envoyproxy / envoyproxy/envoy

ASAN/UBSAN violations in LuaJIT

Aperta
#6,084 3 commenti 0 reazioni 0 assegnatari Vedi su GitHub
bug help wanted
Lingua principale
C++
Stelle
28.9k
Fork
5.6k
Merge medio
1g 22h
PR unite (30g)
430

Descrizione

Plumbing ASAN/UBSAN down to LuaJIT in https://github.com/envoyproxy/envoy/pull/6061 yields traces such as:

```
[ RUN ] LuaFilterConfigTest.LuaFilterInJson
lj_obj.h:867:3: runtime error: member access within misaligned address 0x000040347424 for type 'GCobj' (aka 'union GCobj'), which requires 8 byte alignment
0x000040347424: note: pointer points here
00 00 00 00 00 00 00 00 01 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 73 34 40 00 00 00 00
^
#0 0x4353432 in setgcVraw /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_obj.h:867:3
#1 0x4353432 in setgcV /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_obj.h:873
#2 0x4353432 in setstrV /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_obj.h:881
#3 0x4353432 in lua_pushstring /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lj_api.c:653
#4 0x4610ad4 in luaL_openlibs /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lib_init.c:44:5
#5 0x42beb44 in Envoy::Extensions::Filters::Common::Lua::ThreadLocalState::ThreadLocalState(std::__cxx11::basic_string, std::allocator > const&, Envoy::ThreadLocal::SlotAllocator&) /proc/self/cwd/source/extensions/filters/common/lua/lua.cc:54:3
#6 0x4218154 in Envoy::Extensions::HttpFilters::Lua::FilterConfig::FilterConfig(std::__cxx11::basic_string, std::allocator > const&, Envoy::ThreadLocal::SlotAllocator&, Envoy::Upstream::ClusterManager&) /proc/self/cwd/source/extensions/filters/http/lua/lua_filter.cc:431:42
#7 0x4001e9e in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfig::createFilterFactoryFromProtoTyped(envoy::config::filter::http::lua::v2::Lua const&, std::__cxx11::basic_string, std::allocator > const&, Envoy::Server::Configuration::FactoryContext&) /proc/self/cwd/source/extensions/filters/http/lua/config.cc:18:48
#8 0x4002665 in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfig::createFilterFactory(Envoy::Json::Object const&, std::__cxx11::basic_string, std::allocator > const&, Envoy::Server::Configuration::FactoryContext&) /proc/self/cwd/source/extensions/filters/http/lua/config.cc:31:10
#9 0x3f18f9f in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfigTest_LuaFilterInJson_Test::TestBody() /proc/self/cwd/test/extensions/filters/http/lua/config_test.cc:34:38
#10 0x9800ade in void testing::internal::HandleSehExceptionsInMethodIfSupported(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2424:10
#11 0x97bb83f in void testing::internal::HandleExceptionsInMethodIfSupported(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2460:14
#12 0x977385b in testing::Test::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2499:5
#13 0x9776026 in testing::TestInfo::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2675:11
#14 0x9777b70 in testing::TestSuite::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2803:28
#15 0x979f5fe in testing::internal::UnitTestImpl::RunAllTests() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5241:44
#16 0x98108ee in bool testing::internal::HandleSehExceptionsInMethodIfSupported(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2424:10
#17 0x97c584f in bool testing::internal::HandleExceptionsInMethodIfSupported(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2460:14
#18 0x979e5e6 in testing::UnitTest::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:4843:10
#19 0x6b28c86 in RUN_ALL_TESTS() /proc/self/cwd/external/com_google_googletest/googletest/include/gtest/gtest.h:2499:46
#20 0x6b27f5e in Envoy::TestRunner::RunTests(int, char**) /proc/self/cwd/./test/test_runner.h:57:12
#21 0x6b262e5 in main /proc/self/cwd/test/main.cc:39:10
#22 0x7fc56655482f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#23 0x3e41028 in _start (/build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/execroot/envoy/bazel-out/k8-dbg/bin/test/extensions/filters/http/lua/config_test+0x3e41028)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior lj_obj.h:867:3 in
=================================================================
==33008==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000006ed8a7 at pc 0x0000042fb0a5 bp 0x7ffd18b4d700 sp 0x7ffd18b4d6f8
READ of size 4 at 0x0000006ed8a7 thread T0
#0 0x42fb0a4 in lj_getu32 /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_def.h:244:36
#1 0x42fb0a4 in str_fastcmp /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lj_str.c:47
#2 0x42fb0a4 in lj_str_new /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lj_str.c:155
#3 0x45ec536 in newproxy_weaktable /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lib_base.c:654:34
#4 0x45ec536 in luaopen_base /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lib_base.c:665
#5 0x42dabe9 in lj_BC_FUNCC /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lj_vm.S:811
#6 0x4610ae3 in luaL_openlibs /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lib_init.c:45:5
#7 0x42beb44 in Envoy::Extensions::Filters::Common::Lua::ThreadLocalState::ThreadLocalState(std::__cxx11::basic_string, std::allocator > const&, Envoy::ThreadLocal::SlotAllocator&) /proc/self/cwd/source/extensions/filters/common/lua/lua.cc:54:3
#8 0x4218154 in Envoy::Extensions::HttpFilters::Lua::FilterConfig::FilterConfig(std::__cxx11::basic_string, std::allocator > const&, Envoy::ThreadLocal::SlotAllocator&, Envoy::Upstream::ClusterManager&) /proc/self/cwd/source/extensions/filters/http/lua/lua_filter.cc:431:42
#9 0x4001e9e in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfig::createFilterFactoryFromProtoTyped(envoy::config::filter::http::lua::v2::Lua const&, std::__cxx11::basic_string, std::allocator > const&, Envoy::Server::Configuration::FactoryContext&) /proc/self/cwd/source/extensions/filters/http/lua/config.cc:18:48
#10 0x4002665 in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfig::createFilterFactory(Envoy::Json::Object const&, std::__cxx11::basic_string, std::allocator > const&, Envoy::Server::Configuration::FactoryContext&) /proc/self/cwd/source/extensions/filters/http/lua/config.cc:31:10
#11 0x3f18f9f in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfigTest_LuaFilterInJson_Test::TestBody() /proc/self/cwd/test/extensions/filters/http/lua/config_test.cc:34:38
#12 0x9800ade in void testing::internal::HandleSehExceptionsInMethodIfSupported(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2424:10
#13 0x97bb83f in void testing::internal::HandleExceptionsInMethodIfSupported(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2460:14
#14 0x977385b in testing::Test::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2499:5
#15 0x9776026 in testing::TestInfo::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2675:11
#16 0x9777b70 in testing::TestSuite::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2803:28
#17 0x979f5fe in testing::internal::UnitTestImpl::RunAllTests() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5241:44
#18 0x98108ee in bool testing::internal::HandleSehExceptionsInMethodIfSupported(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2424:10
#19 0x97c584f in bool testing::internal::HandleExceptionsInMethodIfSupported(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2460:14
#20 0x979e5e6 in testing::UnitTest::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:4843:10
#21 0x6b28c86 in RUN_ALL_TESTS() /proc/self/cwd/external/com_google_googletest/googletest/include/gtest/gtest.h:2499:46
#22 0x6b27f5e in Envoy::TestRunner::RunTests(int, char**) /proc/self/cwd/./test/test_runner.h:57:12
#23 0x6b262e5 in main /proc/self/cwd/test/main.cc:39:10
#24 0x7fc56655482f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
#25 0x3e41028 in _start (/build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/execroot/envoy/bazel-out/k8-dbg/bin/test/extensions/filters/http/lua/config_test+0x3e41028)

0x0000006ed8a7 is located 57 bytes to the left of global variable '' defined in 'lib_base.c:655:6' (0x6ed8e0) of size 3
'' is ascii string 'kv'
0x0000006ed8a7 is located 0 bytes to the right of global variable '' defined in 'lib_base.c:654:34' (0x6ed8a0) of size 7
'' is ascii string '__mode'
SUMMARY: AddressSanitizer: global-buffer-overflow /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_def.h:244:36 in lj_getu32
Shadow bytes around the buggy address:
0x0000800d5ac0: 00 00 01 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
0x0000800d5ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800d5ae0: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 02 f9 f9
0x0000800d5af0: f9 f9 f9 f9 00 00 00 00 00 00 00 01 f9 f9 f9 f9
0x0000800d5b00: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
=>0x0000800d5b10: 00 00 00 00[07]f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9
0x0000800d5b20: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800d5b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800d5b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800d5b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0000800d5b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
==33008==ABORTING
```

See https://circleci.com/gh/envoyproxy/envoy/172899?utm_campaign=vcs-integration-link&utm_medium=referral&utm_source=github-build-link for more of these.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.