From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 0B168E4BBA3; Thu, 16 Jan 2025 19:36:27 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 0B168E4BBA3 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1737045387; bh=pF30/jMTNjPP4zVGQcy1M/fpX1n+usXVy5MeOWGaqM0=; h=To:Date:Subject:List-Id:List-Unsubscribe:List-Archive:List-Post: List-Help:List-Subscribe:From:Reply-To:From; b=czDIy5TFRuPhJtMu7K8V1stRU7WhLD+jdx47vzVhs/n206ykV0VNRXGPdI6kZfEPy M0YPNwNk8t4bIMH5Fgx7IoP2BIyws4Tl5hHlgbMmcIvesuN3nFHqC7xYfn6MpMykwM 0lwN/ORBOG/wpzzuGGcE06avEBUIhqiYZJDSVgU0= Received: from mail-lf1-f42.google.com (mail-lf1-f42.google.com [209.85.167.42]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 9A443E4BB93 for ; Thu, 16 Jan 2025 19:36:25 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 9A443E4BB93 Received: by mail-lf1-f42.google.com with SMTP id 2adb3069b0e04-5401c52000dso1252647e87.3 for ; Thu, 16 Jan 2025 08:36:25 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1737045385; x=1737650185; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=5e4L7U0P9lCxPWE3vAR1XEJjDkwUtDwm0gss/jjWgJs=; b=f9h3W3XjLUQoAeEa8J0/Y29RIQq779CIUvTZCOl5fKQSJKwtKdTb67DrcDbVYJKxNU kYMEgvYYj3Hoqy/3+KVGeMesC2/FXdLzXzbPxLbLb021qy3SbDg/HcW9ufDtu38rIp+q w6JrtIMFUL5JuxU1+LiC93g+I4LpbCPWYH63RNyHzKmmskghFsWTvBR7f99WvFdNwYm3 5yrvUH5mdj440vNt7OpTzngHxD2C47D2JHVZO8w3hYmAuJ4Urqi6sLt43Jsq38cnJRNM OQrhni0EH2dhv8Nb5uCGiyyuGdKO6ENtxn81f1LpUlKNfrWdhOh1aXFgw3U98vr7Kb8L OAgQ== X-Gm-Message-State: AOJu0YwfpGMwkPZTTFpXOe9zwXXMoXzbNSJgnCvqrgLK416j8IHpmUgz H2jIwTAF97ok1j1gG6bb/OimtQaLfhxxdWbIimhOFI/8zAMHSn4MdcZHhyP2 X-Gm-Gg: ASbGncvAHcH+/4MC/Nys9FjQxFzmvVbigq03hHsjcQJ+TEs5MsfhdRr4/mJhxMsAw/M q8eZXJVNvQQT4t5yiKIxE4x1g9S4BkEbOSuWNvCtQO2J/J7Qhv8rvtPsRoOYoHgYVNwysHv+JSr rTd8mFY2HoVJ7kbtnDsyNR/dFVQNQEC3p3Gj+gdUph/MMrYvCTEHdWwqr4SkcXCRFzMQ2EGR7vc 6/mnwmAl/3B4m9UMgq/snPPs4UuJIKMDPpEbIsYLWnLr7s= X-Google-Smtp-Source: AGHT+IEc8zLRkFeI5BEzImWt6ZjRktkEWLhIECUQi8qaORc761ItIJ/YyUYiOwxsN5wC4dryxcaY9g== X-Received: by 2002:a05:6512:ad0:b0:542:2e04:edd1 with SMTP id 2adb3069b0e04-542848162fcmr10390073e87.42.1737045384252; Thu, 16 Jan 2025 08:36:24 -0800 (PST) Received: from localhost ([5.181.62.98]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5439af72c85sm34996e87.185.2025.01.16.08.36.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 16 Jan 2025 08:36:22 -0800 (PST) X-Google-Original-From: Sergey Bronnikov To: tarantool-patches@dev.tarantool.org, Sergey Kaplun , Maxim Kokryashkin Date: Thu, 16 Jan 2025 19:36:08 +0300 Message-Id: X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Subject: [Tarantool-patches] [PATCH luajit][v2] Prevent loop in snap_usedef(). X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Sergey Bronnikov via Tarantool-patches Reply-To: Sergey Bronnikov Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Reported by XmiliaH. (cherry picked from commit 0e66fc96377853d898390f1a02723c54ec3a42f7) It is possible to get an infinite loop in a function `snap_usedef` when a `UCLO` makes a tight loop. This infinite loop could happen when `snap_usedef()` is called on trace exit processes UCLO bytecode instruction and this instruction attempts a jump with negative value. The patch fixes the problem by checking a number of slots in a jump argument and replace this value my `maxslot` if a value is negative. Sergey Bronnikov: * added the description and the test for the problem Part of tarantool/tarantool#10709 --- Branch: https://github.com/tarantool/luajit/tree/ligurio/lj-736-prevent-loop-in-snap_usedef Related issues: * https://github.com/tarantool/tarantool/issues/10709 * https://github.com/LuaJIT/LuaJIT/issues/736 v2 changes: - Updated test, now it hangs without patch with fix. - Added more comments to the test with explanations. src/lj_snap.c | 7 +- .../lj-736-BC_UCLO-triggers-infinite-loop.lua | 82 +++++++++++++++++++ 2 files changed, 88 insertions(+), 1 deletion(-) create mode 100644 test/tarantool-tests/lj-736-BC_UCLO-triggers-infinite-loop.lua diff --git a/src/lj_snap.c b/src/lj_snap.c index 8a33dc22..8d7bd868 100644 --- a/src/lj_snap.c +++ b/src/lj_snap.c @@ -252,7 +252,12 @@ static BCReg snap_usedef(jit_State *J, uint8_t *udf, BCReg minslot = bc_a(ins); if (op >= BC_FORI && op <= BC_JFORL) minslot += FORL_EXT; else if (op >= BC_ITERL && op <= BC_JITERL) minslot += bc_b(pc[-2])-1; - else if (op == BC_UCLO) { pc += bc_j(ins); break; } + else if (op == BC_UCLO) { + ptrdiff_t delta = bc_j(ins); + if (delta < 0) return maxslot; /* Prevent loop. */ + pc += delta; + break; + } for (s = minslot; s < maxslot; s++) DEF_SLOT(s); return minslot < maxslot ? minslot : maxslot; } diff --git a/test/tarantool-tests/lj-736-BC_UCLO-triggers-infinite-loop.lua b/test/tarantool-tests/lj-736-BC_UCLO-triggers-infinite-loop.lua new file mode 100644 index 00000000..fb053e9a --- /dev/null +++ b/test/tarantool-tests/lj-736-BC_UCLO-triggers-infinite-loop.lua @@ -0,0 +1,82 @@ +local tap = require('tap') +local test = tap.test('lj-736-BC_UCLO-triggers-infinite-loop'):skipcond({ + ['Test requires JIT enabled'] = not jit.status(), +}) + +test:plan(2) + +-- Test reproduces an issue when BC_UCLO triggers an infinite loop. +-- See details in https://github.com/LuaJIT/LuaJIT/issues/736. +-- +-- Listing below demonstrates a problem - +-- the bytecode UCLO on the line 13 makes a loop at 0013-0014: +-- +-- - BYTECODE -- bc_uclo.lua:0-20 +-- 0001 KPRI 0 0 +-- 0002 FNEW 1 0 ; bc_uclo.lua:5 +-- 0003 KSHORT 2 1 +-- 0004 KSHORT 3 4 +-- 0005 KSHORT 4 1 +-- 0006 FORI 2 => 0011 +-- 0007 => ISNEN 5 0 ; 2 +-- 0008 JMP 6 => 0010 +-- 0009 UCLO 0 => 0012 +-- 0010 => FORL 2 => 0007 +-- 0011 => UCLO 0 => 0012 +-- 0012 => KPRI 0 0 +-- 0013 UCLO 0 => 0012 +-- 0014 FNEW 1 1 ; bc_uclo.lua:18 +-- 0015 UCLO 0 => 0016 +-- 0016 => RET0 0 1 + +jit.opt.start('hotloop=1') + +local assert_msg = 'Infinite loop is not reproduced.' +local assert = assert + +local function testcase() + -- The code in the first scope `do`/`end` is a prerequisite. + -- It is needed so that we have a trace at the exit from which + -- the creation of the snapshot will begin. + do + -- Upvalue below is not used actually, but it is required + -- for calling `snap_usedef()` on trace exit. + local uv1 -- luacheck: ignore + local _ = function() return uv1 end + + -- The loop below is required for recording a trace. + -- The condition inside a loop executes `goto` to a label + -- outside of the loop when the code executed by JIT and + -- this triggers snapshotting. + for i = 1, 2 do + -- Exit to interpreter once trace is compiled. + if i == 2 then + goto x + end + end + end + +::x:: + do + local uv2 -- luacheck: no unused + + -- `goto` if not executed without a patch and generates an + -- UCLO bytecode that makes an infinite loop in a function + -- `snap_usedef` when patch is not applied. `goto` must point + -- to the label on one of the previous lines. `assert()` is + -- executed when patch is applied. + assert(nil, assert_msg) + goto x + + -- Line below is required, it makes `uv` upvalue, and must be + -- placed after `goto`, otherwise reproducer become broken. + local _ = function() return uv2 end -- luacheck: ignore + end +end + +local ok, err = pcall(testcase) + +test:is(ok, false, 'assertion is triggered in a function with testcase') +test:ok(err:match(assert_msg), 'BC_UCLO does not trigger an infinite loop') + +os.exit(test:check() and 0 or 1) -- 2.34.1