bytecodealliance / bytecodealliance/wasmtime

The implementation of `fd_filestat_get` in wasi-preview1-component-adapter is unsound

Open
#8,956 20 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
18.6k
Forks
1.8k
Avg merge
1d 18h
Merged PRs (30d)
126

Description

The implementation uses the value of `metadataHash` as `st_ino`:

https://github.com/bytecodealliance/wasmtime/blob/225d20efe387bc3f4052ec3115125380f9c59774/crates/wasi-preview1-component-adapter/src/lib.rs#L950-L951

This is unsound. To quote the documentation for `metadataHash`:

> Return a hash of the metadata associated with a filesystem object referred to by a descriptor.
>
> This returns a hash of the last-modification timestamp and file size, and may also include the inode number, device number, birth timestamp, and other metadata fields that may change when the file is modified or replaced. It may also include a secret value chosen by the implementation and not otherwise exposed.
>
> Implementations are encourated to provide the following properties:
>
> - If the file is not modified or replaced, the computed hash value should usually not change.
> - If the object is modified or replaced, the computed hash value should usually change.
> - The inputs to the hash should not be easily computable from the computed hash.
>
> However, none of these is required.

Applications will commonly use `st1.st_ino == st2.st_ino` in order to determine if two files are the same (for example, Clang does it). My implementation of `metadataHash`, which always returns 0 and is compliant with the definition above, caused the combination of Clang and the wasip1 component adapter, to always treat all read files as the same file (which in practice meant the first `#include` caused an infinite loop).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.