Bug #19792: arm の alpine 上でネストしたハッシュに長い文字列を入れると segmentation fault が発生する - Ruby master - Ruby Issue Tracking System

Actions

Copy link

Bug #19792

closed

arm の alpine 上でネストしたハッシュに長い文字列を入れると segmentation fault が発生する

Added by koke2y (優樹纐纈) over 1 year ago. Updated 9 months ago.

Status:

Closed

Assignee:

Target version:

ruby -v:

ruby 3.2.2 (2023-03-30 revision e51014f9c0) +YJIT [aarch64-linux-musl]

Backport:

3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: DONE

[ruby-dev:52034]

Tags:

musl, alpine

Description

実行環境¶

Docker version: Docker version 24.0.2, build cb74dfc
Docker image: ruby:3.2.2-alpine3.18

ホスト環境

chip: Apple M2 Max
OS version: Version 13.4

発生した事象¶

上記の環境で下記のスクリプトを実行すると、segmentation faultが発生しました。

str = 'a' * 100_000_000

hash = {
  x: {
    y: {
      z: str
    }
  }
}

p hash

81a3dc0d38e8:/api# ruby test.rb
test.rb:11: [BUG] Segmentation fault at 0x0000ffff84e454a0
ruby 3.2.2 (2023-03-30 revision e51014f9c0) +YJIT [aarch64-linux-musl]

-- Control frame information -----------------------------------------------
c:0006 p:---- s:0022 e:000021 CFUNC  :inspect
c:0005 p:---- s:0019 e:000018 CFUNC  :inspect
c:0004 p:---- s:0016 e:000015 CFUNC  :inspect
c:0003 p:---- s:0013 e:000012 CFUNC  :p
c:0002 p:0029 s:0008 E:001cc0 EVAL   test.rb:11 [FINISH]
c:0001 p:0000 s:0003 E:000da0 DUMMY  [FINISH]

Actions

Copy link

#1 [ruby-dev:52035]

Updated by k0kubun (Takashi Kokubun) over 1 year ago

私の手元の環境では再現させられないのですが、 [BUG] の出力を全行、最初から最後まで省略しないで投稿していただくことは可能でしょうか? c:0001 p:0000 s:0003 E:000da0 DUMMY [FINISH] で出力が停止してしまっていた場合は、そのように明示していただけると助かります。

Actions

Copy link

#2 [ruby-dev:52036]

Updated by koke2y (優樹纐纈) over 1 year ago

k0kubun (Takashi Kokubun) wrote in #note-1:

私の手元の環境では再現させられないのですが、 [BUG] の出力を全行、最初から最後まで省略しないで投稿していただくことは可能でしょうか? c:0001 p:0000 s:0003 E:000da0 DUMMY [FINISH] で出力が停止してしまっていた場合は、そのように明示していただけると助かります。

早速ご確認いただきありがとうございます。
下記が出力の全文になります。

test.rb:11: [BUG] Segmentation fault at 0x0000ffff84e454a0
ruby 3.2.2 (2023-03-30 revision e51014f9c0) +YJIT [aarch64-linux-musl]

-- Control frame information -----------------------------------------------
c:0006 p:---- s:0022 e:000021 CFUNC  :inspect
c:0005 p:---- s:0019 e:000018 CFUNC  :inspect
c:0004 p:---- s:0016 e:000015 CFUNC  :inspect
c:0003 p:---- s:0013 e:000012 CFUNC  :p
c:0002 p:0029 s:0008 E:001cc0 EVAL   test.rb:11 [FINISH]
c:0001 p:0000 s:0003 E:000da0 DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
test.rb:11:in `<main>'
test.rb:11:in `p'
test.rb:11:in `inspect'
test.rb:11:in `inspect'
test.rb:11:in `inspect'

-- Machine register context ------------------------------------------------
  x0: 0x0000ffff7ce444b5  x1: 0x0000ffff84e454a0  x2: 0x0000000005f5e102
  x3: 0x0000000000000000  x4: 0x0000ffff8ada35a2  x5: 0x0000ffff82da25b7
  x6: 0x000000003d7a3a7b  x7: 0x0000ffff9806d410 x18: 0x00000000000007fc
 x19: 0x0000000007ffffff x20: 0x0000ffff7ce444b0 x21: 0x0000000000000001
 x22: 0x0000ffff9301fb60 x23: 0x0000000005f5e107 x24: 0xffffffffffffffff
 x25: 0x0000ffff84e454a0 x26: 0x0000000005f5e102 x27: 0x0000000000000005
 x28: 0x0000000000000005 x29: 0x0000ffffefa08b80  sp: 0x0000ffffefa08b80
 fau: 0x0000ffff84e454a0

-- Other runtime information -----------------------------------------------

* Loaded script: test.rb

* Loaded features:

    0 enumerator.so
    1 thread.rb
    2 fiber.so
    3 rational.so
    4 complex.so
    5 ruby2_keywords.rb
    6 /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/encdb.so
    7 /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/trans/transdb.so
    8 /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/rbconfig.rb
    9 /usr/local/lib/ruby/3.2.0/rubygems/compatibility.rb
   10 /usr/local/lib/ruby/3.2.0/rubygems/defaults.rb
   11 /usr/local/lib/ruby/3.2.0/rubygems/deprecate.rb
   12 /usr/local/lib/ruby/3.2.0/rubygems/errors.rb
   13 /usr/local/lib/ruby/3.2.0/rubygems/unknown_command_spell_checker.rb
   14 /usr/local/lib/ruby/3.2.0/rubygems/exceptions.rb
   15 /usr/local/lib/ruby/3.2.0/rubygems/basic_specification.rb
   16 /usr/local/lib/ruby/3.2.0/rubygems/stub_specification.rb
   17 /usr/local/lib/ruby/3.2.0/rubygems/platform.rb
   18 /usr/local/lib/ruby/3.2.0/rubygems/util/list.rb
   19 /usr/local/lib/ruby/3.2.0/rubygems/version.rb
   20 /usr/local/lib/ruby/3.2.0/rubygems/requirement.rb
   21 /usr/local/lib/ruby/3.2.0/rubygems/specification.rb
   22 /usr/local/lib/ruby/3.2.0/rubygems/util.rb
   23 /usr/local/lib/ruby/3.2.0/rubygems/dependency.rb
   24 /usr/local/lib/ruby/3.2.0/rubygems/core_ext/kernel_gem.rb
   25 /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/monitor.so
   26 /usr/local/lib/ruby/3.2.0/monitor.rb
   27 /usr/local/lib/ruby/3.2.0/rubygems.rb
   28 /usr/local/lib/ruby/3.2.0/rubygems/path_support.rb
   29 /usr/local/lib/ruby/3.2.0/error_highlight/version.rb
   30 /usr/local/lib/ruby/3.2.0/error_highlight/base.rb
   31 /usr/local/lib/ruby/3.2.0/error_highlight/formatter.rb
   32 /usr/local/lib/ruby/3.2.0/error_highlight/core_ext.rb
   33 /usr/local/lib/ruby/3.2.0/error_highlight.rb
   34 /usr/local/lib/ruby/3.2.0/did_you_mean/version.rb
   35 /usr/local/lib/ruby/3.2.0/did_you_mean/core_ext/name_error.rb
   36 /usr/local/lib/ruby/3.2.0/did_you_mean/levenshtein.rb
   37 /usr/local/lib/ruby/3.2.0/did_you_mean/jaro_winkler.rb
   38 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checker.rb
   39 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/name_error_checkers/class_name_checker.rb
   40 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/name_error_checkers/variable_name_checker.rb
   41 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/name_error_checkers.rb
   42 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/method_name_checker.rb
   43 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/key_error_checker.rb
   44 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/null_checker.rb
   45 /usr/local/lib/ruby/3.2.0/did_you_mean/tree_spell_checker.rb
   46 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/require_path_checker.rb
   47 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/pattern_key_name_checker.rb
   48 /usr/local/lib/ruby/3.2.0/did_you_mean/formatter.rb
   49 /usr/local/lib/ruby/3.2.0/did_you_mean.rb
   50 /usr/local/lib/ruby/3.2.0/syntax_suggest/core_ext.rb

* Process memory map:

aaaac3bd0000-aaaac3bd1000 r-xp 00000000 fe:01 2507891                    /usr/local/bin/ruby
aaaac3bef000-aaaac3bf0000 r--p 0000f000 fe:01 2507891                    /usr/local/bin/ruby
aaaac3bf0000-aaaac3bf1000 rw-p 00010000 fe:01 2507891                    /usr/local/bin/ruby
aaaaf32b4000-aaaaf32b5000 ---p 00000000 00:00 0                          [heap]
aaaaf32b5000-aaaaf32c1000 rw-p 00000000 00:00 0                          [heap]
ffff7ce44000-ffff84e45000 rw-p 00000000 00:00 0 
ffff8ce46000-ffff92da9000 rw-p 00000000 00:00 0 
ffff92dab000-ffff92db7000 rw-p 00000000 00:00 0 
ffff92db7000-ffff92dd6000 r-xp 00000000 fe:01 2508203                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/monitor.so
ffff92dd6000-ffff92dd7000 r--p 0000f000 fe:01 2508203                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/monitor.so
ffff92dd7000-ffff92dd8000 rw-p 00010000 fe:01 2508203                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/monitor.so
ffff92dd8000-ffff92e40000 rw-p 00000000 00:00 0 
ffff92e44000-ffff92e80000 rw-p 00000000 00:00 0 
ffff92e82000-ffff92ebe000 rw-p 00000000 00:00 0 
ffff92ec4000-ffff92ecc000 rw-p 00000000 00:00 0 
ffff92ed0000-ffff92f64000 rw-p 00000000 00:00 0 
ffff92f66000-ffff93185000 rw-p 00000000 00:00 0 
ffff93185000-ffff931a4000 r-xp 00000000 fe:01 2508176                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/trans/transdb.so
ffff931a4000-ffff931a5000 r--p 0000f000 fe:01 2508176                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/trans/transdb.so
ffff931a5000-ffff931a6000 rw-p 00010000 fe:01 2508176                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/trans/transdb.so
ffff931a6000-ffff931aa000 rw-p 00000000 00:00 0 
ffff931aa000-ffff931c9000 r-xp 00000000 fe:01 2508132                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/encdb.so
ffff931c9000-ffff931ca000 r--p 0000f000 fe:01 2508132                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/encdb.so
ffff931ca000-ffff931cb000 rw-p 00010000 fe:01 2508132                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/encdb.so
ffff931cb000-ffff931d3000 rw-p 00000000 00:00 0 
ffff931d3000-ffff931d4000 ---p 00000000 00:00 0 
ffff931d4000-ffff93275000 rw-p 00000000 00:00 0 
ffff93275000-ffff93276000 ---p 00000000 00:00 0 
ffff93276000-ffff93317000 rw-p 00000000 00:00 0 
ffff93317000-ffff93318000 ---p 00000000 00:00 0 
ffff93318000-ffff933b9000 rw-p 00000000 00:00 0 
ffff933b9000-ffff933ba000 ---p 00000000 00:00 0 
ffff933ba000-ffff9345b000 rw-p 00000000 00:00 0 
ffff9345b000-ffff9345c000 ---p 00000000 00:00 0 
ffff9345c000-ffff934fd000 rw-p 00000000 00:00 0 
ffff934fd000-ffff934fe000 ---p 00000000 00:00 0 
ffff934fe000-ffff9359f000 rw-p 00000000 00:00 0 
ffff9359f000-ffff935a0000 ---p 00000000 00:00 0 
ffff935a0000-ffff93641000 rw-p 00000000 00:00 0 
ffff93641000-ffff93642000 ---p 00000000 00:00 0 
ffff93642000-ffff936e3000 rw-p 00000000 00:00 0 
ffff936e3000-ffff936e4000 ---p 00000000 00:00 0 
ffff936e4000-ffff93785000 rw-p 00000000 00:00 0 
ffff93785000-ffff93786000 ---p 00000000 00:00 0 
ffff93786000-ffff93827000 rw-p 00000000 00:00 0 
ffff93827000-ffff93828000 ---p 00000000 00:00 0 
ffff93828000-ffff938c9000 rw-p 00000000 00:00 0 
ffff938c9000-ffff938ca000 ---p 00000000 00:00 0 
ffff938ca000-ffff9396b000 rw-p 00000000 00:00 0 
ffff9396b000-ffff9396c000 ---p 00000000 00:00 0 
ffff9396c000-ffff93a0d000 rw-p 00000000 00:00 0 
ffff93a0d000-ffff93a0e000 ---p 00000000 00:00 0 
ffff93a0e000-ffff93aaf000 rw-p 00000000 00:00 0 
ffff93aaf000-ffff93ab0000 ---p 00000000 00:00 0 
ffff93ab0000-ffff93b51000 rw-p 00000000 00:00 0 
ffff93b51000-ffff93b52000 ---p 00000000 00:00 0 
ffff93b52000-ffff93bf3000 rw-p 00000000 00:00 0 
ffff93bf3000-ffff93bf4000 ---p 00000000 00:00 0 
ffff93bf4000-ffff93c95000 rw-p 00000000 00:00 0 
ffff93c95000-ffff93c96000 ---p 00000000 00:00 0 
ffff93c96000-ffff93d37000 rw-p 00000000 00:00 0 
ffff93d37000-ffff93d38000 ---p 00000000 00:00 0 
ffff93d38000-ffff93dd9000 rw-p 00000000 00:00 0 
ffff93dd9000-ffff93dda000 ---p 00000000 00:00 0 
ffff93dda000-ffff93e7b000 rw-p 00000000 00:00 0 
ffff93e7b000-ffff93e7c000 ---p 00000000 00:00 0 
ffff93e7c000-ffff93f1d000 rw-p 00000000 00:00 0 
ffff93f1d000-ffff93f1e000 ---p 00000000 00:00 0 
ffff93f1e000-ffff93fbf000 rw-p 00000000 00:00 0 
ffff93fbf000-ffff93fc0000 ---p 00000000 00:00 0 
ffff93fc0000-ffff94061000 rw-p 00000000 00:00 0 
ffff94061000-ffff94062000 ---p 00000000 00:00 0 
ffff94062000-ffff94103000 rw-p 00000000 00:00 0 
ffff94103000-ffff94104000 ---p 00000000 00:00 0 
ffff94104000-ffff941a5000 rw-p 00000000 00:00 0 
ffff941a5000-ffff941a6000 ---p 00000000 00:00 0 
ffff941a6000-ffff94247000 rw-p 00000000 00:00 0 
ffff94247000-ffff94248000 ---p 00000000 00:00 0 
ffff94248000-ffff942e9000 rw-p 00000000 00:00 0 
ffff942e9000-ffff942ea000 ---p 00000000 00:00 0 
ffff942ea000-ffff9438b000 rw-p 00000000 00:00 0 
ffff9438b000-ffff9438c000 ---p 00000000 00:00 0 
ffff9438c000-ffff9442d000 rw-p 00000000 00:00 0 
ffff9442d000-ffff9442e000 ---p 00000000 00:00 0 
ffff9442e000-ffff944cf000 rw-p 00000000 00:00 0 
ffff944cf000-ffff944d0000 ---p 00000000 00:00 0 
ffff944d0000-ffff94571000 rw-p 00000000 00:00 0 
ffff94571000-ffff94572000 ---p 00000000 00:00 0 
ffff94572000-ffff978c6000 rw-p 00000000 00:00 0 
ffff978c6000-ffff978f5000 r-xp 00000000 fe:01 2507563                    /usr/lib/libgcc_s.so.1
ffff978f5000-ffff978f6000 r--p 0001f000 fe:01 2507563                    /usr/lib/libgcc_s.so.1
ffff978f6000-ffff978f7000 rw-p 00020000 fe:01 2507563                    /usr/lib/libgcc_s.so.1
ffff978f7000-ffff97975000 r-xp 00000000 fe:01 2507567                    /usr/lib/libgmp.so.10.4.1
ffff97975000-ffff97977000 r--p 0006e000 fe:01 2507567                    /usr/lib/libgmp.so.10.4.1
ffff97977000-ffff97978000 rw-p 00070000 fe:01 2507567                    /usr/lib/libgmp.so.10.4.1
ffff97978000-ffff979a7000 r-xp 00000000 fe:01 2504591                    /lib/libz.so.1.2.13
ffff979a7000-ffff979a8000 r--p 0001f000 fe:01 2504591                    /lib/libz.so.1.2.13
ffff979a8000-ffff979a9000 rw-p 00020000 fe:01 2504591                    /lib/libz.so.1.2.13
ffff979a9000-ffff97f9a000 r-xp 00000000 fe:01 2508107                    /usr/local/lib/libruby.so.3.2.2
ffff97f9a000-ffff97fb9000 r--p 005f1000 fe:01 2508107                    /usr/local/lib/libruby.so.3.2.2
ffff97fb9000-ffff97fba000 rw-p 00610000 fe:01 2508107                    /usr/local/lib/libruby.so.3.2.2
ffff97fba000-ffff97fcb000 rw-p 00000000 00:00 0 
ffff97fcb000-ffff98069000 r-xp 00000000 fe:01 2504585                    /lib/ld-musl-aarch64.so.1
ffff98069000-ffff98077000 rw-p 00000000 00:00 0 
ffff98077000-ffff98079000 r--p 00000000 00:00 0                          [vvar]
ffff98079000-ffff9807a000 r-xp 00000000 00:00 0                          [vdso]
ffff9807a000-ffff9807c000 rw-p 0009f000 fe:01 2504585                    /lib/ld-musl-aarch64.so.1
ffff9807c000-ffff9807e000 rw-p 00000000 00:00 0 
ffff980f0000-ffff980f3000 r-xp 00000000 00:00 0 
ffff980f3000-ffff9c0f0000 ---p 00000000 00:00 0 
ffffef20c000-ffffefa0b000 rw-p 00000000 00:00 0                          [stack]

Actions

Copy link

#3 [ruby-dev:52037]

Updated by willnet (Shinichi Maeshima) over 1 year ago

以下の環境でも再現しました

Docker version 24.0.2, build cb74dfc
M1 Max
Ventura 13.5

Actions

Copy link

Updated by alanwu (Alan Wu) over 1 year ago

Status changed from Open to Closed

Applied in changeset git|2214bcb70d9f9120f1f3790ca340236c8f080991.

Fix premature string collection during append

Previously, the following crashed due to use-after-free
with AArch64 Alpine Linux 3.18.3 (aarch64-linux-musl):

str = 'a' * (32*1024*1024)
p({z: str})

32 MiB is the default for GC_MALLOC_LIMIT_MAX, and the crash
could be dodged by setting RUBY_GC_MALLOC_LIMIT_MAX to large values.
Under a debugger, one can see the str2 of rb_str_buf_append()
getting prematurely collected while str_buf_cat4() allocates capacity.

Add GC guards so the buffer of str2 lives across the GC run
initiated in str_buf_cat4().

[Bug #19792]

Actions

Copy link

#5 [ruby-dev:52039]

Updated by alanwu (Alan Wu) over 1 year ago

Backport changed from 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN to 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: REQUIRED

ご丁寧にありがとうございます。

Actions

Copy link

#6 [ruby-dev:52049]

Updated by nagachika (Tomoyuki Chikanaga) about 1 year ago

Backport changed from 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: REQUIRED to 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: DONE

ruby_3_2 d30781db4de82a891712f359d7659c9fc98cb215 merged revision(s) 2214bcb70d9f9120f1f3790ca340236c8f080991.

Actions

Copy link

Updated by hsbt (Hiroshi SHIBATA) 9 months ago

Tags set to musl, alpine

Actions

Copy link

Also available in: Atom PDF

Like1

Like0Like0Like0Like1Like0Like0Like0

Project

General

Profile

Ruby » Ruby master

Custom queries

Bug #19792

arm の alpine 上でネストしたハッシュに長い文字列を入れると segmentation fault が発生する

実行環境¶

発生した事象¶

Updated by k0kubun (Takashi Kokubun) over 1 year ago

Updated by koke2y (優樹纐纈) over 1 year ago

Updated by willnet (Shinichi Maeshima) over 1 year ago

Updated by alanwu (Alan Wu) over 1 year ago

Updated by alanwu (Alan Wu) over 1 year ago

Updated by nagachika (Tomoyuki Chikanaga) about 1 year ago

Updated by hsbt (Hiroshi SHIBATA) 9 months ago

Project

General

Profile

Ruby » Ruby master

Custom queries

Bug #19792

arm の alpine 上でネストしたハッシュに長い文字列を入れると segmentation fault が発生する

実行環境¶

発生した事象¶

Updated by k0kubun (Takashi Kokubun) over 1 year ago

Updated by koke2y (優樹 纐纈) over 1 year ago

Updated by willnet (Shinichi Maeshima) over 1 year ago

Updated by alanwu (Alan Wu) over 1 year ago

Updated by alanwu (Alan Wu) over 1 year ago

Updated by nagachika (Tomoyuki Chikanaga) about 1 year ago

Updated by hsbt (Hiroshi SHIBATA) 9 months ago

Updated by koke2y (優樹纐纈) over 1 year ago