From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from [87.239.111.99] (localhost [127.0.0.1]) by dev.tarantool.org (Postfix) with ESMTP id 7FECA65341F; Wed, 25 Oct 2023 11:05:18 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 7FECA65341F DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=tarantool.org; s=dev; t=1698221118; bh=3jLAHKOxV0JL/MeLLGwiPVsgMp2ba3bWucTol67OHQM=; h=Date:To:References:In-Reply-To:Subject:List-Id:List-Unsubscribe: List-Archive:List-Post:List-Help:List-Subscribe:From:Reply-To:Cc: From; b=RECL0EFqMXKMUAvy3CcMaAV1XxE8xsZGz93wS3e7TP6sDAuDD2plWR5OpDBvecD90 0EisTVXF3WRZ1/k0LAb8pEeDUROLU1NpZ0hBexeOLDVFXvZlpUj0w/wbDjrX+Wi+mF linxOT4LGAGnPxAwUhsSWKvmANQaAJ0lROtpG8gs= Received: from smtp57.i.mail.ru (smtp57.i.mail.ru [95.163.41.95]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by dev.tarantool.org (Postfix) with ESMTPS id 0DE8B65341F for ; Wed, 25 Oct 2023 11:05:17 +0300 (MSK) DKIM-Filter: OpenDKIM Filter v2.11.0 dev.tarantool.org 0DE8B65341F Received: by smtp57.i.mail.ru with esmtpa (envelope-from ) id 1qvYt9-00BXmU-2g; Wed, 25 Oct 2023 11:05:16 +0300 Date: Wed, 25 Oct 2023 11:05:15 +0300 To: Sergey Kaplun Message-ID: References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Mailru-Src: smtp X-4EC0790: 10 X-7564579A: B8F34718100C35BD X-77F55803: 4F1203BC0FB41BD9315D6E1B1B5C3D6D0D2A7EF9CEBBEFF06750956A1DCE3C9900894C459B0CD1B9025E8B182F52208DFF2F1AFA518DC8E05C2DBC97BDB523BF594A56E8FBF655CE X-7FA49CB5: FF5795518A3D127A4AD6D5ED66289B5278DA827A17800CE7A0175C48BD57B26BC2099A533E45F2D0395957E7521B51C2CFCAF695D4D8E9FCEA1F7E6F0F101C6778DA827A17800CE757E1881156861268EA1F7E6F0F101C6723150C8DA25C47586E58E00D9D99D84E1BDDB23E98D2D38BE5CCB53A13BC8DBAAB121E170D24D41F5E0370FFCB69E04ACC7F00164DA146DAFE8445B8C89999728AA50765F7900637D0FEED2715E18529389733CBF5DBD5E9C8A9BA7A39EFB766F5D81C698A659EA7CC7F00164DA146DA9985D098DBDEAEC8B861051D4BA689FCF6B57BC7E6449061A352F6E88A58FB86F5D81C698A659EA73AA81AA40904B5D9A18204E546F3947C13BDA61BF53F5E1DBA3038C0950A5D36C8A9BA7A39EFB766D91E3A1F190DE8FDBA3038C0950A5D36D5E8D9A59859A8B64280523C145DA0913AA81AA40904B5D99C9F4D5AE37F343AD1F44FA8B9022EA23BBE47FD9DD3FB595F5C1EE8F4F765FC974A882099E279BDE2021AF6380DFAD18AA50765F790063735872C767BF85DA227C277FBC8AE2E8BAEB924C2B054B06E75ECD9A6C639B01B4E70A05D1297E1BBCB5012B2E24CD356 X-C1DE0DAB: 0D63561A33F958A5547FB255A185F688ABF1B64F782417DAEBCB193E1290E3C7F87CCE6106E1FC07E67D4AC08A07B9B0DB8A315C1FF4794DBDAD6C7F3747799A X-C8649E89: 1C3962B70DF3F0ADE00A9FD3E00BEEDF3FED46C3ACD6F73ED3581295AF09D3DF87807E0823442EA2ED31085941D9CD0AF7F820E7B07EA4CF482A762A336EAFF55CDA5CC85C7092E9CC6138675A06FDBC29A0721C83689C75F61CD9246542D0C4A789783558ABFE9C28B099D4B7F6A77034B7B377FF38209FE48CAC7CA610320002C26D483E81D6BE64ACE4A408B72B61B0CA6F94E606A667A52EF62A646584F811BD90D3D42C882D43082AE146A756F3 X-D57D3AED: 3ZO7eAau8CL7WIMRKs4sN3D3tLDjz0dLbV79QFUyzQ2Ujvy7cMT6pYYqY16iZVKkSc3dCLJ7zSJH7+u4VD18S7Vl4ZUrpaVfd2+vE6kuoey4m4VkSEu530nj6fImhcD4MUrOEAnl0W826KZ9Q+tr5ycPtXkTV4k65bRjmOUUP8cvGozZ33TWg5HZplvhhXbhDGzqmQDTd6OAevLeAnq3Ra9uf7zvY2zzsIhlcp/Y7m53TZgf2aB4JOg4gkr2bioj7UiV2qa299qbHYYZlwNAnw== X-Mailru-Sender: 00097D31F91C944B15339A1EB722E5034D9A0E1A7CD8365B6413E4FA262DBF2AFD5457F5548CF5255EA65D4B9F24FE89AED07E233588217FA46513A1025A7217E7B7573491FBF26DB0DAF586E7D11B3E67EA787935ED9F1B X-Mras: Ok Subject: Re: [Tarantool-patches] [PATCH luajit 5/6] FFI: Fix dangling reference to CType. Improve checks. X-BeenThere: tarantool-patches@dev.tarantool.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Tarantool development patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , From: Maxim Kokryashkin via Tarantool-patches Reply-To: Maxim Kokryashkin Cc: tarantool-patches@dev.tarantool.org Errors-To: tarantool-patches-bounces@dev.tarantool.org Sender: "Tarantool-patches" Hi, Sergey! Thanks for the patch! LGTM, after answering the same questions as for the previous patch. On Mon, Oct 23, 2023 at 12:22:05PM +0300, Sergey Kaplun wrote: > From: Mike Pall > > Reported by elmknot. > > (cherry-picked from commit cc96ab9d513582703f8663a8775a935b56db32b7) > > During the recording of an arithmetic operation with a cdata function > object and some cdata value in `recff_cdata_arith()`, reallocation of > `cts->tab` in `lj_ctype_intern()` may occur. In that case, the reference > to the first `CType` object (`s[0]`) becomes invalid. This patch saves > the `CTypeID` of this object and gets its `CType` again after possible > reallocation. > > Also, this commit fills `cts->tab` memory with zeros before being freed > when `-DLUAJIT_CTYPE_CHECK_ANCHOR` is defined. It helps to observe > assertion failures in case this memory is used after free. > > Sergey Kaplun: > * added the description and the test for the problem > > Part of tarantool/tarantool#9145 > --- > src/lj_crecord.c | 4 + > src/lj_ctype.c | 12 +++ > ...0-fix-dangling-reference-to-ctype.test.lua | 77 +++++++++++++++++++ > 3 files changed, 93 insertions(+) > create mode 100644 test/tarantool-tests/lj-920-fix-dangling-reference-to-ctype.test.lua > > diff --git a/src/lj_crecord.c b/src/lj_crecord.c > index 10d1dc70..e17e512f 100644 > --- a/src/lj_crecord.c > +++ b/src/lj_crecord.c > @@ -1502,9 +1502,13 @@ void LJ_FASTCALL recff_cdata_arith(jit_State *J, RecordFFData *rd) > if (ctype_isenum(ct->info)) ct = ctype_child(cts, ct); > goto ok; > } else if (ctype_isfunc(ct->info)) { > + CTypeID id0 = i ? ctype_typeid(cts, s[0]) : 0; > tr = emitir(IRT(IR_FLOAD, IRT_PTR), tr, IRFL_CDATA_PTR); > ct = ctype_get(cts, > lj_ctype_intern(cts, CTINFO(CT_PTR, CTALIGN_PTR|id), CTSIZE_PTR)); > + if (i) { > + s[0] = ctype_get(cts, id0); /* cts->tab may have been reallocated. */ > + } > goto ok; > } else { > tr = emitir(IRT(IR_ADD, IRT_PTR), tr, lj_ir_kintp(J, sizeof(GCcdata))); > diff --git a/src/lj_ctype.c b/src/lj_ctype.c > index a42e3d60..0874fa61 100644 > --- a/src/lj_ctype.c > +++ b/src/lj_ctype.c > @@ -191,8 +191,20 @@ CTypeID lj_ctype_intern(CTState *cts, CTInfo info, CTSize size) > } > id = cts->top; > if (LJ_UNLIKELY(id >= cts->sizetab)) { > +#ifdef LUAJIT_CTYPE_CHECK_ANCHOR > + CType *ct; > +#endif > if (id >= CTID_MAX) lj_err_msg(cts->L, LJ_ERR_TABOV); > +#ifdef LUAJIT_CTYPE_CHECK_ANCHOR > + ct = lj_mem_newvec(cts->L, id+1, CType); > + memcpy(ct, cts->tab, id*sizeof(CType)); > + memset(cts->tab, 0, id*sizeof(CType)); > + lj_mem_freevec(cts->g, cts->tab, cts->sizetab, CType); > + cts->tab = ct; > + cts->sizetab = id+1; > +#else > lj_mem_growvec(cts->L, cts->tab, cts->sizetab, CTID_MAX, CType); > +#endif > } > cts->top = id+1; > cts->tab[id].info = info; > diff --git a/test/tarantool-tests/lj-920-fix-dangling-reference-to-ctype.test.lua b/test/tarantool-tests/lj-920-fix-dangling-reference-to-ctype.test.lua > new file mode 100644 > index 00000000..a7e35888 > --- /dev/null > +++ b/test/tarantool-tests/lj-920-fix-dangling-reference-to-ctype.test.lua > @@ -0,0 +1,77 @@ > +local tap = require('tap') > +local ffi = require('ffi') > +local test = tap.test('lj-920-fix-dangling-reference-to-ctype'):skipcond({ > + ['Test requires JIT enabled'] = not jit.status(), > + -- luacheck: no global > + ['Impossible to predict the value of cts->top'] = _TARANTOOL, > +}) > + > +test:plan(1) > + > +-- This test demonstrates LuaJIT's incorrect behaviour when the > +-- reallocation of `cts->tab` strikes during the recording of the > +-- cdata metamethod arithmetic. > +-- The test fails under ASAN. > + > +-- XXX: Just some C functions to be casted. There is no need to > +-- declare their prototypes correctly. > +ffi.cdef[[ > + int malloc(void); > + int fprintf(void); > + int printf(void); > + int memset(void); > + int memcpy(void); > + int memmove(void); > + int getppid(void); > +]] > + > +local cfunc_type = ffi.metatype(ffi.typeof('struct {int a;}'), { > + -- Just some metatable with reloaded arithmetic operator. > + __add = function(o1, _) return o1 end > +}) > +-- Just some cdata with metamethod. > +local test_value = cfunc_type(1) > + > +-- XXX: structure to set `cts->top` to 112. > +local _ = ffi.new('struct {int a; long b; float c; double d;}', 0) > + > +-- Anchor table to prevent cdata objects from being collected. > +local anchor = {} > +-- Each call to this function grows `cts->top` by 3. > +local function save_new_func(func) > + anchor[#anchor + 1] = ffi.cast('void (*)(void)', func) > +end > + > +save_new_func(ffi.C.fprintf) -- `cts->top` = 112 > +save_new_func(ffi.C.printf) -- `cts->top` = 115 > +save_new_func(ffi.C.memset) -- `cts->top` = 118 > +save_new_func(ffi.C.memcpy) -- `cts->top` = 121 > +save_new_func(ffi.C.malloc) -- `cts->top` = 124 > + > +-- Assertions to check the `cts->top` value and step between > +-- calls. > +assert(ffi.typeinfo(124), 'cts->top >= 124') > +assert(not ffi.typeinfo(125), 'cts->top < 125') > + > +save_new_func(ffi.C.memmove) -- `cts->top` = 127 > + > +jit.opt.start('hotloop=1') > + > +-- Just some function to record trace and cause reallocation. > +local function recorded_func(func_arg) > + local res = test_value + func_arg > + return res > +end > +recorded_func(ffi.C.malloc) > + > +assert(ffi.typeinfo(127), 'cts->top >= 127') > +assert(not ffi.typeinfo(128), 'cts->top < 128') > + > +-- Last call to grow `cts->top` up to 129, so this causes > +-- `cts->tab` reallocation. Need to use different functions as > +-- an argument. > +recorded_func(ffi.C.getppid) > + > +test:ok(true, 'no heap-use-after-free in recff_cdata_arith') > + > +test:done(true) > -- > 2.42.0 >