Skip to content

Fix - Restrict address space of sysvar syscalls in SIMD-0219 #7832

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Lichtso merged 2 commits into from
Sep 9, 2025
Merged

Fix - Restrict address space of sysvar syscalls in SIMD-0219 #7832

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
165a5d1
Restrict address space of sysvar syscalls as well (similar to CPI).
Lichtso Sep 2, 2025
382d12e
Adds a test for the new restriction.
Lichtso Sep 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions programs/sbf/rust/sysvar/src/lib.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -209,6 +209,16 @@ pub fn process_instruction(

Ok(())
}
Some(&4) => {
// Attempt to store the result in the input region instead of the stack or heap
unsafe {
solana_define_syscall::definitions::sol_get_epoch_rewards_sysvar(
accounts[2].data.borrow_mut().as_mut_ptr(),
)
};

Ok(())
}
_ => Err(ProgramError::InvalidInstructionData),
}
}
26 changes: 24 additions & 2 deletions programs/sbf/tests/sysvar.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,15 +69,21 @@ fn test_sysvar_syscalls() {
&authority_keypair,
"solana_sbf_rust_sysvar",
);
let dummy_account_key = Pubkey::new_unique();
bank.store_account(
&dummy_account_key,
&solana_account::AccountSharedData::new(1, 32, &program_id),
);
bank.freeze();
let blockhash = bank.last_blockhash();

for ix_discriminator in 0..4 {
let instruction = Instruction::new_with_bincode(
program_id,
&[ix_discriminator],
vec![
AccountMeta::new(mint_keypair.pubkey(), true),
AccountMeta::new(Pubkey::new_unique(), false),
AccountMeta::new(dummy_account_key, false),
AccountMeta::new_readonly(clock::id(), false),
AccountMeta::new_readonly(epoch_schedule::id(), false),
AccountMeta::new_readonly(instructions::id(), false),
Expand All @@ -90,11 +96,27 @@ fn test_sysvar_syscalls() {
AccountMeta::new_readonly(epoch_rewards::id(), false),
],
);
let blockhash = bank.last_blockhash();
let message = Message::new(&[instruction], Some(&mint_keypair.pubkey()));
let transaction = Transaction::new(&[&mint_keypair], message, blockhash);
let sanitized_tx = RuntimeTransaction::from_transaction_for_tests(transaction);
let result = bank.simulate_transaction(&sanitized_tx, false);
assert!(result.result.is_ok());
}

// Storing the result of get_sysvar() in the input region is not allowed
// because of the 16 byte alignment requirement of the EpochRewards sysvar.
Comment on lines +106 to +107
Copy link
Copy Markdown

@buffalojoec buffalojoec Sep 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shouldn't this comment say it's not allowed because it's strictly forbidden by the restrictions?

Copy link
Copy Markdown
Author

@Lichtso Lichtso Sep 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

And the reason why it is forbidden is the alignment requirement. So, the comment just skips the middle.

Copy link
Copy Markdown

@buffalojoec buffalojoec Sep 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought the whole point was to disallow aliasing of account memory regions as stack space? SIMD-0219 doesn't list EpochRewards sysvar alignment as the motivation.

https://github.com/solana-foundation/solana-improvement-documents/pull/219/files#diff-d4c15e8a609c0d53c78a3db932bce5bb207dfce9d9a9874f2b2a5eedf56dda54R79

Copy link
Copy Markdown
Author

@Lichtso Lichtso Sep 6, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, there can not be aliasing of account regions and the stack region anyway because we don't do overlapping memory layouts. The SIMD says that these pointers must be in the stack or heap regions (thus implicitly can not be in the account regions).

Yes, I can add the alignment requirement as a motivation for forbidding sysvar syscalls from writing to the account regions in the SIMD. Currently it only mentions the restriction, not the reason for its existence.

let instruction = Instruction::new_with_bincode(
program_id,
&[4],
vec![
AccountMeta::new(mint_keypair.pubkey(), true),
AccountMeta::new_readonly(epoch_rewards::id(), false),
AccountMeta::new(dummy_account_key, false),
],
);
let message = Message::new(&[instruction], Some(&mint_keypair.pubkey()));
let transaction = Transaction::new(&[&mint_keypair], message, blockhash);
let sanitized_tx = RuntimeTransaction::from_transaction_for_tests(transaction);
let result = bank.simulate_transaction(&sanitized_tx, false);
assert!(result.result.is_err());
}
17 changes: 16 additions & 1 deletion syscalls/src/sysvar.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
use {
super::*, crate::translate_mut,
solana_program_runtime::execution_budget::SVMTransactionExecutionCost,
solana_program_runtime::execution_budget::SVMTransactionExecutionCost, solana_sbpf::ebpf,
};

fn get_sysvar<T: std::fmt::Debug + SysvarSerialize + Clone>(
Expand All @@ -17,6 +17,14 @@ fn get_sysvar<T: std::fmt::Debug + SysvarSerialize + Clone>(
.sysvar_base_cost
.saturating_add(size_of::<T>() as u64),
)?;

if var_addr >= ebpf::MM_INPUT_START
Comment thread
Lichtso marked this conversation as resolved.
&& invoke_context
.get_feature_set()
.stricter_abi_and_runtime_constraints
{
return Err(SyscallError::InvalidPointer.into());
}
translate_mut!(
memory_mapping,
check_aligned,
Expand Down Expand Up @@ -203,6 +211,13 @@ declare_builtin_function!(
.saturating_add(std::cmp::max(sysvar_buf_cost, mem_op_base_cost)),
)?;

if var_addr >= ebpf::MM_INPUT_START
&& invoke_context
.get_feature_set()
.stricter_abi_and_runtime_constraints
{
return Err(SyscallError::InvalidPointer.into());
}
// Abort: "Not all bytes in VM memory range `[var_addr, var_addr + length)` are writable."
translate_mut!(
memory_mapping,
Expand Down
Loading