Add test program for BPF memory corruption bug (#5603)

* Add test program for BPF memory corruption bug

* @jackcmay feedback

programs/bpf/build.rs

@@ -76,6 +76,8 @@ fn main() {
             "external_spend",
             "noop",
             "panic",
+            // ISSUE: https://github.com/solana-labs/solana/issues/5602
+            // "stack_bug",
             "tick_height",
         ];
         for program in rust_programs.iter() {

programs/bpf/rust/stack_bug/.gitignore

@@ -0,0 +1,4 @@
+/target/
+
+Cargo.lock
+/farf/

programs/bpf/rust/stack_bug/Cargo.toml

@@ -0,0 +1,27 @@
+
+# Note: This crate must be built using build.sh
+
+[package]
+name = "solana-bpf-rust-stack-bug"
+version = "0.18.0-pre2"
+description = "Solana BPF iter program written in Rust"
+authors = ["Solana Maintainers <maintainers@solana.com>"]
+repository = "https://github.com/solana-labs/solana"
+license = "Apache-2.0"
+homepage = "https://solana.com/"
+edition = "2018"
+
+[dependencies]
+solana-sdk-bpf-utils = { path = "../../../../sdk/bpf/rust/rust-utils", version = "0.18.0-pre2" }
+solana-sdk-bpf-no-std = { path = "../../../../sdk/bpf/rust/rust-no-std", version = "0.18.0-pre2" }
+solana-bpf-rust-stack-bug-dep = { path = "../stack_bug_dep", version = "0.18.0-pre2" }
+
+[dev_dependencies]
+solana-sdk-bpf-test = { path = "../../../../sdk/bpf/rust/rust-test", version = "0.18.0-pre2" }
+
+[workspace]
+members = []
+
+[lib]
+crate-type = ["cdylib"]
+name = "solana_bpf_rust_stack_bug"

programs/bpf/rust/stack_bug/Xargo.toml

@@ -0,0 +1,6 @@
+[dependencies.compiler_builtins]
+path = "../../../../sdk/bpf/dependencies/rust-bpf-sysroot/src/compiler-builtins"
+features = ["c", "mem"]
+
+[target.bpfel-unknown-unknown.dependencies]
+alloc = { path = "../../../../sdk/bpf/dependencies/rust-bpf-sysroot/src/liballoc" }

programs/bpf/rust/stack_bug/src/lib.rs

@@ -0,0 +1,41 @@
+//! @brief Example Rust-based BPF program tests loop iteration
+
+#![no_std]
+#![allow(unused_attributes)]
+
+#[macro_use]
+extern crate alloc;
+#[cfg(not(test))]
+extern crate solana_sdk_bpf_no_std;
+extern crate solana_sdk_bpf_utils;
+
+use alloc::vec::Vec;
+use solana_sdk_bpf_utils::info;
+use solana_sdk_bpf_utils::entrypoint;
+use solana_sdk_bpf_utils::entrypoint::{SolKeyedAccount, SolClusterInfo};
+use solana_bpf_rust_stack_bug_dep::{InitPollData, PollData};
+
+entrypoint!(process_instruction);
+fn process_instruction(ka: &mut [SolKeyedAccount], _info: &SolClusterInfo, _data: &[u8]) -> bool {
+    let header = vec![1u8; 6];
+    let option_a = vec![1u8; 1];
+    let option_b = vec![1u8; 1];
+    let init_poll = InitPollData {
+        timeout: 10u32,
+        header_len: 6,
+        header: &header,
+        option_a_len: 1,
+        option_a: &option_a,
+        option_b_len: 1,
+        option_b: &option_b,
+    };
+
+    let key1 = [1u8; 32];
+    let key2 = [1u8; 32];
+    let key3 = [1u8; 32];
+    let poll_data = PollData::init(init_poll, &key1, &key2, &key3, 5000);
+    poll_data.to_bytes();
+
+    info!("Success");
+    true
+}

programs/bpf/rust/stack_bug_dep/.gitignore

@@ -0,0 +1,4 @@
+/target/
+
+Cargo.lock
+/farf/

programs/bpf/rust/stack_bug_dep/Cargo.toml

@@ -0,0 +1,22 @@
+
+# Note: This crate must be built using build.sh
+
+[package]
+name = "solana-bpf-rust-stack-bug-dep"
+version = "0.18.0-pre2"
+description = "Solana BPF program written in Rust"
+authors = ["Solana Maintainers <maintainers@solana.com>"]
+repository = "https://github.com/solana-labs/solana"
+license = "Apache-2.0"
+homepage = "https://solana.com/"
+edition = "2018"
+
+[dependencies]
+solana-sdk-bpf-utils = { path = "../../../../sdk/bpf/rust/rust-utils", version = "0.18.0-pre2" }
+solana-sdk-bpf-no-std = { path = "../../../../sdk/bpf/rust/rust-no-std", version = "0.18.0-pre2" }
+
+[dev_dependencies]
+solana-sdk-bpf-test = { path = "../../../../sdk/bpf/rust/rust-test", version = "0.18.0-pre2" }
+
+[workspace]
+members = []

programs/bpf/rust/stack_bug_dep/Xargo.toml

@@ -0,0 +1,6 @@
+[dependencies.compiler_builtins]
+path = "../../../../sdk/bpf/dependencies/rust-bpf-sysroot/src/compiler-builtins"
+features = ["c", "mem"]
+
+[target.bpfel-unknown-unknown.dependencies]
+alloc = { path = "../../../../sdk/bpf/dependencies/rust-bpf-sysroot/src/liballoc" }

programs/bpf/rust/stack_bug_dep/src/lib.rs

@@ -0,0 +1,98 @@
+//! @brief Example Rust-based BPF program tests loop iteration
+
+#![no_std]
+#![allow(unused_attributes)]
+
+extern crate alloc;
+#[cfg(not(test))]
+extern crate solana_sdk_bpf_no_std;
+extern crate solana_sdk_bpf_utils;
+
+use alloc::vec::Vec;
+use solana_sdk_bpf_utils::entrypoint::{SolPubkey};
+
+pub struct InitPollData<'a> {
+    pub timeout: u32,
+    pub header_len: u32,
+    pub header: &'a [u8],
+    pub option_a_len: u32,
+    pub option_a: &'a [u8],
+    pub option_b_len: u32,
+    pub option_b: &'a [u8],
+}
+
+pub struct PollData<'a> {
+    pub creator_key: &'a SolPubkey,
+    pub last_block: u64,
+    pub header_len: u32,
+    pub header: &'a [u8],
+    pub option_a: PollOptionData<'a>,
+    pub option_b: PollOptionData<'a>,
+}
+
+impl<'a> PollData<'a> {
+    pub fn length(&self) -> usize {
+        (32 + 8 + 4 + self.header_len) as usize + self.option_a.length() + self.option_b.length()
+    }
+
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let mut bytes = Vec::with_capacity(self.length());
+        bytes.extend_from_slice(self.creator_key);
+        bytes.extend_from_slice(&self.last_block.to_be_bytes());
+        bytes.extend_from_slice(&self.header_len.to_be_bytes());
+        bytes.extend_from_slice(self.header);
+        bytes.extend(self.option_a.to_bytes().into_iter());
+        bytes.extend(self.option_b.to_bytes().into_iter());
+        bytes
+    }
+
+    pub fn init(
+        init: InitPollData<'a>,
+        creator_key: &'a SolPubkey,
+        tally_a_key: &'a SolPubkey,
+        tally_b_key: &'a SolPubkey,
+        slot: u64,
+    ) -> Self {
+        assert_eq!(init.timeout, 10);
+        Self {
+            creator_key,
+            last_block: slot + init.timeout as u64,
+            header_len: init.header_len,
+            header: init.header,
+            option_a: PollOptionData {
+                text_len: init.option_a_len,
+                text: init.option_a,
+                tally_key: tally_a_key,
+                quantity: 0,
+            },
+            option_b: PollOptionData {
+                text_len: init.option_b_len,
+                text: init.option_b,
+                tally_key: tally_b_key,
+                quantity: 0,
+            },
+        }
+    }
+}
+
+pub struct PollOptionData<'a> {
+    pub text_len: u32,
+    pub text: &'a [u8],
+    pub tally_key: &'a SolPubkey,
+    pub quantity: u64,
+}
+
+impl<'a> PollOptionData<'a> {
+    pub fn length(&self) -> usize {
+        (4 + self.text_len + 32 + 8) as usize
+    }
+
+    pub fn to_bytes(&self) -> Vec<u8> {
+        let mut bytes = Vec::with_capacity(self.length());
+        bytes.extend_from_slice(&self.text_len.to_be_bytes());
+        bytes.extend_from_slice(self.text);
+        bytes.extend_from_slice(self.tally_key);
+        bytes.extend_from_slice(&self.quantity.to_be_bytes());
+        bytes
+    }
+}

programs/bpf/tests/programs.rs

@@ -97,6 +97,8 @@ mod bpf {
                 ("solana_bpf_rust_external_spend", false),
                 ("solana_bpf_rust_noop", true),
                 ("solana_bpf_rust_panic", false),
+                // ISSUE: https://github.com/solana-labs/solana/issues/5602
+                // ("solana_bpf_rust_stack_bug", true),
             ];
             for program in programs.iter() {
                 let filename = create_bpf_path(program.0);