bytecodealliance / bytecodealliance/wasmtime

MemoryImageSlot doesn't handle the case where RuntimeLinearMemory::byte_size is not host page-aligned

Open
#9,660 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
18.6k
Forks
1.8k
Avg merge
1d 18h
Merged PRs (30d)
126

Description

Discovered this while working on #9652.

Looking at `LocalMemory::new`:

https://github.com/bytecodealliance/wasmtime/blob/bc656c72126ca3dcdc9477960b88a1816d2c09cb/crates/wasmtime/src/runtime/vm/memory.rs#L484-L487

It passes in `alloc.byte_size()` as the `accessible` parameter to `MemoryImageSlot::create`:

https://github.com/bytecodealliance/wasmtime/blob/bc656c72126ca3dcdc9477960b88a1816d2c09cb/crates/wasmtime/src/runtime/vm/cow.rs#L337-L345

`self.accessible` is not rounded up to the host page size and is instead stored directly. But other places assume that `self.accessible` is page-aligned, for example:

https://github.com/bytecodealliance/wasmtime/blob/bc656c72126ca3dcdc9477960b88a1816d2c09cb/crates/wasmtime/src/runtime/vm/cow.rs#L425

This ends up resolving to `mprotect`:

https://github.com/bytecodealliance/wasmtime/blob/bc656c72126ca3dcdc9477960b88a1816d2c09cb/crates/wasmtime/src/runtime/vm/sys/unix/vm.rs#L9-L11

`mprotect` requires that its address is page-aligned, and will produce an `EINVAL` if it isn't.

I think there are likely also places where it panics or possibly even causes UB.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.