Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Runtime JIT support detection #157

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Runtime JIT support detection #157

wants to merge 3 commits into from

Commits on Dec 16, 2022

  1. sljit/protexec: fix out-of-bounds stack write 

    In create_tempfile() we look for a suitable place to put the temporary
file into and, among others, look at $TMPDIR. If the value of this
environment variable exceeds the bounds of the local tmp_name[] buffer,
we ignore it. However, we still change the value of 'tmp_name_len' which
leads to follow-up errors.

On debug builds this can lead to hitting the assertion as can be seen
below:

$ TMPDIR=$(perl -e 'print "A"x1024') ./bin/array_access
Assertion failed at sljit_src/sljitProtExecAllocator.c:147
Aborted

For non-debug builds, however, this can lead to a memory corruption, by
abusing the fact that we change a trailing '/' to '\0' later on. With a
sufficiently high enough value for 'tmp_name_len' this can corrupt stack
frames up in the call chain.

Fix this by setting 'tmp_name_len' only if value it is based on is found
to be valid -- just like it was prior to commit 98323bd82218.

Fixes: 98323bd82218 ("protexec: refactor create_tempfile() (PCRE2Project#37)")
Signed-off-by: Mathias Krause <[email protected]>
    @minipli-oss
    minipli-oss committed Dec 16, 2022
    Configuration menu
    Copy the full SHA
    f852788 View commit details
    Browse the repository at this point in the history

  2. sljit/exec: provide function to test runtime availability of rwx maps 

    SELinux or PaX/grsecurity based kernels may deny creating writable and
executable mappings, leading to errors when trying to allocate JIT
memory, even though JIT support is generally available.

Provide a function to probe for the runtime availability of rwx maps to
support users like libpcre2 which can use it to announce the lack of JIT
and fall back to the interpreter instead.

This function is only needed for Linux and only if we're using the
default JIT memory allocator, as all others implement workarounds via
double mappings.

Signed-off-by: Mathias Krause <[email protected]>
    @minipli-oss
    minipli-oss committed Dec 16, 2022
    Configuration menu
    Copy the full SHA
    5e93d28 View commit details
    Browse the repository at this point in the history

  3. Probe JIT availability at runtime 

    SELinux or PaX/grsecurity based kernels may deny creating writable and
executable mappings, leading to errors when trying to allocate JIT
memory, even though JIT support is generally available. Instead of
failing hard in this case, allow to use the interpreter fallback by
probing and announcing the availability of JIT mode at runtime through
the PCRE2_CONFIG_JIT hook.

This only happens for configurations using only the default JIT memory
allocator, i.e. not the SELinux aware one. However, we still mark the
latter as experimental and distributions like Debian don't enable it.

The current behaviour leads to nasty user visible errors on such
systems, e.g. when running 'git grep':

  $ git grep peach
  fatal: Couldn't JIT the PCRE2 pattern 'peach', got '-48'

With this change in place, it'll fall back to the interpreter and "just
work", providing a much more pleasant user experience.

Signed-off-by: Mathias Krause <[email protected]>
    @minipli-oss
    minipli-oss committed Dec 16, 2022
    Configuration menu
    Copy the full SHA
    c2dfa1e View commit details
    Browse the repository at this point in the history