From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id A899BBFEB1B; Mon, 11 Mar 2024 23:50:08 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org A899BBFEB1B DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1710190208; bh=jyBhWoe3aQvVCo7j5FptT7GEv/Bx9NCWXs1VacDD6FM=; h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=jdtBYJILWPs8v9zFhS9SGxFhjdddXoX7xzJSP6GL1raE3x/QWXolMDVtdRd4ml69A JeRUr5/9PUoBjzl8IgxHWnSRpsyz72qlroThE3iQDMD+Jo89IjxbQ6PTUbgGxj3T4c yUk/8qHlr5goA7eiPhtmrNoKSzQsqPArS+cKm4Pw= Received: from smtp32.i.mail.ru (smtp32.i.mail.ru [95.163.41.73]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 72772BFEB1B for ; Mon, 11 Mar 2024 23:50:06 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 72772BFEB1B Received: by smtp32.i.mail.ru with esmtpa (envelope-from ) id 1rjmaz-0000000GMQP-2vyS; Mon, 11 Mar 2024 23:50:06 +0300 Date: Mon, 11 Mar 2024 23:50:05 +0300 To: Sergey Kaplun Message-ID: References: <20240311103701.24502-1-skaplun@tarantool.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20240311103701.24502-1-skaplun@tarantool.org> X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: 78E4E2B564C1792B X-77F55803: 4F1203BC0FB41BD987C0EE6E7F0A597D21AFE2E000C69B1FBAF020A234192257182A05F53808504064E74FA0D12B3941479CDAE959BF64242BDBF58AAE180A38231FA1E41E7F4783A41EFFA2D20C5292 X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE75210414551E8CD62EA1F7E6F0F101C67BD4B6F7A4D31EC0BCC500DACC3FED6E28638F802B75D45FF8AA50765F7900637260A91F4FDC58E7D8638F802B75D45FF36EB9D2243A4F8B5A6FCA7DBDB1FC311F39EFFDF887939037866D6147AF826D8D08730C80E32A769CF8D51ADC294F9558C38540AF985742ACC7F00164DA146DAFE8445B8C89999728AA50765F7900637CAEE156C82D3D7D9389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC8062BEEFFB5F8EA3EF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA73AA81AA40904B5D9A18204E546F3947C64E7220B7C5505926136E347CC761E074AD6D5ED66289B523666184CF4C3C14F6136E347CC761E07725E5C173C3A84C35E208EBACFE9213EBA3038C0950A5D36B5C8C57E37DE458B330BD67F2E7D9AF16D1867E19FE14079C09775C1D3CA48CF17B107DEF921CE791DD303D21008E298D5E8D9A59859A8B6B372FE9A2E580EFC725E5C173C3A84C3BE90F13D913F449135872C767BF85DA2F004C90652538430E4A6367B16DE6309 X-C1DE0DAB: 0D63561A33F958A5B72965321BCEE7425002B1117B3ED696E124B4050104571B1E49B01306B5E3AD823CB91A9FED034534781492E4B8EEADA91A6E18C88C5E2F X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF54B6814E24209DE21FBB3FAEEF141B83870F315E2F3DA00EBC6B66F13921B5E45585C02E945303B3748ED927723DE83FBDBA421A9BB1728B64F6F38B30351A80ECCB1E47AE1DC1BE5F4332CA8FE04980913E6812662D5F2A54F6898A6FDCBDC72A617DFBE5FEC2C6383653B6C8D9AE0FD16FCAA6493B703A X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2biojT+KSurEfQaflaGAZxgnKnw== X-Mailru-Sender: 7940E2A4EB16C9976F80DCDCD59EC227F2C2398ACC4161F3479CDAE959BF64242BDBF58AAE180A38E2527C969975515CFF9FCECFB8D89CB6C77752E0C033A69E235A20A81F3B0E39AB3C5F247CB2F7F93A5DB60FBEB33A8A0DA7A0AF5A3A8387 X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit] Handle stack reallocation in debug.setmetatable() and lua_setmetatable(). X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Maxim Kokryashkin via Tarantool-patches Reply-To: Maxim Kokryashkin Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Sergey! Thanks for the patch! Please consider my comments below. The test passes before the patch, as can be seen in CI for this branch: https://github.com/tarantool/luajit/tree/mkokryashkin/test On Mon, Mar 11, 2024 at 01:37:01PM +0300, Sergey Kaplun wrote: > From: Mike Pall > > Thanks to Sergey Kaplun. > > (cherry picked from commit 88ed9fdbbba632d174a473a0a97c914089c2916d) > > When we use the aforementioned functions to set a metatable for types > with one shared metatable, we must flush all traces since they are > specialized to base metatables. If we have enabled vmevent handlers, > they invoke a callback on trace flushing. This callback may reallocate > the Lua stack. Thus invalidates the reference to the `TValue *` object > `o` by the given index in the `lua_setmetatable()` and leads to a > heap-use-after-free error. > > This patch fixes the behaviour by recalculating the address by the given > index after possible stack reallocation. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#9595 > --- > > Branch: https://github.com/tarantool/luajit/tree/skaplun/lj-1172-debug-handling-ref > Tarantool PR: https://github.com/tarantool/tarantool/pull/9786 > Related issues: > * https://github.com/tarantool/tarantool/issues/9595 > * https://github.com/LuaJIT/LuaJIT/issues/1172 > > > src/lj_api.c | 1 + > .../lj-1172-debug-handling-ref.test.lua | 30 +++++++++++++++++++ > 2 files changed, 31 insertions(+) > create mode 100644 test/tarantool-tests/lj-1172-debug-handling-ref.test.lua > > diff --git a/src/lj_api.c b/src/lj_api.c > index 3bacad33..2e915306 100644 > --- a/src/lj_api.c > +++ b/src/lj_api.c > @@ -1067,6 +1067,7 @@ LUA_API int lua_setmetatable(lua_State *L, int idx) > /* Flush cache, since traces specialize to basemt. But not during __gc. */ > if (lj_trace_flushall(L)) > lj_err_caller(L, LJ_ERR_NOGCMM); > + o = index2adr(L, idx); /* Stack may have been reallocated. */ > if (tvisbool(o)) { > /* NOBARRIER: basemt is a GC root. */ > setgcref(basemt_it(g, LJ_TTRUE), obj2gco(mt)); > diff --git a/test/tarantool-tests/lj-1172-debug-handling-ref.test.lua b/test/tarantool-tests/lj-1172-debug-handling-ref.test.lua > new file mode 100644 > index 00000000..cac1c223 > --- /dev/null > +++ b/test/tarantool-tests/lj-1172-debug-handling-ref.test.lua > @@ -0,0 +1,30 @@ > +local tap = require('tap') > + > +-- Test file to demonstrate the heap-use-after-free, error for > +-- `debug.setmetatable()` and enabled `jit.dump()`. > +-- The test fails under ASAN. > +-- See also: https://github.com/LuaJIT/LuaJIT/issues/1172. > + > +local test = tap.test('lj-1172-debug-handling-ref'):skipcond({ > + ['Test requires JIT enabled'] = not jit.status(), > +}) > + > +local jdump = require('jit.dump') > + > +test:plan(1) > + > +jdump.start('t', '/dev/null') Why do we need that call here? > + > +-- Use `coroutine.wrap()` to create a new Lua stack with a minimum > +-- number of stack slots. > +coroutine.wrap(function() > + -- "TRACE flush" event handler causes stack reallocation and How is flush event caused? > + -- leads to heap-use-after-free. This event handler is called > + -- because all traces are specialized to base metatables, so > + -- if we update any base metatable, we must flush all traces. > + debug.setmetatable(1, {}) > +end)() > + > +test:ok(true, 'no heap-use-after-free error') > + > +test:done(true) > -- > 2.44.0 >