Fix mprotect failures by enabling cranelift-jit selinux-fix#5204
Fix mprotect failures by enabling cranelift-jit selinux-fix#5204abrown merged 1 commit intobytecodealliance:mainfrom
Conversation
github-actions
bot
added
the
cranelift
|
See #4986 |
The sample program in cranelift/filetests/src/function_runner.rs would abort with an mprotect failure under certain circumstances, see bytecodealliance#4453 (comment) Root cause was that enabling PROT_EXEC on the main process heap may be prohibited, depending on Linux distro and version. This only shows up in the doc test sample program because the main clif-util is multi-threaded and therefore allocations will happen on glibc's per-thread heap, which is allocated via mmap, and not the main process heap. Work around the problem by enabling the "selinux-fix" feature of the cranelift-jit crate dependency in the filetests. Note that this didn't compile out of the box, so a separate fix is also required and provided as part of this PR. Going forward, it would be preferable to always use mmap to allocate the backing memory for JITted code.
uweigand
force-pushed
the
mprotect-fix
branch
from
3121ccc to
fec18b5
Compare
|
Updated cfg checks to prevent breaking windows builds with selinux-fix. |
jameysharp
left a comment
jameysharp
left a comment
There was a problem hiding this comment.
This PR is equivalent to fixing #4986 by turning the selinux-fix feature on for everybody. I think this is a good idea, but if we're going to do that, I think we should do two things:
- Benchmark the runtime performance impact of this change on Linux.
- Remove all the
cfgattributes forselinux-fixand just use that path unconditionally (except on Windows, I guess).
The intent of the PR is to turn on I agree that we should move to |
jameysharp
left a comment
jameysharp
left a comment
There was a problem hiding this comment.
Oh, yeah, I mis-read this. Okay, looks good to me!
abrown
left a comment
abrown
left a comment
There was a problem hiding this comment.
I have also been bitten by this error in the past... thanks for fixing it!
4 participants
The sample program in cranelift/filetests/src/function_runner.rs would abort with an mprotect failure under certain circumstances, see #4453 (comment)
Root cause was that enabling PROT_EXEC on the main process heap may be prohibited, depending on Linux distro and version.
This only shows up in the doc test sample program because the main clif-util is multi-threaded and therefore allocations will happen on glibc's per-thread heap, which is allocated via mmap, and not the main process heap.
Work around the problem by enabling the "selinux-fix" feature of the cranelift-jit crate dependency in the filetests. Note that this didn't compile out of the box, so a separate fix is also required and provided as part of this PR.
Going forward, it would be preferable to always use mmap to allocate the backing memory for JITted code.
CC @cfallin @afonso360