Tarantool development patches archive
 help / color / mirror / Atom feed
From: Maxim Kokryashkin via Tarantool-patches <tarantool-patches@dev.tarantool.org>
To: Sergey Kaplun <skaplun@tarantool.org>
Cc: tarantool-patches@dev.tarantool.org
Subject: Re: [Tarantool-patches] [PATCH luajit 5/6] FFI: Fix dangling reference to CType. Improve checks.
Date: Wed, 25 Oct 2023 11:05:15 +0300	[thread overview]
Message-ID: <sf5poie64s7obyyjkq7hpz7a2hxfqrcd7kv3ns3nx45swlhklu@hszfhb5aqpcj> (raw)
In-Reply-To: <a963238df9c76a9db9908f89deb4df6ab093e1bd.1698049570.git.skaplun@tarantool.org>

Hi, Sergey!
Thanks for the patch!
LGTM, after answering the same questions as for the previous patch.
On Mon, Oct 23, 2023 at 12:22:05PM +0300, Sergey Kaplun wrote:
> From: Mike Pall <mike>
> 
> Reported by elmknot.
> 
> (cherry-picked from commit cc96ab9d513582703f8663a8775a935b56db32b7)
> 
> During the recording of an arithmetic operation with a cdata function
> object and some cdata value in `recff_cdata_arith()`, reallocation of
> `cts->tab` in `lj_ctype_intern()` may occur. In that case, the reference
> to the first `CType` object (`s[0]`) becomes invalid. This patch saves
> the `CTypeID` of this object and gets its `CType` again after possible
> reallocation.
> 
> Also, this commit fills `cts->tab` memory with zeros before being freed
> when `-DLUAJIT_CTYPE_CHECK_ANCHOR` is defined. It helps to observe
> assertion failures in case this memory is used after free.
> 
> Sergey Kaplun:
> * added the description and the test for the problem
> 
> Part of tarantool/tarantool#9145
> ---
>  src/lj_crecord.c                              |  4 +
>  src/lj_ctype.c                                | 12 +++
>  ...0-fix-dangling-reference-to-ctype.test.lua | 77 +++++++++++++++++++
>  3 files changed, 93 insertions(+)
>  create mode 100644 test/tarantool-tests/lj-920-fix-dangling-reference-to-ctype.test.lua
> 
> diff --git a/src/lj_crecord.c b/src/lj_crecord.c
> index 10d1dc70..e17e512f 100644
> --- a/src/lj_crecord.c
> +++ b/src/lj_crecord.c
> @@ -1502,9 +1502,13 @@ void LJ_FASTCALL recff_cdata_arith(jit_State *J, RecordFFData *rd)
>  	if (ctype_isenum(ct->info)) ct = ctype_child(cts, ct);
>  	goto ok;
>        } else if (ctype_isfunc(ct->info)) {
> +	CTypeID id0 = i ? ctype_typeid(cts, s[0]) : 0;
>  	tr = emitir(IRT(IR_FLOAD, IRT_PTR), tr, IRFL_CDATA_PTR);
>  	ct = ctype_get(cts,
>  	  lj_ctype_intern(cts, CTINFO(CT_PTR, CTALIGN_PTR|id), CTSIZE_PTR));
> +	if (i) {
> +	  s[0] = ctype_get(cts, id0);  /* cts->tab may have been reallocated. */
> +	}
>  	goto ok;
>        } else {
>  	tr = emitir(IRT(IR_ADD, IRT_PTR), tr, lj_ir_kintp(J, sizeof(GCcdata)));
> diff --git a/src/lj_ctype.c b/src/lj_ctype.c
> index a42e3d60..0874fa61 100644
> --- a/src/lj_ctype.c
> +++ b/src/lj_ctype.c
> @@ -191,8 +191,20 @@ CTypeID lj_ctype_intern(CTState *cts, CTInfo info, CTSize size)
>    }
>    id = cts->top;
>    if (LJ_UNLIKELY(id >= cts->sizetab)) {
> +#ifdef LUAJIT_CTYPE_CHECK_ANCHOR
> +    CType *ct;
> +#endif
>      if (id >= CTID_MAX) lj_err_msg(cts->L, LJ_ERR_TABOV);
> +#ifdef LUAJIT_CTYPE_CHECK_ANCHOR
> +    ct = lj_mem_newvec(cts->L, id+1, CType);
> +    memcpy(ct, cts->tab, id*sizeof(CType));
> +    memset(cts->tab, 0, id*sizeof(CType));
> +    lj_mem_freevec(cts->g, cts->tab, cts->sizetab, CType);
> +    cts->tab = ct;
> +    cts->sizetab = id+1;
> +#else
>      lj_mem_growvec(cts->L, cts->tab, cts->sizetab, CTID_MAX, CType);
> +#endif
>    }
>    cts->top = id+1;
>    cts->tab[id].info = info;
> diff --git a/test/tarantool-tests/lj-920-fix-dangling-reference-to-ctype.test.lua b/test/tarantool-tests/lj-920-fix-dangling-reference-to-ctype.test.lua
> new file mode 100644
> index 00000000..a7e35888
> --- /dev/null
> +++ b/test/tarantool-tests/lj-920-fix-dangling-reference-to-ctype.test.lua
> @@ -0,0 +1,77 @@
> +local tap = require('tap')
> +local ffi = require('ffi')
> +local test = tap.test('lj-920-fix-dangling-reference-to-ctype'):skipcond({
> +  ['Test requires JIT enabled'] = not jit.status(),
> +  -- luacheck: no global
> +  ['Impossible to predict the value of cts->top'] = _TARANTOOL,
> +})
> +
> +test:plan(1)
> +
> +-- This test demonstrates LuaJIT's incorrect behaviour when the
> +-- reallocation of `cts->tab` strikes during the recording of the
> +-- cdata metamethod arithmetic.
> +-- The test fails under ASAN.
> +
> +-- XXX: Just some C functions to be casted. There is no need to
> +-- declare their prototypes correctly.
> +ffi.cdef[[
> +  int malloc(void);
> +  int fprintf(void);
> +  int printf(void);
> +  int memset(void);
> +  int memcpy(void);
> +  int memmove(void);
> +  int getppid(void);
> +]]
> +
> +local cfunc_type = ffi.metatype(ffi.typeof('struct {int a;}'), {
> +  -- Just some metatable with reloaded arithmetic operator.
> +  __add = function(o1, _) return o1 end
> +})
> +-- Just some cdata with metamethod.
> +local test_value = cfunc_type(1)
> +
> +-- XXX: structure to set `cts->top` to 112.
> +local _ = ffi.new('struct {int a; long b; float c; double d;}', 0)
> +
> +-- Anchor table to prevent cdata objects from being collected.
> +local anchor = {}
> +-- Each call to this function grows `cts->top` by 3.
> +local function save_new_func(func)
> +  anchor[#anchor + 1] = ffi.cast('void (*)(void)', func)
> +end
> +
> +save_new_func(ffi.C.fprintf) -- `cts->top` = 112
> +save_new_func(ffi.C.printf)  -- `cts->top` = 115
> +save_new_func(ffi.C.memset)  -- `cts->top` = 118
> +save_new_func(ffi.C.memcpy)  -- `cts->top` = 121
> +save_new_func(ffi.C.malloc)  -- `cts->top` = 124
> +
> +-- Assertions to check the `cts->top` value and step between
> +-- calls.
> +assert(ffi.typeinfo(124), 'cts->top >= 124')
> +assert(not ffi.typeinfo(125), 'cts->top < 125')
> +
> +save_new_func(ffi.C.memmove) -- `cts->top` = 127
> +
> +jit.opt.start('hotloop=1')
> +
> +-- Just some function to record trace and cause reallocation.
> +local function recorded_func(func_arg)
> +  local res = test_value + func_arg
> +  return res
> +end
> +recorded_func(ffi.C.malloc)
> +
> +assert(ffi.typeinfo(127), 'cts->top >= 127')
> +assert(not ffi.typeinfo(128), 'cts->top < 128')
> +
> +-- Last call to grow `cts->top` up to 129, so this causes
> +-- `cts->tab` reallocation. Need to use different functions as
> +-- an argument.
> +recorded_func(ffi.C.getppid)
> +
> +test:ok(true, 'no heap-use-after-free in recff_cdata_arith')
> +
> +test:done(true)
> -- 
> 2.42.0
> 

  reply	other threads:[~2023-10-25  8:05 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2023-10-23  9:22 [Tarantool-patches] [PATCH luajit 0/6] FFI fixes Sergey Kaplun via Tarantool-patches
2023-10-23  9:22 ` [Tarantool-patches] [PATCH luajit 1/6] Abstract out on-demand loading of FFI library Sergey Kaplun via Tarantool-patches
2023-10-24 14:38   ` Maxim Kokryashkin via Tarantool-patches
2023-11-29 14:35   ` Sergey Bronnikov via Tarantool-patches
2023-10-23  9:22 ` [Tarantool-patches] [PATCH luajit 2/6] FFI: Fix missing cts->L initialization in argv2ctype() Sergey Kaplun via Tarantool-patches
2023-10-24 14:49   ` Maxim Kokryashkin via Tarantool-patches
2023-10-25 10:19     ` Sergey Kaplun via Tarantool-patches
2023-11-29 14:39   ` Sergey Bronnikov via Tarantool-patches
2023-10-23  9:22 ` [Tarantool-patches] [PATCH luajit 3/6] FFI: Ensure returned string is alive in ffi.typeinfo() Sergey Kaplun via Tarantool-patches
2023-10-24 21:33   ` Maxim Kokryashkin via Tarantool-patches
2023-11-29 14:48   ` Sergey Bronnikov via Tarantool-patches
2023-10-23  9:22 ` [Tarantool-patches] [PATCH luajit 4/6] FFI: Fix dangling reference to CType Sergey Kaplun via Tarantool-patches
2023-10-25  7:48   ` Maxim Kokryashkin via Tarantool-patches
2023-10-25 10:43     ` Sergey Kaplun via Tarantool-patches
2023-10-25 11:42       ` Maxim Kokryashkin via Tarantool-patches
2023-10-25  8:06   ` Maxim Kokryashkin via Tarantool-patches
2023-11-29 15:00   ` Sergey Bronnikov via Tarantool-patches
2023-10-23  9:22 ` [Tarantool-patches] [PATCH luajit 5/6] FFI: Fix dangling reference to CType. Improve checks Sergey Kaplun via Tarantool-patches
2023-10-25  8:05   ` Maxim Kokryashkin via Tarantool-patches [this message]
2023-10-25 10:46     ` Sergey Kaplun via Tarantool-patches
2023-10-25 11:42       ` Maxim Kokryashkin via Tarantool-patches
2023-11-29 15:41   ` Sergey Bronnikov via Tarantool-patches
2023-11-30  7:25     ` Sergey Kaplun via Tarantool-patches
2023-12-19 10:55       ` Sergey Bronnikov via Tarantool-patches
2023-10-23  9:22 ` [Tarantool-patches] [PATCH luajit 6/6] FFI: Fix dangling reference to CType in carith_checkarg() Sergey Kaplun via Tarantool-patches
2023-10-25  8:07   ` Maxim Kokryashkin via Tarantool-patches
2023-10-25 10:48     ` Sergey Kaplun via Tarantool-patches
2023-10-25 11:42       ` Maxim Kokryashkin via Tarantool-patches
2023-12-19 10:59   ` Sergey Bronnikov via Tarantool-patches
2023-12-19 11:01 ` [Tarantool-patches] [PATCH luajit 0/6] FFI fixes Sergey Bronnikov via Tarantool-patches
2024-01-10  8:53 ` Igor Munkin via Tarantool-patches

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=sf5poie64s7obyyjkq7hpz7a2hxfqrcd7kv3ns3nx45swlhklu@hszfhb5aqpcj \
    --to=tarantool-patches@dev.tarantool.org \
    --cc=m.kokryashkin@tarantool.org \
    --cc=skaplun@tarantool.org \
    --subject='Re: [Tarantool-patches] [PATCH luajit 5/6] FFI: Fix dangling reference to CType. Improve checks.' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox