PoC of memory corruption issue in TS#352
Open
jgur-psyops wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Demonstrates a possible memory/process corruption issue that occurs on Linux when using LiteSVM with TS.
To preview:
this will hang indefinitely on
BigNumber("100000000").div("1000000"). SetMODE = "skip", or send a different ix (such as a simple SOL transfer) and it will complete. Creating an ATA always triggers the issue.Possible Fix
Enabling
stricter_abi_and_runtime_constraintsfixes the issue. E.g. addOr comment back in the block starting with
if (process.env.FEATURE_SOURCE === "repo") {and observe thatthis hangs
this exits cleanly
Forcing the BPF loader to user the interpreter instead of the x86 SBPF JIT also seems to work.
It seems that with
stricter_abi_and_runtime_constraintscreating ATA runs through the old ABI path. A more clever permanent fix is probably possible but beyond the scope of this PR.Versions Used: