Bug 194769 – Bytecode cache should a have a boot-specific validation

• Component: JavaScriptCore
• Status: RESOLVED FIXED

[Tadeu Zagallo]

...

[Tadeu Zagallo]

<rdar://problem/48149509>

[Tadeu Zagallo]

Created attachment 362267 [details]
Patch

[Tadeu Zagallo]

Created attachment 362278 [details]
Patch

Rebase

[EWS Watchlist]

Comment on attachment 362278 [details]
Patch

Attachment 362278 [details] did not pass mac-debug-ews (mac):
Output: https://webkit-queues.webkit.org/results/11190412

New failing tests:
webgl/2.0.0/conformance/context/context-release-upon-reload.html

[EWS Watchlist]

Created attachment 362289 [details]
Archive of layout-test-results from ews113 for mac-highsierra

The attached test failures were seen while running run-webkit-tests on the mac-debug-ews.
Bot: ews113  Port: mac-highsierra  Platform: Mac OS X 10.13.6

[Keith Miller]

Comment on attachment 362278 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=362278&action=review

> Source/JavaScriptCore/runtime/CachedTypes.cpp:78
> +using UUID = std::array<uint8_t, 16>;
> +
> +static UUID bootUUID()
> +{
> +    static UUID bootUUID = { };
> +#if OS(DARWIN)
> +    static std::once_flag onceKey;
> +    std::call_once(onceKey, [] {
> +        size_t uuidlen = 37;
> +        char uuid[uuidlen];
> +        if (sysctlbyname("kern.bootsessionuuid", uuid, &uuidlen, nullptr, 0))
> +            return;
> +        uint32_t offset = 0;
> +        for (uint32_t i = 0; i < uuidlen - 1;) {
> +            if (uuid[i] == '-') {
> +                ++i;
> +                continue;
> +            }
> +            bootUUID[offset++] = toASCIIHexValue(uuid[i], uuid[i+1]);
> +            i += 2;
> +        }
> +        RELEASE_ASSERT(offset == sizeof(UUID));
> +    });
> +#endif
> +    return bootUUID;
> +}

Can we move this to its own file in WTF? Maybe UUID.h? If we do that though, we might just want to make the UUID a string or make it a class that has an operator String&()

[Tadeu Zagallo]

Created attachment 362308 [details]
Patch

[EWS Watchlist]

Attachment 362308 [details] did not pass style-queue:


ERROR: Source/WTF/wtf/UUID.cpp:34:  Alphabetical sorting problem.  [build/include_order] [4]
Total errors found: 1 in 5 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Keith Miller]

Comment on attachment 362308 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=362308&action=review

r=me with small fix.

> Source/WTF/wtf/UUID.cpp:34
> +#include <mutex>

I think you need to move this to after the WTF includes.

[Saam Barati]

Comment on attachment 362308 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=362308&action=review

> Source/WTF/wtf/UUID.cpp:77
> +        bootSessionUUID.construct(String(uuid, 36));

Nit: I think you can just invoke the normal constructor instead of the move constructor: construct(uuid, 36)

I’d also say uuidLength - 1 instead of 36.

[Tadeu Zagallo]

Comment on attachment 362308 [details]
Patch

View in context: https://bugs.webkit.org/attachment.cgi?id=362308&action=review

>> Source/WTF/wtf/UUID.cpp:77
>> +        bootSessionUUID.construct(String(uuid, 36));
> 
> Nit: I think you can just invoke the normal constructor instead of the move constructor: construct(uuid, 36)
> 
> I’d also say uuidLength - 1 instead of 36.

I tried that, but it complained about the char[] as a template argument. I thought this was better than casting, but I'm happy to change it.

I'll change the length argument.

[Tadeu Zagallo]

Created attachment 362310 [details]
Patch for landing

[EWS Watchlist]

Attachment 362310 [details] did not pass style-queue:


ERROR: Source/WTF/wtf/UUID.cpp:34:  Alphabetical sorting problem.  [build/include_order] [4]
Total errors found: 1 in 8 files


If any of these errors are false positives, please file a bug against check-webkit-style.

[Sam Weinig]

Comment on attachment 362310 [details]
Patch for landing

View in context: https://bugs.webkit.org/attachment.cgi?id=362310&action=review

> Source/JavaScriptCore/ChangeLog:10
> +        Add the boot UUID to the cached bytecode to enforce that it is not reused
> +        across reboots.

What is the reason for invalidating across reboots? What bug are you trying to fix/avoid?

[Keith Miller]

(In reply to Sam Weinig from comment #14)
> Comment on attachment 362310 [details]
> Patch for landing
> 
> View in context:
> https://bugs.webkit.org/attachment.cgi?id=362310&action=review
> 
> > Source/JavaScriptCore/ChangeLog:10
> > +        Add the boot UUID to the cached bytecode to enforce that it is not reused
> > +        across reboots.
> 
> What is the reason for invalidating across reboots? What bug are you trying
> to fix/avoid?

It’s to prevent a malicious bytecode cache from pwning the device across reboots.

[WebKit Commit Bot]

Comment on attachment 362310 [details]
Patch for landing

Clearing flags on attachment: 362310

Committed r241733: <https://trac.webkit.org/changeset/241733>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Sam Weinig]

(In reply to Keith Miller from comment #15)
> (In reply to Sam Weinig from comment #14)
> > Comment on attachment 362310 [details]
> > Patch for landing
> > 
> > View in context:
> > https://bugs.webkit.org/attachment.cgi?id=362310&action=review
> > 
> > > Source/JavaScriptCore/ChangeLog:10
> > > +        Add the boot UUID to the cached bytecode to enforce that it is not reused
> > > +        across reboots.
> > 
> > What is the reason for invalidating across reboots? What bug are you trying
> > to fix/avoid?
> 
> It’s to prevent a malicious bytecode cache from pwning the device across
> reboots.

Please try and include the "why" in the ChangeLog.

[Keith Miller]

> 
> Please try and include the "why" in the ChangeLog.

Fair enough.