Skip to content

PoC of memory corruption issue in TS#352

Open
jgur-psyops wants to merge 1 commit into
LiteSVM:masterfrom
jgur-psyops:ts-corruption-poc
Open

PoC of memory corruption issue in TS#352
jgur-psyops wants to merge 1 commit into
LiteSVM:masterfrom
jgur-psyops:ts-corruption-poc

Conversation

@jgur-psyops

Copy link
Copy Markdown

Demonstrates a possible memory/process corruption issue that occurs on Linux when using LiteSVM with TS.

To preview:

cd scripts
yarn install
yarn repro

this will hang indefinitely on BigNumber("100000000").div("1000000"). Set MODE = "skip", or send a different ix (such as a simple SOL transfer) and it will complete. Creating an ATA always triggers the issue.

Possible Fix

Enabling stricter_abi_and_runtime_constraints fixes the issue. E.g. add

const featureSet = FeatureSet.allEnabled();
svm.withFeatureSet(featureSet);

Or comment back in the block starting with if (process.env.FEATURE_SOURCE === "repo") { and observe that

this hangs

FEATURE_SOURCE=repo MODE=send timeout 15s node --loader ts-node/esm repro.ts

this exits cleanly

FEATURE_SOURCE=repo EXTRA_FEATURES=Eoh7e1sDqtyPtuiWAhBNSJinvtJWTTDgeUMRi3RF8zWS MODE=send timeout 15s node --loader ts-node/esm repro.ts

Forcing the BPF loader to user the interpreter instead of the x86 SBPF JIT also seems to work.

It seems that with stricter_abi_and_runtime_constraints creating ATA runs through the old ABI path. A more clever permanent fix is probably possible but beyond the scope of this PR.

Versions Used:

Ubuntu 24.04.2 LTS
➜  scripts git:(ts-corruption-poc) node -v       
v24.16.0
➜  scripts git:(ts-corruption-poc) yarn -v       
4.14.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant