| Andrew Geissler | d688a01 | 2020-09-18 13:36:00 -0500 | [diff] [blame] | 1 | From 1e6df25ac28dcd89f0324177bb55019422404b44 Mon Sep 17 00:00:00 2001 |
| 2 | From: Roberto Ierusalimschy <roberto@inf.puc-rio.br> |
| 3 | Date: Thu, 3 Sep 2020 15:32:17 +0800 |
| 4 | Subject: [PATCH] Fixed bug: barriers cannot be active during sweep |
| 5 | |
| 6 | Barriers cannot be active during sweep, even in generational mode. |
| 7 | (Although gen. mode is not incremental, it can hit a barrier when |
| 8 | deleting a thread and closing its upvalues.) The colors of objects are |
| 9 | being changed during sweep and, therefore, cannot be trusted. |
| 10 | |
| 11 | Upstream-Status: Backport [https://github.com/lua/lua/commit/a6da1472c0c5e05ff249325f979531ad51533110] |
| 12 | CVE: CVE-2020-24371 |
| 13 | |
| 14 | [Adjust code KGC_INC -> KGC_NORMAL, refer 69371c4b84becac09c445aae01d005b49658ef82] |
| 15 | Signed-off-by: Wenlin Kang <wenlin.kang@windriver.com> |
| 16 | --- |
| 17 | src/lgc.c | 33 ++++++++++++++++++++++++--------- |
| 18 | 1 file changed, 24 insertions(+), 9 deletions(-) |
| 19 | |
| 20 | diff --git a/src/lgc.c b/src/lgc.c |
| 21 | index 973c269..7af23d5 100644 |
| 22 | --- a/src/lgc.c |
| 23 | +++ b/src/lgc.c |
| 24 | @@ -142,10 +142,17 @@ static int iscleared (global_State *g, const TValue *o) { |
| 25 | |
| 26 | |
| 27 | /* |
| 28 | -** barrier that moves collector forward, that is, mark the white object |
| 29 | -** being pointed by a black object. (If in sweep phase, clear the black |
| 30 | -** object to white [sweep it] to avoid other barrier calls for this |
| 31 | -** same object.) |
| 32 | +** Barrier that moves collector forward, that is, marks the white object |
| 33 | +** 'v' being pointed by the black object 'o'. In the generational |
| 34 | +** mode, 'v' must also become old, if 'o' is old; however, it cannot |
| 35 | +** be changed directly to OLD, because it may still point to non-old |
| 36 | +** objects. So, it is marked as OLD0. In the next cycle it will become |
| 37 | +** OLD1, and in the next it will finally become OLD (regular old). By |
| 38 | +** then, any object it points to will also be old. If called in the |
| 39 | +** incremental sweep phase, it clears the black object to white (sweep |
| 40 | +** it) to avoid other barrier calls for this same object. (That cannot |
| 41 | +** be done is generational mode, as its sweep does not distinguish |
| 42 | +** whites from deads.) |
| 43 | */ |
| 44 | void luaC_barrier_ (lua_State *L, GCObject *o, GCObject *v) { |
| 45 | global_State *g = G(L); |
| 46 | @@ -154,7 +161,8 @@ void luaC_barrier_ (lua_State *L, GCObject *o, GCObject *v) { |
| 47 | reallymarkobject(g, v); /* restore invariant */ |
| 48 | else { /* sweep phase */ |
| 49 | lua_assert(issweepphase(g)); |
| 50 | - makewhite(g, o); /* mark main obj. as white to avoid other barriers */ |
| 51 | + if (g->gckind == KGC_NORMAL) /* incremental mode? */ |
| 52 | + makewhite(g, o); /* mark 'o' as white to avoid other barriers */ |
| 53 | } |
| 54 | } |
| 55 | |
| 56 | @@ -299,10 +307,15 @@ static void markbeingfnz (global_State *g) { |
| 57 | |
| 58 | |
| 59 | /* |
| 60 | -** Mark all values stored in marked open upvalues from non-marked threads. |
| 61 | -** (Values from marked threads were already marked when traversing the |
| 62 | -** thread.) Remove from the list threads that no longer have upvalues and |
| 63 | -** not-marked threads. |
| 64 | +** For each non-marked thread, simulates a barrier between each open |
| 65 | +** upvalue and its value. (If the thread is collected, the value will be |
| 66 | +** assigned to the upvalue, but then it can be too late for the barrier |
| 67 | +** to act. The "barrier" does not need to check colors: A non-marked |
| 68 | +** thread must be young; upvalues cannot be older than their threads; so |
| 69 | +** any visited upvalue must be young too.) Also removes the thread from |
| 70 | +** the list, as it was already visited. Removes also threads with no |
| 71 | +** upvalues, as they have nothing to be checked. (If the thread gets an |
| 72 | +** upvalue later, it will be linked in the list again.) |
| 73 | */ |
| 74 | static void remarkupvals (global_State *g) { |
| 75 | lua_State *thread; |
| 76 | @@ -313,9 +326,11 @@ static void remarkupvals (global_State *g) { |
| 77 | p = &thread->twups; /* keep marked thread with upvalues in the list */ |
| 78 | else { /* thread is not marked or without upvalues */ |
| 79 | UpVal *uv; |
| 80 | + lua_assert(!isold(thread) || thread->openupval == NULL); |
| 81 | *p = thread->twups; /* remove thread from the list */ |
| 82 | thread->twups = thread; /* mark that it is out of list */ |
| 83 | for (uv = thread->openupval; uv != NULL; uv = uv->u.open.next) { |
| 84 | + lua_assert(getage(uv) <= getage(thread)); |
| 85 | if (uv->u.open.touched) { |
| 86 | markvalue(g, uv->v); /* remark upvalue's value */ |
| 87 | uv->u.open.touched = 0; |
| 88 | -- |
| 89 | 1.9.1 |
| 90 | |