bytecodealliance / wasmtime

A fast and secure runtime for WebAssembly
https://wasmtime.dev/
Apache License 2.0
15.08k stars 1.26k forks source link

Cranelift: "bus error" with unaligned atomics on AArch64 #5483

Open afonso360 opened 1 year ago

afonso360 commented 1 year ago

👋 Hey,

Fuzzgen found this on AArch64.

.clif Test Case

test run
target aarch64
target s390x
target riscv64
target x86_64

function %a(i32) -> i32 system_v {
    ss0 = explicit_slot 14

block0(v0: i32):
    v1 = stack_addr.i64 ss0+1
    atomic_store v0, v1
    return v0
}

; run: %a(0) == 0

Steps to Reproduce

This test does not crash in QEMU, only in a real AArch64 machine.

Expected Results

I would expect this to either pass or fail to compile. According to the docs, the instruction should not be allowed to trap, since it does not have the aligned flag.

By default, Cranelift memory instructions work with any unaligned effective address. If the aligned flag is set, the instruction is permitted to trap or return a wrong result if the effective address is misaligned.

Actual Results

ubuntu@instance-20220805-0848:~/git/wasmtime/cranelift$ cargo run -- test ./lmao.clif
    Finished dev [unoptimized + debuginfo] target(s) in 0.16s
     Running `/home/ubuntu/git/wasmtime/target/debug/clif-util test ./lmao.clif`
Bus error (core dumped)

Versions and Environment

Cranelift version or commit: main Operating system: Linux Architecture: AArch64

Extra Info

Maybe we should restrict the current lowering to only if the aligned flag is present?

cfallin commented 1 year ago

Maybe we should restrict the current lowering to only if the aligned flag is present?

I think that's the most reasonable fix, yeah; and correspondingly, add the aligned flag when generating these instructions from Wasm atomic ops in cranelift-wasm, as we guarantee that the heap is aligned with the built-in allocators and I believe the Wasm ops require the address to be naturally aligned wrt the heap base. Support for atomic ops in CLIF without aligned is then machine-dependent: x86 has them, most other architectures probably don't.