envoyproxy/envoy

ASAN/UBSAN violations in LuaJIT

Open

#6,084 opened on Feb 27, 2019

View on GitHub
 (3 comments) (0 reactions) (0 assignees)C++ (5,373 forks)batch import
bughelp wanted

Repository metrics

Stars
 (27,997 stars)
PR merge metrics
 (Avg merge 8d) (378 merged PRs in 30d)

Description

Plumbing ASAN/UBSAN down to LuaJIT in https://github.com/envoyproxy/envoy/pull/6061 yields traces such as:

[ RUN      ] LuaFilterConfigTest.LuaFilterInJson
lj_obj.h:867:3: runtime error: member access within misaligned address 0x000040347424 for type 'GCobj' (aka 'union GCobj'), which requires 8 byte alignment
0x000040347424: note: pointer points here
  00 00 00 00 00 00 00 00  01 04 00 00 00 00 00 00  00 00 00 00 00 00 00 00  78 73 34 40 00 00 00 00
              ^ 
    #0 0x4353432 in setgcVraw /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_obj.h:867:3
    #1 0x4353432 in setgcV /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_obj.h:873
    #2 0x4353432 in setstrV /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_obj.h:881
    #3 0x4353432 in lua_pushstring /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lj_api.c:653
    #4 0x4610ad4 in luaL_openlibs /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lib_init.c:44:5
    #5 0x42beb44 in Envoy::Extensions::Filters::Common::Lua::ThreadLocalState::ThreadLocalState(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Envoy::ThreadLocal::SlotAllocator&) /proc/self/cwd/source/extensions/filters/common/lua/lua.cc:54:3
    #6 0x4218154 in Envoy::Extensions::HttpFilters::Lua::FilterConfig::FilterConfig(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Envoy::ThreadLocal::SlotAllocator&, Envoy::Upstream::ClusterManager&) /proc/self/cwd/source/extensions/filters/http/lua/lua_filter.cc:431:42
    #7 0x4001e9e in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfig::createFilterFactoryFromProtoTyped(envoy::config::filter::http::lua::v2::Lua const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Envoy::Server::Configuration::FactoryContext&) /proc/self/cwd/source/extensions/filters/http/lua/config.cc:18:48
    #8 0x4002665 in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfig::createFilterFactory(Envoy::Json::Object const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Envoy::Server::Configuration::FactoryContext&) /proc/self/cwd/source/extensions/filters/http/lua/config.cc:31:10
    #9 0x3f18f9f in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfigTest_LuaFilterInJson_Test::TestBody() /proc/self/cwd/test/extensions/filters/http/lua/config_test.cc:34:38
    #10 0x9800ade in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2424:10
    #11 0x97bb83f in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2460:14
    #12 0x977385b in testing::Test::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2499:5
    #13 0x9776026 in testing::TestInfo::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2675:11
    #14 0x9777b70 in testing::TestSuite::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2803:28
    #15 0x979f5fe in testing::internal::UnitTestImpl::RunAllTests() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5241:44
    #16 0x98108ee in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2424:10
    #17 0x97c584f in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2460:14
    #18 0x979e5e6 in testing::UnitTest::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:4843:10
    #19 0x6b28c86 in RUN_ALL_TESTS() /proc/self/cwd/external/com_google_googletest/googletest/include/gtest/gtest.h:2499:46
    #20 0x6b27f5e in Envoy::TestRunner::RunTests(int, char**) /proc/self/cwd/./test/test_runner.h:57:12
    #21 0x6b262e5 in main /proc/self/cwd/test/main.cc:39:10
    #22 0x7fc56655482f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #23 0x3e41028 in _start (/build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/execroot/envoy/bazel-out/k8-dbg/bin/test/extensions/filters/http/lua/config_test+0x3e41028)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior lj_obj.h:867:3 in 
=================================================================
==33008==ERROR: AddressSanitizer: global-buffer-overflow on address 0x0000006ed8a7 at pc 0x0000042fb0a5 bp 0x7ffd18b4d700 sp 0x7ffd18b4d6f8
READ of size 4 at 0x0000006ed8a7 thread T0
    #0 0x42fb0a4 in lj_getu32 /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_def.h:244:36
    #1 0x42fb0a4 in str_fastcmp /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lj_str.c:47
    #2 0x42fb0a4 in lj_str_new /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lj_str.c:155
    #3 0x45ec536 in newproxy_weaktable /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lib_base.c:654:34
    #4 0x45ec536 in luaopen_base /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lib_base.c:665
    #5 0x42dabe9 in lj_BC_FUNCC /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lj_vm.S:811
    #6 0x4610ae3 in luaL_openlibs /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/lib_init.c:45:5
    #7 0x42beb44 in Envoy::Extensions::Filters::Common::Lua::ThreadLocalState::ThreadLocalState(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Envoy::ThreadLocal::SlotAllocator&) /proc/self/cwd/source/extensions/filters/common/lua/lua.cc:54:3
    #8 0x4218154 in Envoy::Extensions::HttpFilters::Lua::FilterConfig::FilterConfig(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Envoy::ThreadLocal::SlotAllocator&, Envoy::Upstream::ClusterManager&) /proc/self/cwd/source/extensions/filters/http/lua/lua_filter.cc:431:42
    #9 0x4001e9e in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfig::createFilterFactoryFromProtoTyped(envoy::config::filter::http::lua::v2::Lua const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Envoy::Server::Configuration::FactoryContext&) /proc/self/cwd/source/extensions/filters/http/lua/config.cc:18:48
    #10 0x4002665 in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfig::createFilterFactory(Envoy::Json::Object const&, std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, Envoy::Server::Configuration::FactoryContext&) /proc/self/cwd/source/extensions/filters/http/lua/config.cc:31:10
    #11 0x3f18f9f in Envoy::Extensions::HttpFilters::Lua::LuaFilterConfigTest_LuaFilterInJson_Test::TestBody() /proc/self/cwd/test/extensions/filters/http/lua/config_test.cc:34:38
    #12 0x9800ade in void testing::internal::HandleSehExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2424:10
    #13 0x97bb83f in void testing::internal::HandleExceptionsInMethodIfSupported<testing::Test, void>(testing::Test*, void (testing::Test::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2460:14
    #14 0x977385b in testing::Test::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2499:5
    #15 0x9776026 in testing::TestInfo::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2675:11
    #16 0x9777b70 in testing::TestSuite::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2803:28
    #17 0x979f5fe in testing::internal::UnitTestImpl::RunAllTests() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:5241:44
    #18 0x98108ee in bool testing::internal::HandleSehExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2424:10
    #19 0x97c584f in bool testing::internal::HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool>(testing::internal::UnitTestImpl*, bool (testing::internal::UnitTestImpl::*)(), char const*) /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:2460:14
    #20 0x979e5e6 in testing::UnitTest::Run() /proc/self/cwd/external/com_google_googletest/googletest/src/gtest.cc:4843:10
    #21 0x6b28c86 in RUN_ALL_TESTS() /proc/self/cwd/external/com_google_googletest/googletest/include/gtest/gtest.h:2499:46
    #22 0x6b27f5e in Envoy::TestRunner::RunTests(int, char**) /proc/self/cwd/./test/test_runner.h:57:12
    #23 0x6b262e5 in main /proc/self/cwd/test/main.cc:39:10
    #24 0x7fc56655482f in __libc_start_main /build/glibc-Cl5G7W/glibc-2.23/csu/../csu/libc-start.c:291
    #25 0x3e41028 in _start (/build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/execroot/envoy/bazel-out/k8-dbg/bin/test/extensions/filters/http/lua/config_test+0x3e41028)

0x0000006ed8a7 is located 57 bytes to the left of global variable '<string literal>' defined in 'lib_base.c:655:6' (0x6ed8e0) of size 3
  '<string literal>' is ascii string 'kv'
0x0000006ed8a7 is located 0 bytes to the right of global variable '<string literal>' defined in 'lib_base.c:654:34' (0x6ed8a0) of size 7
  '<string literal>' is ascii string '__mode'
SUMMARY: AddressSanitizer: global-buffer-overflow /build/tmp/_bazel_bazel/b570b5ccd0454dc9af9f65ab1833764d/external/envoy_deps_cache_b22e04bff96538ea37e715942da6315c/luajit.dep.build/LuaJIT-2.1.0-beta3/src/./lj_def.h:244:36 in lj_getu32
Shadow bytes around the buggy address:
  0x0000800d5ac0: 00 00 01 f9 f9 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
  0x0000800d5ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800d5ae0: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 02 f9 f9
  0x0000800d5af0: f9 f9 f9 f9 00 00 00 00 00 00 00 01 f9 f9 f9 f9
  0x0000800d5b00: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
=>0x0000800d5b10: 00 00 00 00[07]f9 f9 f9 f9 f9 f9 f9 03 f9 f9 f9
  0x0000800d5b20: f9 f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800d5b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800d5b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800d5b50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0000800d5b60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07 
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==33008==ABORTING

See https://circleci.com/gh/envoyproxy/envoy/172899?utm_campaign=vcs-integration-link&utm_medium=referral&utm_source=github-build-link for more of these.

Contributor guide

Research direction
Investigate the misaligned memory access in lj obj.h:867 and the global buffer overflow in lib base.c:654. Consider adding alignment attributes to GCobj or modifying string comparison functions to handle unaligned data.
Tech stack
ccpp
Domain
backendsecurity
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
4
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
3-5 days
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
CLuaJIT internalsASAN/UBSAN
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
25