[ruby-core:118325] [Ruby master Bug#20493] Segfault on rb_io_getline_fast

Issue #20493 has been updated by nagachika (Tomoyuki Chikanaga).

Backport changed from 3.1: UNKNOWN, 3.2: REQUIRED, 3.3: DONE to 3.1: UNKNOWN, 3.2: DONE, 3.3: DONE

ruby_3_2 commit:2f010f31f1887ad0f429709a2906fc5a4dae8e87.

----------------------------------------
Bug #20493: Segfault on rb_io_getline_fast
https://bugs.ruby-lang.org/issues/20493#change-108832

* Author: josegomezr (Jose Gomez)
* Status: Closed
* Assignee: kjtsanaktsidis (KJ Tsanaktsidis)
* ruby -v: 3.3.1
* Backport: 3.1: UNKNOWN, 3.2: DONE, 3.3: DONE
----------------------------------------
We've spotted a consistent segfault when running bundle install with `--jobs 4`

When running: `bundle install -j 4` we'd get a Segfault at:

```
/usr/lib64/ruby/3.3.0/rubygems/ext/builder.rb:93: [BUG] Segmentation fault at 0x0000000000000014
ruby 3.3.1 (2024-04-23 revision c56cd86388) [x86_64-linux-gnu]
```

Full [log is available here][0].

I could not find a shorter reproducer besides using bundler with `--jobs 4` or
`--jobs 8`.

Here's a sample command to trigger the behavior (it creates the Gemfile and
calls bundler) [1].

We installed all debug symbols and narrowed down the location of the segfault to
`rb_io_getline_fast` in io.c

At [line 4001][3] `str` is `T_NONE`, which makes further usage down the line in
[`io_enc_str`][4] raise a null pointer dereference.

With the notes from [extension.rdoc - Appendix E. RB_GC_GUARD to protect from premature GC][8] I've prepared a patched ruby 3.3.1 package that does not
segfault. It's on [OBS Project home:josegomezr:branches:ruby/ruby3.3][6].

Adding a `RB_GC_GUARD` on `rb_io_getline_fast` @ `io.c:4004` just before the return

```diff
--- ruby3.3.orig/ruby-3.3.1/io.c
+++ ruby3.3/ruby-3.3.1/io.c
@@ -4004,6 +4004,7 @@ rb_io_getline_fast(rb_io_t *fptr, rb_enc
     ENC_CODERANGE_SET(str, cr);
     fptr->lineno++;
 
+    RB_GC_GUARD(str);
     return str;
 }
```

Fixes the segfault in our tests. `bundle` finish the installation and the image is built.

I've set up a project in OBS to provide reproduceables.

- [ruby3.3.1 package][5].
- [ruby3.3.1 base image with enough dependencies to reproduce][7] with [the reproducer script][1].

And the corresponding container is exported in the `containers-patched`
repository.

Here I leave the docker images generated by OBS:

- 3.3.1 [without patches, segfaults.]
```
registry.opensuse.org/home/josegomezr/branches/ruby/containers/containers/base-ruby33:latest
```


- 3.3.1 [with patch, does not fail]
```
registry.opensuse.org/home/josegomezr/branches/ruby/containers/containers-patched/base-ruby33:latest
```


[0]: https://gist.github.com/josegomezr/441c271cc731b0ec57213cb98743a699
[1]: https://gist.github.com/josegomezr/e17129bf2df33f3bea60e84a616a8322
[2]: https://gist.github.com/josegomezr/6f81878c979af334efee59b8f2225e58
[3]: https://github.com/ruby/ruby/blob/v3_3_1/io.c#L4001
[4]: https://github.com/ruby/ruby/blob/v3_3_1/io.c#L4003
[5]: https://build.opensuse.org/package/show/devel:languages:ruby/ruby3.3
[6]: https://build.opensuse.org/package/show/home:josegomezr:branches:ruby/ruby3.3
[7]: https://build.opensuse.org/package/show/home:josegomezr:branches:ruby:containers/base-ruby33
[8]: https://github.com/ruby/ruby/blob/master/doc/extension.rdoc#label-Appendix+E.+RB_GC_GUARD+to+protect+from+premature+GC




-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/