Fix crash on LuaManager::clear triggered by vfs

elsid · elsid · commit 1bb3198b715b · 2025-03-01T15:54:24.000+01:00
See https://gitlab.com/OpenMW/openmw/-/issues/8370#note_2370896069. ================================================================= ==8699==ERROR: AddressSanitizer: heap-use-after-free on address 0x50800060d4b0 at pc 0x7254de50893e bp 0x7fffa97f9700 sp 0x7fffa97f96f0 READ of size 8 at 0x50800060d4b0 thread T0 #0 0x7254de50893d (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x6293d) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #1 0x7254de50ccad in lua_rawgeti (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x66cad) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #2 0x7254de5d4cab in luaL_unref (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x12ecab) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #3 0x5f96378dd1e9 in sol::stateless_reference::deref(lua_State*) const /home/elsid/dev/openmw/extern/sol3/sol/reference.hpp:440 #4 0x5f96378dd1e9 in sol::basic_reference<false>::deref() const /home/elsid/dev/openmw/extern/sol3/sol/reference.hpp:545 #5 0x5f96378dd1e9 in sol::basic_reference<false>::~basic_reference() /home/elsid/dev/openmw/extern/sol3/sol/reference.hpp:635 #6 0x5f96378dd1e9 in sol::basic_object_base<sol::basic_reference<false> >::~basic_object_base() /home/elsid/dev/openmw/extern/sol3/sol/object_base.hpp:33 #7 0x5f96378dd1e9 in sol::basic_object<sol::basic_reference<false> >::~basic_object() /home/elsid/dev/openmw/extern/sol3/sol/object.hpp:35 #8 0x5f96378dd1e9 in ~<lambda> /home/elsid/dev/openmw/apps/openmw/mwlua/vfsbindings.cpp:195 #9 0x5f96378dd1e9 in ~functor_function /home/elsid/dev/openmw/extern/sol3/sol/function_types_stateful.hpp:32 #10 0x5f96378dd1e9 in destroy_at<sol::function_detail::functor_function<MWLua::initVFSPackage(const Context&)::<lambda(sol::this_state, sol::object)>::<lambda()>, false, true> > /usr/include/c++/14.2.1/bits/stl_construct.h:88 #11 0x5f96378dd1e9 in destroy<sol::function_detail::functor_function<MWLua::initVFSPackage(const Context&)::<lambda(sol::this_state, sol::object)>::<lambda()>, false, true> > /usr/include/c++/14.2.1/bits/alloc_traits.h:599 #12 0x5f96378dd1e9 in user_alloc_destroy<sol::function_detail::functor_function<MWLua::initVFSPackage(const Context&)::<lambda(sol::this_state, sol::object)>::<lambda()>, false, true> > /home/elsid/dev/openmw/extern/sol3/sol/stack_core.hpp:460 #13 0x5f963a31e305 in int sol::detail::trampoline<int (*&)(lua_State*)>(lua_State*, int (*&)(lua_State*)) /home/elsid/dev/openmw/extern/sol3/sol/trampoline.hpp:158 #14 0x5f963a31e89c in sol::detail::c_trampoline(lua_State*, int (*)(lua_State*)) /home/elsid/dev/openmw/extern/sol3/sol/trampoline.hpp:183 #15 0x7254de4dc13a (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x3613a) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #16 0x7254de4deac4 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x38ac4) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #17 0x7254de4df1a2 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x391a2) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #18 0x7254de4e1cf2 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x3bcf2) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #19 0x7254de4e2a37 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x3ca37) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #20 0x7254de50f4a4 in lua_gc (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x694a4) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #21 0x5f96371f615c in MWLua::LuaManager::clear() /home/elsid/dev/openmw/apps/openmw/mwlua/luamanagerimp.cpp:348 #22 0x5f96371f91ea in MWLua::LuaManager::noGame() /home/elsid/dev/openmw/apps/openmw/mwlua/luamanagerimp.cpp:397 #23 0x5f963a1c7170 in MWState::StateManager::cleanup(bool) /home/elsid/dev/openmw/apps/openmw/mwstate/statemanagerimp.cpp:71 #24 0x5f963a1cabfe in MWState::StateManager::newGame(bool) /home/elsid/dev/openmw/apps/openmw/mwstate/statemanagerimp.cpp:169 #25 0x5f963a1c7aa4 in MWState::StateManager::update(float) /home/elsid/dev/openmw/apps/openmw/mwstate/statemanagerimp.cpp:761 #26 0x5f963a230bab in OMW::Engine::frame(unsigned int, float) /home/elsid/dev/openmw/apps/openmw/engine.cpp:238 #27 0x5f963a2442f3 in OMW::Engine::go() /home/elsid/dev/openmw/apps/openmw/engine.cpp:1032 #28 0x5f963633b3a7 in runApplication(int, char**) /home/elsid/dev/openmw/apps/openmw/main.cpp:228 #29 0x5f963b375b45 in Debug::wrapApplication(int (*)(int, char**), int, char**, std::basic_string_view<char, std::char_traits<char> >) /home/elsid/dev/openmw/components/debug/debugging.cpp:457 #30 0x5f9636331695 in main /home/elsid/dev/openmw/apps/openmw/main.cpp:240 #31 0x7254db435487 (/usr/lib/libc.so.6+0x27487) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0) #32 0x7254db43554b in __libc_start_main (/usr/lib/libc.so.6+0x2754b) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0) #33 0x5f9636331464 in _start (/home/elsid/dev/openmw/build/gcc/asan/openmw+0x10db464) (BuildId: ac74a52ca60e8913bef6eb6b3b23d6de648cf3c9) 0x50800060d4b0 is located 16 bytes inside of 96-byte region [0x50800060d4a0,0x50800060d500) freed by thread T0 here: #0 0x7254e2afc102 in free /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:52 #1 0x5f963a2f84e7 in LuaUtil::LuaState::trackingAllocator(void*, void*, unsigned long, unsigned long) /home/elsid/dev/openmw/components/lua/luastate.cpp:107 #2 0x7254de4f7779 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x51779) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #3 0x7254de4de7f3 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x387f3) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #4 0x7254de4e1a9a (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x3ba9a) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #5 0x7254de4e2a37 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x3ca37) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #6 0x7254de50f4a4 in lua_gc (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x694a4) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #7 0x5f96371f615c in MWLua::LuaManager::clear() /home/elsid/dev/openmw/apps/openmw/mwlua/luamanagerimp.cpp:348 #8 0x5f96371f91ea in MWLua::LuaManager::noGame() /home/elsid/dev/openmw/apps/openmw/mwlua/luamanagerimp.cpp:397 #9 0x5f963a1c7170 in MWState::StateManager::cleanup(bool) /home/elsid/dev/openmw/apps/openmw/mwstate/statemanagerimp.cpp:71 #10 0x5f963a1cabfe in MWState::StateManager::newGame(bool) /home/elsid/dev/openmw/apps/openmw/mwstate/statemanagerimp.cpp:169 #11 0x5f963a1c7aa4 in MWState::StateManager::update(float) /home/elsid/dev/openmw/apps/openmw/mwstate/statemanagerimp.cpp:761 #12 0x5f963a230bab in OMW::Engine::frame(unsigned int, float) /home/elsid/dev/openmw/apps/openmw/engine.cpp:238 #13 0x5f963a2442f3 in OMW::Engine::go() /home/elsid/dev/openmw/apps/openmw/engine.cpp:1032 #14 0x5f963633b3a7 in runApplication(int, char**) /home/elsid/dev/openmw/apps/openmw/main.cpp:228 #15 0x5f963b375b45 in Debug::wrapApplication(int (*)(int, char**), int, char**, std::basic_string_view<char, std::char_traits<char> >) /home/elsid/dev/openmw/components/debug/debugging.cpp:457 #16 0x5f9636331695 in main /home/elsid/dev/openmw/apps/openmw/main.cpp:240 #17 0x7254db435487 (/usr/lib/libc.so.6+0x27487) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0) #18 0x7254db43554b in __libc_start_main (/usr/lib/libc.so.6+0x2754b) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0) #19 0x5f9636331464 in _start (/home/elsid/dev/openmw/build/gcc/asan/openmw+0x10db464) (BuildId: ac74a52ca60e8913bef6eb6b3b23d6de648cf3c9) previously allocated by thread T20 here: #0 0x7254e2afc3c2 in realloc /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_malloc_linux.cpp:85 #1 0x5f963a2f7080 in LuaUtil::LuaState::trackingAllocator(void*, void*, unsigned long, unsigned long) /home/elsid/dev/openmw/components/lua/luastate.cpp:110 #2 0x7254de4e2fc8 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x3cfc8) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #3 0x7254de4f7476 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x51476) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #4 0x7254de50c456 in lua_newthread (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x66456) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #5 0x7254de5d53e5 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x12f3e5) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) #6 0x7254de4dc0c5 (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x360c5) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) Thread T20 created by T0 here: #0 0x7254e2af44cb in pthread_create /usr/src/debug/gcc/gcc/libsanitizer/asan/asan_interceptors.cpp:245 #1 0x7254db6e2071 in __gthread_create /usr/src/debug/gcc/gcc-build/x86_64-pc-linux-gnu/libstdc++-v3/include/x86_64-pc-linux-gnu/bits/gthr-default.h:676 #2 0x7254db6e2071 in std::thread::_M_start_thread(std::unique_ptr<std::thread::_State, std::default_delete<std::thread::_State> >, void (*)()) /usr/src/debug/gcc/gcc/libstdc++-v3/src/c++11/thread.cc:172 #3 0x5f96380fa2eb in thread<MWLua::Worker::Worker(MWLua::LuaManager&)::<lambda()> > /usr/include/c++/14.2.1/bits/std_thread.h:173 #4 0x5f96380fa2eb in MWLua::Worker::Worker(MWLua::LuaManager&) /home/elsid/dev/openmw/apps/openmw/mwlua/worker.cpp:18 #5 0x5f963a23faf4 in std::__detail::_MakeUniq<MWLua::Worker>::__single_object std::make_unique<MWLua::Worker, MWLua::LuaManager&>(MWLua::LuaManager&) /usr/include/c++/14.2.1/bits/unique_ptr.h:1077 #6 0x5f963a23faf4 in OMW::Engine::prepareEngine() /home/elsid/dev/openmw/apps/openmw/engine.cpp:920 #7 0x5f963a2413ae in OMW::Engine::go() /home/elsid/dev/openmw/apps/openmw/engine.cpp:952 #8 0x5f963633b3a7 in runApplication(int, char**) /home/elsid/dev/openmw/apps/openmw/main.cpp:228 #9 0x5f963b375b45 in Debug::wrapApplication(int (*)(int, char**), int, char**, std::basic_string_view<char, std::char_traits<char> >) /home/elsid/dev/openmw/components/debug/debugging.cpp:457 #10 0x5f9636331695 in main /home/elsid/dev/openmw/apps/openmw/main.cpp:240 #11 0x7254db435487 (/usr/lib/libc.so.6+0x27487) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0) #12 0x7254db43554b in __libc_start_main (/usr/lib/libc.so.6+0x2754b) (BuildId: 0b707b217b15b106c25fe51df3724b25848310c0) #13 0x5f9636331464 in _start (/home/elsid/dev/openmw/build/gcc/asan/openmw+0x10db464) (BuildId: ac74a52ca60e8913bef6eb6b3b23d6de648cf3c9) SUMMARY: AddressSanitizer: heap-use-after-free (/home/elsid/dev/LuaJIT/build/gcc/asan/install/lib/libluajit-5.1.so.2+0x6293d) (BuildId: 1249151684379d19b11900f406fea9704a6375cb) Shadow bytes around the buggy address: 0x50800060d200: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa 0x50800060d280: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa 0x50800060d300: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa 0x50800060d380: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa 0x50800060d400: fa fa fa fa 00 00 00 00 00 00 00 00 00 00 00 fa =>0x50800060d480: fa fa fa fa fd fd[fd]fd fd fd fd fd fd fd fd fd 0x50800060d500: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50800060d580: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50800060d600: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50800060d680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa 0x50800060d700: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa Shadow byte legend (one shadow byte represents 8 application bytes): Addressable: 00 Partially addressable: 01 02 03 04 05 06 07 Heap left redzone: fa Freed heap region: fd Stack left redzone: f1 Stack mid redzone: f2 Stack right redzone: f3 Stack after return: f5 Stack use after scope: f8 Global redzone: f9 Global init order: f6 Poisoned by user: f7 Container overflow: fc Array cookie: ac Intra object redzone: bb ASan internal: fe Left alloca redzone: ca Right alloca redzone: cb ==8699==ABORTING
diff --git a/apps/openmw/mwlua/vfsbindings.cpp b/apps/openmw/mwlua/vfsbindings.cpp
@@ -68,7 +68,7 @@ namespace MWLua
             Log(Debug::Verbose) << "Read a large data chunk (" << size << " bytes) from '" << file.mFileName << "'.";
         }
 
-        sol::object readFile(sol::this_state lua, FileHandle& file)
+        sol::object readFile(lua_State* lua, FileHandle& file)
         {
             std::ostringstream os;
             if (file.mFilePtr && file.mFilePtr->peek() != EOF)
@@ -79,7 +79,7 @@ namespace MWLua
             return sol::make_object<std::string>(lua, std::move(result));
         }
 
-        sol::object readLineFromFile(sol::this_state lua, FileHandle& file)
+        sol::object readLineFromFile(lua_State* lua, FileHandle& file)
         {
             std::string result;
             if (file.mFilePtr && std::getline(*file.mFilePtr, result))
@@ -91,7 +91,7 @@ namespace MWLua
             return sol::nil;
         }
 
-        sol::object readNumberFromFile(sol::this_state lua, Files::IStreamPtr& file)
+        sol::object readNumberFromFile(lua_State* lua, Files::IStreamPtr& file)
         {
             double number = 0;
             if (file && *file >> number)
@@ -100,7 +100,7 @@ namespace MWLua
             return sol::nil;
         }
 
-        sol::object readCharactersFromFile(sol::this_state lua, FileHandle& file, size_t count)
+        sol::object readCharactersFromFile(lua_State* lua, FileHandle& file, size_t count)
         {
             if (count <= 0 && file.mFilePtr->peek() != EOF)
                 return sol::make_object<std::string>(lua, std::string());
@@ -189,7 +189,7 @@ namespace MWLua
 
                 return seek(lua, self, std::ios_base::cur, off);
             });
-        handle["lines"] = [](sol::this_state lua, sol::object self) {
+        handle["lines"] = [](sol::this_main_state lua, sol::main_object self) {
             if (!self.is<FileHandle*>())
                 throw std::runtime_error("self should be a file handle");
             return sol::as_function([lua, self]() -> sol::object {
@@ -199,7 +199,7 @@ namespace MWLua
             });
         };
 
-        api["lines"] = [vfs](sol::this_state lua, std::string_view fileName) {
+        api["lines"] = [vfs](sol::this_main_state lua, std::string_view fileName) {
             auto normalizedName = VFS::Path::normalizeFilename(fileName);
             return sol::as_function(
                 [lua, file = FileHandle(vfs->getNormalized(normalizedName), normalizedName)]() mutable {

Original file line number	Diff line number	Diff line change
`@@ -68,7 +68,7 @@ namespace MWLua`
`68`	`68`	`Log(Debug::Verbose) << "Read a large data chunk (" << size << " bytes) from '" << file.mFileName << "'.";`
`69`	`69`	`}`
`70`	`70`
`71`		`- sol::object readFile(sol::this_state lua, FileHandle& file)`
	`71`	`+ sol::object readFile(lua_State* lua, FileHandle& file)`
`72`	`72`	`{`
`73`	`73`	`std::ostringstream os;`
`74`	`74`	`if (file.mFilePtr && file.mFilePtr->peek() != EOF)`
`@@ -79,7 +79,7 @@ namespace MWLua`
`79`	`79`	`return sol::make_object<std::string>(lua, std::move(result));`
`80`	`80`	`}`
`81`	`81`
`82`		`- sol::object readLineFromFile(sol::this_state lua, FileHandle& file)`
	`82`	`+ sol::object readLineFromFile(lua_State* lua, FileHandle& file)`
`83`	`83`	`{`
`84`	`84`	`std::string result;`
`85`	`85`	`if (file.mFilePtr && std::getline(*file.mFilePtr, result))`
`@@ -91,7 +91,7 @@ namespace MWLua`
`91`	`91`	`return sol::nil;`
`92`	`92`	`}`
`93`	`93`
`94`		`- sol::object readNumberFromFile(sol::this_state lua, Files::IStreamPtr& file)`
	`94`	`+ sol::object readNumberFromFile(lua_State* lua, Files::IStreamPtr& file)`
`95`	`95`	`{`
`96`	`96`	`double number = 0;`
`97`	`97`	`if (file && *file >> number)`
`@@ -100,7 +100,7 @@ namespace MWLua`
`100`	`100`	`return sol::nil;`
`101`	`101`	`}`
`102`	`102`
`103`		`- sol::object readCharactersFromFile(sol::this_state lua, FileHandle& file, size_t count)`
	`103`	`+ sol::object readCharactersFromFile(lua_State* lua, FileHandle& file, size_t count)`
`104`	`104`	`{`
`105`	`105`	`if (count <= 0 && file.mFilePtr->peek() != EOF)`
`106`	`106`	`return sol::make_object<std::string>(lua, std::string());`
`@@ -189,7 +189,7 @@ namespace MWLua`
`189`	`189`
`190`	`190`	`return seek(lua, self, std::ios_base::cur, off);`
`191`	`191`	`});`
`192`		`- handle["lines"] = [](sol::this_state lua, sol::object self) {`
	`192`	`+ handle["lines"] = [](sol::this_main_state lua, sol::main_object self) {`
`193`	`193`	`if (!self.is<FileHandle*>())`
`194`	`194`	`throw std::runtime_error("self should be a file handle");`
`195`	`195`	`return sol::as_function([lua, self]() -> sol::object {`
`@@ -199,7 +199,7 @@ namespace MWLua`
`199`	`199`	`});`
`200`	`200`	`};`
`201`	`201`
`202`		`- api["lines"] = [vfs](sol::this_state lua, std::string_view fileName) {`
	`202`	`+ api["lines"] = [vfs](sol::this_main_state lua, std::string_view fileName) {`
`203`	`203`	`auto normalizedName = VFS::Path::normalizeFilename(fileName);`
`204`	`204`	`return sol::as_function(`
`205`	`205`	`[lua, file = FileHandle(vfs->getNormalized(normalizedName), normalizedName)]() mutable {`