Skip to content

Commit

Permalink
Add some missing RB_GC_GUARDs to openssl r/w functions
Browse files Browse the repository at this point in the history
The string passed to openssl seems to be poisoned, and adding a guard
somewhere where the compiler can't optimize it away fixes it.

I'm honestly not 100% sure why this is nescessary in the write case;
the str str is clearly still used. But, shrug.
[3/76] OpenSSL::TestSSL#test_parallel=================================================================
==552674==ERROR: AddressSanitizer: use-after-poison on address 0x7fbba354def0 at pc 0x7fbba3694bb1 bp 0x7fbba29fe830 sp 0x7fbba29fe828
READ of size 8 at 0x7fbba354def0 thread T13
    #0 0x7fbba3694bb0 in RB_BUILTIN_TYPE /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/value_type.h:190:30
    #1 0x7fbba3694bb0 in rbimpl_RB_TYPE_P_fastpath /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/value_type.h:351:19
    ruby#2 0x7fbba3694bb0 in Check_Type /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/value_type.h:434:9
    ruby#3 0x7fbba3694bb0 in rbimpl_rstring_getmem /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/core/rstring.h:391:5
    ruby#4 0x7fbba3694bb0 in RSTRING_PTR /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/core/rstring.h:418:17
    ruby#5 0x7fbba3694bb0 in ossl_ssl_read_internal /home/kj/ruby/build/ext/openssl/../../../ext/openssl/ossl_ssl.c:1969:35
    ruby#6 0x55ea9dfe76d2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#7 0x55ea9df84b54 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#8 0x55ea9df8e5ea in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    ruby#9 0x55ea9df85b72 in rb_vm_exec /home/kj/ruby/build/../vm.c:2551:22
    ruby#10 0x55ea9dffa326 in vm_call0_body /home/kj/ruby/build/../vm_eval.c:229:20
    ruby#11 0x55ea9dfad48e in vm_call0_cc /home/kj/ruby/build/../vm_eval.c:110:12
    ruby#12 0x55ea9dfadae0 in rb_vm_call0 /home/kj/ruby/build/../vm_eval.c:70:12
    ruby#13 0x55ea9dfadae0 in rb_vm_call_kw /home/kj/ruby/build/../vm_eval.c:330:12
    ruby#14 0x55ea9dd8a22c in call_method_data /home/kj/ruby/build/../proc.c:2469:12
    ruby#15 0x55ea9dd8a22c in rb_method_call_with_block_kw /home/kj/ruby/build/../proc.c:2483:12
    ruby#16 0x55ea9dfe76d2 in vm_call_cfunc_with_frame_ /home/kj/ruby/build/../vm_insnhelper.c:3492:11
    ruby#17 0x55ea9df84b54 in vm_sendish /home/kj/ruby/build/../vm_callinfo.h
    ruby#18 0x55ea9df8e5ea in vm_exec_core /home/kj/ruby/build/../insns.def:867:11
    ruby#19 0x55ea9df85b72 in rb_vm_exec /home/kj/ruby/build/../vm.c:2551:22
    #20 0x55ea9dfbfb3f in invoke_block /home/kj/ruby/build/../vm.c:1515:12
    ruby#21 0x55ea9dfbfb3f in invoke_iseq_block_from_c /home/kj/ruby/build/../vm.c:1585:16
    ruby#22 0x55ea9dfbfb3f in invoke_block_from_c_proc /home/kj/ruby/build/../vm.c:1683:16
    ruby#23 0x55ea9dfbfb3f in vm_invoke_proc /home/kj/ruby/build/../vm.c:1713:12
    ruby#24 0x55ea9dfbf4fd in rb_vm_invoke_proc /home/kj/ruby/build/../vm.c:1734:16
    ruby#25 0x55ea9df21e5b in thread_do_start_proc /home/kj/ruby/build/../thread.c:595:16
    ruby#26 0x55ea9df20163 in thread_do_start /home/kj/ruby/build/../thread.c:614:18
    ruby#27 0x55ea9df20163 in thread_start_func_2 /home/kj/ruby/build/../thread.c:668:9
    ruby#28 0x55ea9df1f62a in call_thread_start_func_2 /home/kj/ruby/build/../thread_pthread.c:2234:5
    ruby#29 0x55ea9df1f62a in nt_start /home/kj/ruby/build/../thread_pthread.c:2279:13
    ruby#30 0x55ea9daa32a4 in asan_thread_start(void*) /home/kj/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:239:43
    ruby#31 0x7fbbbac8d896 in start_thread /usr/src/debug/glibc-2.38-16.fc39.x86_64/nptl/pthread_create.c:444:8
    ruby#32 0x7fbbbad1480b in __GI___clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:78

Address 0x7fbba354def0 is a wild pointer inside of access range of size 0x000000000008.
SUMMARY: AddressSanitizer: use-after-poison /home/kj/ruby/build/ext/openssl/../../../include/ruby/internal/value_type.h:190:30 in RB_BUILTIN_TYPE
Shadow bytes around the buggy address:
  0x7fbba354dc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354dc80: 00 00 00 00 00 00 00 00 00 00 00 00 f7 00 00 00
  0x7fbba354dd00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354dd80: 00 00 00 00 f7 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354de00: 00 00 00 00 00 00 f7 00 00 00 00 00 f7 00 00 00
=>0x7fbba354de80: 00 00 00 00 00 00 00 00 f7 00 00 00 00 00[f7]00
  0x7fbba354df00: 00 00 00 00 00 00 00 00 00 00 f7 00 00 00 00 00
  0x7fbba354df80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354e000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354e080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x7fbba354e100: 00 00 00 00 00 00 f7 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
Thread T13 created by T11 here:
    #0 0x55ea9db5d8fd in pthread_create /home/kj/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
    #1 0x55ea9df037b8 in native_thread_create0 /home/kj/ruby/build/../thread_pthread.c:2151:11
    ruby#2 0x55ea9df037b8 in native_thread_create_dedicated /home/kj/ruby/build/../thread_pthread.c:2218:12
    ruby#3 0x55ea9df037b8 in native_thread_create /home/kj/ruby/build/../thread_pthread.c:2392:16
    ruby#4 0x55ea9df037b8 in thread_create_core /home/kj/ruby/build/../thread.c:847:11
    ruby#5 0x55ea9df15a39 in thread_initialize /home/kj/ruby/build/../thread.c:955:16
    ruby#6 0x55ea9dfad48e in vm_call0_cc /home/kj/ruby/build/../vm_eval.c:110:12
    ruby#7 0x55ea9dffd34e in rb_call0 /home/kj/ruby/build/../vm_eval.c:573:12
    ruby#8 0x55ea9dfb0362 in rb_call /home/kj/ruby/build/../vm_eval.c:899:12
    ruby#9 0x55ea9dfb0362 in rb_funcallv_kw /home/kj/ruby/build/../vm_eval.c:1092:12

Thread T11 created by T0 here:
    #0 0x55ea9db5d8fd in pthread_create /home/kj/llvm-project/compiler-rt/lib/asan/asan_interceptors.cpp:250:3
    #1 0x55ea9df037b8 in native_thread_create0 /home/kj/ruby/build/../thread_pthread.c:2151:11
    ruby#2 0x55ea9df037b8 in native_thread_create_dedicated /home/kj/ruby/build/../thread_pthread.c:2218:12
    ruby#3 0x55ea9df037b8 in native_thread_create /home/kj/ruby/build/../thread_pthread.c:2392:16
    ruby#4 0x55ea9df037b8 in thread_create_core /home/kj/ruby/build/../thread.c:847:11
    ruby#5 0x55ea9df15a39 in thread_initialize /home/kj/ruby/build/../thread.c:955:16
    ruby#6 0x55ea9dfad48e in vm_call0_cc /home/kj/ruby/build/../vm_eval.c:110:12
    ruby#7 0x55ea9dffd34e in rb_call0 /home/kj/ruby/build/../vm_eval.c:573:12
    ruby#8 0x55ea9dfb0362 in rb_call /home/kj/ruby/build/../vm_eval.c:899:12
    ruby#9 0x55ea9dfb0362 in rb_funcallv_kw /home/kj/ruby/build/../vm_eval.c:1092:12

==552674==ABORTING
  • Loading branch information
KJTsanaktsidis committed Feb 17, 2024
1 parent 2d0792a commit c01aa5b
Showing 1 changed file with 2 additions and 0 deletions.
2 changes: 2 additions & 0 deletions ext/openssl/ossl_ssl.c
Expand Up @@ -1971,6 +1971,7 @@ ossl_ssl_read_internal(int argc, VALUE *argv, VALUE self, int nonblock)
case SSL_ERROR_NONE:
rb_str_unlocktmp(str);
rb_str_set_len(str, nread);
RB_GC_GUARD(str);
return str;
case SSL_ERROR_ZERO_RETURN:
rb_str_unlocktmp(str);
Expand Down Expand Up @@ -2075,6 +2076,7 @@ ossl_ssl_write_internal(VALUE self, VALUE str, VALUE opts)
int nwritten = SSL_write(ssl, RSTRING_PTR(tmp), num);
switch (ssl_get_error(ssl, nwritten)) {
case SSL_ERROR_NONE:
RB_GC_GUARD(tmp);
return INT2NUM(nwritten);
case SSL_ERROR_WANT_WRITE:
if (no_exception_p(opts)) { return sym_wait_writable; }
Expand Down

0 comments on commit c01aa5b

Please sign in to comment.