Bug #19792: arm の alpine 上でネストしたハッシュに長い文字列を入れると segmentation fault が発生する

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: ruby 3.2.2 (2023-03-30 revision e51014f9c0) +YJIT [aarch64-linux-musl]
• Backport: 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: DONE
• Tags: musl, alpine

[koke2y (優樹 纐纈)]

実行環境

Docker version: Docker version 24.0.2, build cb74dfc
Docker image: ruby:3.2.2-alpine3.18

ホスト環境

• chip: Apple M2 Max
• OS version: Version 13.4

発生した事象

上記の環境で下記のスクリプトを実行すると、segmentation faultが発生しました。

str = 'a' * 100_000_000

hash = {
  x: {
    y: {
      z: str
    }
  }
}

p hash

81a3dc0d38e8:/api# ruby test.rb
test.rb:11: [BUG] Segmentation fault at 0x0000ffff84e454a0
ruby 3.2.2 (2023-03-30 revision e51014f9c0) +YJIT [aarch64-linux-musl]

-- Control frame information -----------------------------------------------
c:0006 p:---- s:0022 e:000021 CFUNC  :inspect
c:0005 p:---- s:0019 e:000018 CFUNC  :inspect
c:0004 p:---- s:0016 e:000015 CFUNC  :inspect
c:0003 p:---- s:0013 e:000012 CFUNC  :p
c:0002 p:0029 s:0008 E:001cc0 EVAL   test.rb:11 [FINISH]
c:0001 p:0000 s:0003 E:000da0 DUMMY  [FINISH]

[k0kubun (Takashi Kokubun)]

私の手元の環境では再現させられないのですが、 [BUG] の出力を全行、最初から最後まで省略しないで投稿していただくことは可能でしょうか? c:0001 p:0000 s:0003 E:000da0 DUMMY [FINISH] で出力が停止してしまっていた場合は、そのように明示していただけると助かります。

[koke2y (優樹 纐纈)]

k0kubun (Takashi Kokubun) wrote in #note-1:

私の手元の環境では再現させられないのですが、 [BUG] の出力を全行、最初から最後まで省略しないで投稿していただくことは可能でしょうか? c:0001 p:0000 s:0003 E:000da0 DUMMY [FINISH] で出力が停止してしまっていた場合は、そのように明示していただけると助かります。

早速ご確認いただきありがとうございます。
下記が出力の全文になります。

test.rb:11: [BUG] Segmentation fault at 0x0000ffff84e454a0
ruby 3.2.2 (2023-03-30 revision e51014f9c0) +YJIT [aarch64-linux-musl]

-- Control frame information -----------------------------------------------
c:0006 p:---- s:0022 e:000021 CFUNC  :inspect
c:0005 p:---- s:0019 e:000018 CFUNC  :inspect
c:0004 p:---- s:0016 e:000015 CFUNC  :inspect
c:0003 p:---- s:0013 e:000012 CFUNC  :p
c:0002 p:0029 s:0008 E:001cc0 EVAL   test.rb:11 [FINISH]
c:0001 p:0000 s:0003 E:000da0 DUMMY  [FINISH]

-- Ruby level backtrace information ----------------------------------------
test.rb:11:in `<main>'
test.rb:11:in `p'
test.rb:11:in `inspect'
test.rb:11:in `inspect'
test.rb:11:in `inspect'

-- Machine register context ------------------------------------------------
  x0: 0x0000ffff7ce444b5  x1: 0x0000ffff84e454a0  x2: 0x0000000005f5e102
  x3: 0x0000000000000000  x4: 0x0000ffff8ada35a2  x5: 0x0000ffff82da25b7
  x6: 0x000000003d7a3a7b  x7: 0x0000ffff9806d410 x18: 0x00000000000007fc
 x19: 0x0000000007ffffff x20: 0x0000ffff7ce444b0 x21: 0x0000000000000001
 x22: 0x0000ffff9301fb60 x23: 0x0000000005f5e107 x24: 0xffffffffffffffff
 x25: 0x0000ffff84e454a0 x26: 0x0000000005f5e102 x27: 0x0000000000000005
 x28: 0x0000000000000005 x29: 0x0000ffffefa08b80  sp: 0x0000ffffefa08b80
 fau: 0x0000ffff84e454a0

-- Other runtime information -----------------------------------------------

* Loaded script: test.rb

* Loaded features:

    0 enumerator.so
    1 thread.rb
    2 fiber.so
    3 rational.so
    4 complex.so
    5 ruby2_keywords.rb
    6 /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/encdb.so
    7 /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/trans/transdb.so
    8 /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/rbconfig.rb
    9 /usr/local/lib/ruby/3.2.0/rubygems/compatibility.rb
   10 /usr/local/lib/ruby/3.2.0/rubygems/defaults.rb
   11 /usr/local/lib/ruby/3.2.0/rubygems/deprecate.rb
   12 /usr/local/lib/ruby/3.2.0/rubygems/errors.rb
   13 /usr/local/lib/ruby/3.2.0/rubygems/unknown_command_spell_checker.rb
   14 /usr/local/lib/ruby/3.2.0/rubygems/exceptions.rb
   15 /usr/local/lib/ruby/3.2.0/rubygems/basic_specification.rb
   16 /usr/local/lib/ruby/3.2.0/rubygems/stub_specification.rb
   17 /usr/local/lib/ruby/3.2.0/rubygems/platform.rb
   18 /usr/local/lib/ruby/3.2.0/rubygems/util/list.rb
   19 /usr/local/lib/ruby/3.2.0/rubygems/version.rb
   20 /usr/local/lib/ruby/3.2.0/rubygems/requirement.rb
   21 /usr/local/lib/ruby/3.2.0/rubygems/specification.rb
   22 /usr/local/lib/ruby/3.2.0/rubygems/util.rb
   23 /usr/local/lib/ruby/3.2.0/rubygems/dependency.rb
   24 /usr/local/lib/ruby/3.2.0/rubygems/core_ext/kernel_gem.rb
   25 /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/monitor.so
   26 /usr/local/lib/ruby/3.2.0/monitor.rb
   27 /usr/local/lib/ruby/3.2.0/rubygems.rb
   28 /usr/local/lib/ruby/3.2.0/rubygems/path_support.rb
   29 /usr/local/lib/ruby/3.2.0/error_highlight/version.rb
   30 /usr/local/lib/ruby/3.2.0/error_highlight/base.rb
   31 /usr/local/lib/ruby/3.2.0/error_highlight/formatter.rb
   32 /usr/local/lib/ruby/3.2.0/error_highlight/core_ext.rb
   33 /usr/local/lib/ruby/3.2.0/error_highlight.rb
   34 /usr/local/lib/ruby/3.2.0/did_you_mean/version.rb
   35 /usr/local/lib/ruby/3.2.0/did_you_mean/core_ext/name_error.rb
   36 /usr/local/lib/ruby/3.2.0/did_you_mean/levenshtein.rb
   37 /usr/local/lib/ruby/3.2.0/did_you_mean/jaro_winkler.rb
   38 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checker.rb
   39 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/name_error_checkers/class_name_checker.rb
   40 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/name_error_checkers/variable_name_checker.rb
   41 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/name_error_checkers.rb
   42 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/method_name_checker.rb
   43 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/key_error_checker.rb
   44 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/null_checker.rb
   45 /usr/local/lib/ruby/3.2.0/did_you_mean/tree_spell_checker.rb
   46 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/require_path_checker.rb
   47 /usr/local/lib/ruby/3.2.0/did_you_mean/spell_checkers/pattern_key_name_checker.rb
   48 /usr/local/lib/ruby/3.2.0/did_you_mean/formatter.rb
   49 /usr/local/lib/ruby/3.2.0/did_you_mean.rb
   50 /usr/local/lib/ruby/3.2.0/syntax_suggest/core_ext.rb

* Process memory map:

aaaac3bd0000-aaaac3bd1000 r-xp 00000000 fe:01 2507891                    /usr/local/bin/ruby
aaaac3bef000-aaaac3bf0000 r--p 0000f000 fe:01 2507891                    /usr/local/bin/ruby
aaaac3bf0000-aaaac3bf1000 rw-p 00010000 fe:01 2507891                    /usr/local/bin/ruby
aaaaf32b4000-aaaaf32b5000 ---p 00000000 00:00 0                          [heap]
aaaaf32b5000-aaaaf32c1000 rw-p 00000000 00:00 0                          [heap]
ffff7ce44000-ffff84e45000 rw-p 00000000 00:00 0 
ffff8ce46000-ffff92da9000 rw-p 00000000 00:00 0 
ffff92dab000-ffff92db7000 rw-p 00000000 00:00 0 
ffff92db7000-ffff92dd6000 r-xp 00000000 fe:01 2508203                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/monitor.so
ffff92dd6000-ffff92dd7000 r--p 0000f000 fe:01 2508203                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/monitor.so
ffff92dd7000-ffff92dd8000 rw-p 00010000 fe:01 2508203                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/monitor.so
ffff92dd8000-ffff92e40000 rw-p 00000000 00:00 0 
ffff92e44000-ffff92e80000 rw-p 00000000 00:00 0 
ffff92e82000-ffff92ebe000 rw-p 00000000 00:00 0 
ffff92ec4000-ffff92ecc000 rw-p 00000000 00:00 0 
ffff92ed0000-ffff92f64000 rw-p 00000000 00:00 0 
ffff92f66000-ffff93185000 rw-p 00000000 00:00 0 
ffff93185000-ffff931a4000 r-xp 00000000 fe:01 2508176                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/trans/transdb.so
ffff931a4000-ffff931a5000 r--p 0000f000 fe:01 2508176                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/trans/transdb.so
ffff931a5000-ffff931a6000 rw-p 00010000 fe:01 2508176                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/trans/transdb.so
ffff931a6000-ffff931aa000 rw-p 00000000 00:00 0 
ffff931aa000-ffff931c9000 r-xp 00000000 fe:01 2508132                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/encdb.so
ffff931c9000-ffff931ca000 r--p 0000f000 fe:01 2508132                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/encdb.so
ffff931ca000-ffff931cb000 rw-p 00010000 fe:01 2508132                    /usr/local/lib/ruby/3.2.0/aarch64-linux-musl/enc/encdb.so
ffff931cb000-ffff931d3000 rw-p 00000000 00:00 0 
ffff931d3000-ffff931d4000 ---p 00000000 00:00 0 
ffff931d4000-ffff93275000 rw-p 00000000 00:00 0 
ffff93275000-ffff93276000 ---p 00000000 00:00 0 
ffff93276000-ffff93317000 rw-p 00000000 00:00 0 
ffff93317000-ffff93318000 ---p 00000000 00:00 0 
ffff93318000-ffff933b9000 rw-p 00000000 00:00 0 
ffff933b9000-ffff933ba000 ---p 00000000 00:00 0 
ffff933ba000-ffff9345b000 rw-p 00000000 00:00 0 
ffff9345b000-ffff9345c000 ---p 00000000 00:00 0 
ffff9345c000-ffff934fd000 rw-p 00000000 00:00 0 
ffff934fd000-ffff934fe000 ---p 00000000 00:00 0 
ffff934fe000-ffff9359f000 rw-p 00000000 00:00 0 
ffff9359f000-ffff935a0000 ---p 00000000 00:00 0 
ffff935a0000-ffff93641000 rw-p 00000000 00:00 0 
ffff93641000-ffff93642000 ---p 00000000 00:00 0 
ffff93642000-ffff936e3000 rw-p 00000000 00:00 0 
ffff936e3000-ffff936e4000 ---p 00000000 00:00 0 
ffff936e4000-ffff93785000 rw-p 00000000 00:00 0 
ffff93785000-ffff93786000 ---p 00000000 00:00 0 
ffff93786000-ffff93827000 rw-p 00000000 00:00 0 
ffff93827000-ffff93828000 ---p 00000000 00:00 0 
ffff93828000-ffff938c9000 rw-p 00000000 00:00 0 
ffff938c9000-ffff938ca000 ---p 00000000 00:00 0 
ffff938ca000-ffff9396b000 rw-p 00000000 00:00 0 
ffff9396b000-ffff9396c000 ---p 00000000 00:00 0 
ffff9396c000-ffff93a0d000 rw-p 00000000 00:00 0 
ffff93a0d000-ffff93a0e000 ---p 00000000 00:00 0 
ffff93a0e000-ffff93aaf000 rw-p 00000000 00:00 0 
ffff93aaf000-ffff93ab0000 ---p 00000000 00:00 0 
ffff93ab0000-ffff93b51000 rw-p 00000000 00:00 0 
ffff93b51000-ffff93b52000 ---p 00000000 00:00 0 
ffff93b52000-ffff93bf3000 rw-p 00000000 00:00 0 
ffff93bf3000-ffff93bf4000 ---p 00000000 00:00 0 
ffff93bf4000-ffff93c95000 rw-p 00000000 00:00 0 
ffff93c95000-ffff93c96000 ---p 00000000 00:00 0 
ffff93c96000-ffff93d37000 rw-p 00000000 00:00 0 
ffff93d37000-ffff93d38000 ---p 00000000 00:00 0 
ffff93d38000-ffff93dd9000 rw-p 00000000 00:00 0 
ffff93dd9000-ffff93dda000 ---p 00000000 00:00 0 
ffff93dda000-ffff93e7b000 rw-p 00000000 00:00 0 
ffff93e7b000-ffff93e7c000 ---p 00000000 00:00 0 
ffff93e7c000-ffff93f1d000 rw-p 00000000 00:00 0 
ffff93f1d000-ffff93f1e000 ---p 00000000 00:00 0 
ffff93f1e000-ffff93fbf000 rw-p 00000000 00:00 0 
ffff93fbf000-ffff93fc0000 ---p 00000000 00:00 0 
ffff93fc0000-ffff94061000 rw-p 00000000 00:00 0 
ffff94061000-ffff94062000 ---p 00000000 00:00 0 
ffff94062000-ffff94103000 rw-p 00000000 00:00 0 
ffff94103000-ffff94104000 ---p 00000000 00:00 0 
ffff94104000-ffff941a5000 rw-p 00000000 00:00 0 
ffff941a5000-ffff941a6000 ---p 00000000 00:00 0 
ffff941a6000-ffff94247000 rw-p 00000000 00:00 0 
ffff94247000-ffff94248000 ---p 00000000 00:00 0 
ffff94248000-ffff942e9000 rw-p 00000000 00:00 0 
ffff942e9000-ffff942ea000 ---p 00000000 00:00 0 
ffff942ea000-ffff9438b000 rw-p 00000000 00:00 0 
ffff9438b000-ffff9438c000 ---p 00000000 00:00 0 
ffff9438c000-ffff9442d000 rw-p 00000000 00:00 0 
ffff9442d000-ffff9442e000 ---p 00000000 00:00 0 
ffff9442e000-ffff944cf000 rw-p 00000000 00:00 0 
ffff944cf000-ffff944d0000 ---p 00000000 00:00 0 
ffff944d0000-ffff94571000 rw-p 00000000 00:00 0 
ffff94571000-ffff94572000 ---p 00000000 00:00 0 
ffff94572000-ffff978c6000 rw-p 00000000 00:00 0 
ffff978c6000-ffff978f5000 r-xp 00000000 fe:01 2507563                    /usr/lib/libgcc_s.so.1
ffff978f5000-ffff978f6000 r--p 0001f000 fe:01 2507563                    /usr/lib/libgcc_s.so.1
ffff978f6000-ffff978f7000 rw-p 00020000 fe:01 2507563                    /usr/lib/libgcc_s.so.1
ffff978f7000-ffff97975000 r-xp 00000000 fe:01 2507567                    /usr/lib/libgmp.so.10.4.1
ffff97975000-ffff97977000 r--p 0006e000 fe:01 2507567                    /usr/lib/libgmp.so.10.4.1
ffff97977000-ffff97978000 rw-p 00070000 fe:01 2507567                    /usr/lib/libgmp.so.10.4.1
ffff97978000-ffff979a7000 r-xp 00000000 fe:01 2504591                    /lib/libz.so.1.2.13
ffff979a7000-ffff979a8000 r--p 0001f000 fe:01 2504591                    /lib/libz.so.1.2.13
ffff979a8000-ffff979a9000 rw-p 00020000 fe:01 2504591                    /lib/libz.so.1.2.13
ffff979a9000-ffff97f9a000 r-xp 00000000 fe:01 2508107                    /usr/local/lib/libruby.so.3.2.2
ffff97f9a000-ffff97fb9000 r--p 005f1000 fe:01 2508107                    /usr/local/lib/libruby.so.3.2.2
ffff97fb9000-ffff97fba000 rw-p 00610000 fe:01 2508107                    /usr/local/lib/libruby.so.3.2.2
ffff97fba000-ffff97fcb000 rw-p 00000000 00:00 0 
ffff97fcb000-ffff98069000 r-xp 00000000 fe:01 2504585                    /lib/ld-musl-aarch64.so.1
ffff98069000-ffff98077000 rw-p 00000000 00:00 0 
ffff98077000-ffff98079000 r--p 00000000 00:00 0                          [vvar]
ffff98079000-ffff9807a000 r-xp 00000000 00:00 0                          [vdso]
ffff9807a000-ffff9807c000 rw-p 0009f000 fe:01 2504585                    /lib/ld-musl-aarch64.so.1
ffff9807c000-ffff9807e000 rw-p 00000000 00:00 0 
ffff980f0000-ffff980f3000 r-xp 00000000 00:00 0 
ffff980f3000-ffff9c0f0000 ---p 00000000 00:00 0 
ffffef20c000-ffffefa0b000 rw-p 00000000 00:00 0                          [stack]

[willnet (Shinichi Maeshima)]

以下の環境でも再現しました

• Docker version 24.0.2, build cb74dfc
• M1 Max
• Ventura 13.5

[alanwu (Alan Wu)]

• Status changed from Open to Closed

Applied in changeset git|2214bcb70d9f9120f1f3790ca340236c8f080991.

---

Fix premature string collection during append

Previously, the following crashed due to use-after-free
with AArch64 Alpine Linux 3.18.3 (aarch64-linux-musl):

str = 'a' * (32*1024*1024)
p({z: str})

32 MiB is the default for GC_MALLOC_LIMIT_MAX, and the crash
could be dodged by setting RUBY_GC_MALLOC_LIMIT_MAX to large values.
Under a debugger, one can see the str2 of rb_str_buf_append()
getting prematurely collected while str_buf_cat4() allocates capacity.

Add GC guards so the buffer of str2 lives across the GC run
initiated in str_buf_cat4().

[Bug #19792]

[alanwu (Alan Wu)]

• Backport changed from 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: UNKNOWN to 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: REQUIRED

ご丁寧にありがとうございます。

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: REQUIRED to 3.0: UNKNOWN, 3.1: UNKNOWN, 3.2: DONE

ruby_3_2 d30781db4de82a891712f359d7659c9fc98cb215 merged revision(s) 2214bcb70d9f9120f1f3790ca340236c8f080991.

[hsbt (Hiroshi SHIBATA)]

• Tags set to musl, alpine