Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Somehow protect against hugely-recursive module types #214

Closed
alexcrichton opened this issue Jan 28, 2021 · 0 comments · Fixed by #215
Closed

Somehow protect against hugely-recursive module types #214

alexcrichton opened this issue Jan 28, 2021 · 0 comments · Fixed by #215

Comments

@alexcrichton
Copy link
Member

Currently it's relatively easy to get the validator (and wasm-smith which actually generates modules like this) to go down a rabbit hole in terms of performance. To do this you can create a hugely-nested module type with expands to lots of recursive checks of subtypes:

(module
  (type $m0 (module))
  (type $m1 (module
    (import "1" (module (type $m0)))
    (import "2" (module (type $m0)))
    (import "3" (module (type $m0)))
    (import "4" (module (type $m0)))
    (import "5" (module (type $m0)))
    (import "6" (module (type $m0)))
    (import "7" (module (type $m0)))
    (import "8" (module (type $m0)))
    (import "9" (module (type $m0)))
    (import "10" (module (type $m0)))
  ))
  (type $m2 (module
    (import "1" (module (type $m1)))
    (import "2" (module (type $m1)))
    (import "3" (module (type $m1)))
    (import "4" (module (type $m1)))
    (import "5" (module (type $m1)))
    (import "6" (module (type $m1)))
    (import "7" (module (type $m1)))
    (import "8" (module (type $m1)))
    (import "9" (module (type $m1)))
    (import "10" (module (type $m1)))
  ))
  (type $m3 (module
    (import "1" (module (type $m2)))
    (import "2" (module (type $m2)))
    (import "3" (module (type $m2)))
    (import "4" (module (type $m2)))
    (import "5" (module (type $m2)))
    (import "6" (module (type $m2)))
    (import "7" (module (type $m2)))
    (import "8" (module (type $m2)))
    (import "9" (module (type $m2)))
    (import "10" (module (type $m2)))
  ))
  (type $m4 (module
    (import "1" (module (type $m3)))
    (import "2" (module (type $m3)))
    (import "3" (module (type $m3)))
    (import "4" (module (type $m3)))
    (import "5" (module (type $m3)))
    (import "6" (module (type $m3)))
    (import "7" (module (type $m3)))
    (import "8" (module (type $m3)))
    (import "9" (module (type $m3)))
    (import "10" (module (type $m3)))
  ))
  (type $m5 (module
    (import "1" (module (type $m4)))
    (import "2" (module (type $m4)))
    (import "3" (module (type $m4)))
    (import "4" (module (type $m4)))
    (import "5" (module (type $m4)))
    (import "6" (module (type $m4)))
    (import "7" (module (type $m4)))
    (import "8" (module (type $m4)))
    (import "9" (module (type $m4)))
    (import "10" (module (type $m4)))
  ))
  (type $m6 (module
    (import "1" (module (type $m5)))
    (import "2" (module (type $m5)))
    (import "3" (module (type $m5)))
    (import "4" (module (type $m5)))
    (import "5" (module (type $m5)))
    (import "6" (module (type $m5)))
    (import "7" (module (type $m5)))
    (import "8" (module (type $m5)))
    (import "9" (module (type $m5)))
    (import "10" (module (type $m5)))
  ))
  (type $m7 (module
    (import "1" (module (type $m6)))
    (import "2" (module (type $m6)))
    (import "3" (module (type $m6)))
    (import "4" (module (type $m6)))
    (import "5" (module (type $m6)))
    (import "6" (module (type $m6)))
    (import "7" (module (type $m6)))
    (import "8" (module (type $m6)))
    (import "9" (module (type $m6)))
    (import "10" (module (type $m6)))
  ))
  (type $m8 (module
    (import "1" (module (type $m7)))
    (import "2" (module (type $m7)))
    (import "3" (module (type $m7)))
    (import "4" (module (type $m7)))
    (import "5" (module (type $m7)))
    (import "6" (module (type $m7)))
    (import "7" (module (type $m7)))
    (import "8" (module (type $m7)))
    (import "9" (module (type $m7)))
    (import "10" (module (type $m7)))
  ))
  (type $m9 (module
    (import "1" (module (type $m8)))
    (import "2" (module (type $m8)))
    (import "3" (module (type $m8)))
    (import "4" (module (type $m8)))
    (import "5" (module (type $m8)))
    (import "6" (module (type $m8)))
    (import "7" (module (type $m8)))
    (import "8" (module (type $m8)))
    (import "9" (module (type $m8)))
    (import "10" (module (type $m8)))
  ))

  (type $m (module
    (import "" (module (type $m9)))
  ))
  (import "a" (module $a (type $m9)))
  (import "b" (module $b (type $m)))
  (instance (instantiate $b "" (module $a)))
)

Today that module takes quite a long time in validation (30s!).

I'm not entirely sure how to prevent this just yet, but we shouldn't in any case have modules take 30s in validation when they're so small. Whatever fix is applied here needs to be extended to wasm-smith since sometimes generating modules takes 30+ seconds since it's doing subtyping checks internally.

alexcrichton added a commit to alexcrichton/wasm-tools that referenced this issue Jan 28, 2021
This commit implements a fix for bytecodealliance#214 where the effective size of the
type of any item in a module (or a module itself) is now required to be
bounded. The goal here is to accept reasonable modules but at the same
time protecting implementations like wasmtime from having to worry about
deeply recursive and nested module types. The general fix here is to
account for the size of all types as we parse them, and at all times the
size is bounded.

Additionally wasm-smith is updated with similar accounting for the size
of types and such to prevent generating modules with massively recursive
types.

Closes bytecodealliance#214
alexcrichton added a commit that referenced this issue Jan 29, 2021
* Validate the effective type size of modules

This commit implements a fix for #214 where the effective size of the
type of any item in a module (or a module itself) is now required to be
bounded. The goal here is to accept reasonable modules but at the same
time protecting implementations like wasmtime from having to worry about
deeply recursive and nested module types. The general fix here is to
account for the size of all types as we parse them, and at all times the
size is bounded.

Additionally wasm-smith is updated with similar accounting for the size
of types and such to prevent generating modules with massively recursive
types.

Closes #214

* Clarify doc comments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant