..d44a8802 100644 > --- a/test/tarantool-tests/utils/CMakeLists.txt > +++ b/test/tarantool-tests/utils/CMakeLists.txt > @@ -2,6 +2,7 @@ list(APPEND tests > lj-1166-error-stitch-oom-ir-buff.test.lua > lj-1166-error-stitch-oom-snap-buff.test.lua > lj-1247-fin-tab-rehashing-on-trace.test.lua > + lj-1249-loadfile-fd-leak.test.lua > lj-1298-oom-on-concat-recording.test.lua > ) > BuildTestCLib(allocinject allocinject.c "${tests}") --------------CJlt0tgEkQOgvSQgaGXThOHx Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: 7bit

Hello, Sergey,

the test is passed when CMake option -DLUAJIT_USE_VALGRIND=ON is used and

patch with fix is reverted.

Sergey

On 6/5/25 08:44, Sergey Kaplun wrote:
From: Mike Pall <mike>

Reported by Assumeru.

(cherry picked from commit 19db4e9b7c5e19398286adb4d953a4874cc39ae0)

`loadfile()` doesn't close the fd in case when `fopen()` results
successfully, but the call `lua_pushfstring()` raises the "not enough
memory" error on creation of the filename string (started with @).

This patch fixes that behaviour by moving the string creation before the
`fopen()` call to avoid descriptor leak.

Sergey Kaplun:
* added the description and the test for the problem

Part of tarantool/tarantool#11278
---
 src/lj_load.c                                 |  3 ++-
 .../lj-1249-loadfile-fd-leak.test.lua         | 27 +++++++++++++++++++
 test/tarantool-tests/utils/CMakeLists.txt     |  1 +
 3 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 test/tarantool-tests/lj-1249-loadfile-fd-leak.test.lua

diff --git a/src/lj_load.c b/src/lj_load.c
index 19ac6ba2..a6d0b464 100644
--- a/src/lj_load.c
+++ b/src/lj_load.c
@@ -88,12 +88,13 @@ LUALIB_API int luaL_loadfilex(lua_State *L, const char *filename,
   int status;
   const char *chunkname;
   if (filename) {
+    chunkname = lua_pushfstring(L, "@%s", filename);
     ctx.fp = fopen(filename, "rb");
     if (ctx.fp == NULL) {
+      L->top--;
       lua_pushfstring(L, "cannot open %s: %s", filename, strerror(errno));
       return LUA_ERRFILE;
     }
-    chunkname = lua_pushfstring(L, "@%s", filename);
   } else {
     ctx.fp = stdin;
     chunkname = "=stdin";
diff --git a/test/tarantool-tests/lj-1249-loadfile-fd-leak.test.lua b/test/tarantool-tests/lj-1249-loadfile-fd-leak.test.lua
new file mode 100644
index 00000000..c1a45724
--- /dev/null
+++ b/test/tarantool-tests/lj-1249-loadfile-fd-leak.test.lua
@@ -0,0 +1,27 @@
+local tap = require('tap')
+
+-- Test file to demonstrate fd leakage in case of OOM during the
+-- `loadfile()` call. The test fails before the patch when run
+-- under Valgrind with the `--track-fds=yes` option.
+-- See also, https://github.com/LuaJIT/LuaJIT/issues/1249.
+local test = tap.test('lj-1249-loadfile-fd-leak')
+
+test:plan(2)
+
+local allocinject = require('allocinject')
+
+allocinject.enable_null_alloc()
+
+-- Just use the /dev/null as the surely available file.
+-- OOM is due to the creation of the string "@/dev/null" as the
+-- filename to be stored.
+local res, errmsg = pcall(loadfile, '/dev/null')
+
+allocinject.disable()
+
+-- Sanity checks.
+test:ok(not res, 'correct status, OOM on filename creation')
+test:like(errmsg, 'not enough memory',
+          'correct error message, OOM on filename creation')
+
+test:done(true)
diff --git a/test/tarantool-tests/utils/CMakeLists.txt b/test/tarantool-tests/utils/CMakeLists.txt
index 15871934..d44a8802 100644
--- a/test/tarantool-tests/utils/CMakeLists.txt
+++ b/test/tarantool-tests/utils/CMakeLists.txt
@@ -2,6 +2,7 @@ list(APPEND tests
   lj-1166-error-stitch-oom-ir-buff.test.lua
   lj-1166-error-stitch-oom-snap-buff.test.lua
   lj-1247-fin-tab-rehashing-on-trace.test.lua
+  lj-1249-loadfile-fd-leak.test.lua
   lj-1298-oom-on-concat-recording.test.lua
 )
 BuildTestCLib(allocinject allocinject.c "${tests}")
--------------CJlt0tgEkQOgvSQgaGXThOHx--