ffi: reject fast calls after library close

Optimized Fast API calls bypass InvokeFunction and can jump directly to
a symbol after DynamicLibrary::close() unloads its library.
Check the function's closed state in the AArch64 and SysV x64
trampolines before entering the target. If the library is closed,
schedule ERR_FFI_LIBRARY_CLOSED and return without calling the symbol.
Keep the JavaScript guard on platforms without a native trampoline guard
and for signatures that already require argument conversion or
validation. This keeps raw scalar fast calls close to their original
performance on supported platforms.
Signed-off-by: Kamat, Trivikram <16024985+trivikr@users.noreply.github.com>
Assisted-by: codex:gpt-5.6-sol
PR-URL: #64860Fixes: #64854
Reviewed-By: Paolo Insogna <paolo@cowtech.it>
Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
Reviewed-By: James M Snell <jasnell@gmail.com>

Author: trivikr

lib/ffi.js

@@ -68,6 +68,7 @@ const {
 }=require('internal/ffi-shared-buffer');
 
 const{
+ markFastLibraryClosed,
  wrapWithRawPointerConversions,
 }=require('internal/ffi/fast-api');
 
@@ -100,6 +101,27 @@ function wrapFFIFunction(rawFn, owner) {
 
 constrawGetFunction=DynamicLibrary.prototype.getFunction;
 constrawGetFunctions=DynamicLibrary.prototype.getFunctions;
+constrawClose=DynamicLibrary.prototype.close;
+
+functionclose(){
+constresult=FunctionPrototypeCall(rawClose,this);
+markFastLibraryClosed(this);
+returnresult;
+}
+
+ObjectDefineProperty(DynamicLibrary.prototype,'close',{
+__proto__: null,
+configurable: true,
+value: close,
+writable: true,
+});
+
+ObjectDefineProperty(DynamicLibrary.prototype,SymbolDispose,{
+__proto__: null,
+configurable: true,
+value: close,
+writable: true,
+});
 
 DynamicLibrary.prototype.getFunction=functiongetFunction(name,signature){
 constraw=FunctionPrototypeCall(rawGetFunction,this,name,signature);

lib/internal/errors.js

@@ -1232,6 +1232,7 @@ E('ERR_FEATURE_UNAVAILABLE_ON_PLATFORM',
 'The feature %s is unavailable on the current platform'+
 ', which is being used to run Node.js',
 TypeError);
+E('ERR_FFI_LIBRARY_CLOSED','Library is closed',Error);
 E('ERR_FS_CP_DIR_TO_NON_DIR',
 'Cannot overwrite non-directory with directory',SystemError);
 E('ERR_FS_CP_EEXIST','Target already exists',SystemError);

lib/internal/ffi/fast-api.js

@@ -5,6 +5,7 @@ const {
  NumberIsInteger,
  ObjectDefineProperty,
  ReflectApply,
+ SafeWeakMap,
  StringPrototypeIncludes,
  TypeError,
 }=primordials;
@@ -25,9 +26,16 @@ const {
  kFastBufferInvoke,
 }=internalBinding('ffi');
 
+const{
+codes: {
+ERR_FFI_LIBRARY_CLOSED,
+},
+}=require('internal/errors');
+
 constU64_MAX=0xFFFFFFFFFFFFFFFFn;
 constI64_MAX=0x7FFFFFFFFFFFFFFFn;
 constI64_MIN=-0x8000000000000000n;
+constfastLibraryStates=newSafeWeakMap();
 
 // These ranges mirror ToFFIArgument in src/ffi/types.cc. V8's Fast API
 // exposes narrow integers as 32-bit values and uses truncating BigInt
@@ -202,7 +210,20 @@ function inheritMetadata(wrapper, rawFn, nargs) {
 returnwrapper;
 }
 
-functionwrapWithRawPointerConversions(rawFn,argumentTypes,_owner){
+functionmarkFastLibraryClosed(owner){
+conststate=fastLibraryStates.get(owner);
+if(state!==undefined){
+state.closed=true;
+}
+}
+
+functionthrowIfFastLibraryClosed(state){
+if(state.closed){
+thrownewERR_FFI_LIBRARY_CLOSED();
+}
+}
+
+functionwrapWithRawPointerConversions(rawFn,argumentTypes,owner){
 if(rawFn===undefined||rawFn===null){
 returnrawFn;
 }
@@ -213,11 +234,14 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, _owner) {
 returnrawFn;
 }
 
-constindexes=getFastArgumentIndexes(argumentTypes);
-if(indexes===null){
-returnrawFn;
+letstate=fastLibraryStates.get(owner);
+if(state===undefined){
+state={__proto__: null,closed: false};
+fastLibraryStates.set(owner,state);
 }
 
+constindexes=getFastArgumentIndexes(argumentTypes)??[];
+
 conststringState={
 __proto__: null,
 buffers: [],
@@ -233,6 +257,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, _owner) {
 constfastBufferInvoke=needsPointerLikeConversion(t0) ?
 rawFn[kFastBufferInvoke] : undefined;
 wrapper=function(a0){
+throwIfFastLibraryClosed(state);
 if(arguments.length!==1){
 throwFFIArgCountError(1,arguments.length);
 }
@@ -262,6 +287,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, _owner) {
 constt0=argumentTypes[0];
 constt1=argumentTypes[1];
 wrapper=function(a0,a1){
+throwIfFastLibraryClosed(state);
 if(arguments.length!==2){
 throwFFIArgCountError(2,arguments.length);
 }
@@ -283,6 +309,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, _owner) {
 constt1=argumentTypes[1];
 constt2=argumentTypes[2];
 wrapper=function(a0,a1,a2){
+throwIfFastLibraryClosed(state);
 if(arguments.length!==3){
 throwFFIArgCountError(3,arguments.length);
 }
@@ -300,6 +327,7 @@ function wrapWithRawPointerConversions(rawFn, argumentTypes, _owner) {
 };
 }else{
 wrapper=function(...args){
+throwIfFastLibraryClosed(state);
 if(args.length!==nargs){
 throwFFIArgCountError(nargs,args.length);
 }
@@ -332,5 +360,6 @@ module.exports = {
  convertPointerArg,
  hasPointerMemoryArg,
  hasStringPointerArg,
+ markFastLibraryClosed,
  wrapWithRawPointerConversions,
 };

src/ffi/fast.cc

@@ -241,12 +241,26 @@ extern "C" uintptr_t node_ffi_fast_buffer_data(v8::Local<v8::Value> value,
 
  v8::Isolate* isolate = options != nullptr ? options->isolate : nullptr;
 if (isolate != nullptr) {
+// No HandleScope is active during a Fast API call, so open one before
+// creating the error object.
+ v8::HandleScope scope(isolate);
 THROW_ERR_INVALID_ARG_VALUE(
  isolate, "Argument %u must be a buffer or an ArrayBuffer", index);
  }
 returnkInvalidBuffer;
 }
 
+extern"C"voidnode_ffi_fast_library_closed(v8::Isolate* isolate) {
+if (isolate != nullptr) {
+// Fast API calls do not enter a HandleScope, and the generated trampolines
+// call this helper directly. Building the error object allocates handles,
+// so open a scope here. The scheduled exception lives on the isolate and
+// outlives the scope.
+ v8::HandleScope scope(isolate);
+THROW_ERR_FFI_LIBRARY_CLOSED(isolate);
+ }
+}
+
 FastFFIMetadata::~FastFFIMetadata() {
 // Metadata owns executable memory through `trampoline`; releasing it here
 // ties code lifetime to the V8 function's weak FFIFunctionInfo cleanup.
@@ -265,7 +279,18 @@ bool IsFastCallSupported() {
 #endif
 }
 
-std::unique_ptr<FastFFIMetadata> CreateFastFFIMetadata(const FFIFunction& fn) {
+boolIsFastLibraryGuardSupported() {
+#if defined(__aarch64__) || defined(_M_ARM64) || \
+ (defined(__x86_64__) && !defined(_WIN32))
+returntrue;
+#else
+returnfalse;
+#endif
+}
+
+std::unique_ptr<FastFFIMetadata> CreateFastFFIMetadata(const FFIFunction& fn,
+constbool* closed,
+ v8::Isolate* isolate) {
 // Bail early if executable memory allocation doesn't work on this process
 // (missing MAP_JIT entitlement, hardened runtime, SELinux execmem, etc.).
 // The self-test runs once and caches the result.
@@ -299,6 +324,7 @@ std::unique_ptr<FastFFIMetadata> CreateFastFFIMetadata(const FFIFunction& fn) {
  std::vector<FastFFIType> args;
  args.reserve(fn.arg_type_names.size());
 bool needs_bigint = NeedsBigIntRepresentation(result);
+constbool guards_library = IsFastLibraryGuardSupported();
 bool needs_callback_options = false;
 // Normalize public argument names into FastFFIType values while collecting
 // signature-wide flags required by V8 CFunctionInfo.
@@ -320,8 +346,9 @@ std::unique_ptr<FastFFIMetadata> CreateFastFFIMetadata(const FFIFunction& fn) {
 // The platform-specific trampoline is the executable entrypoint V8 calls.
 // If the platform rejects the signature, the whole fast metadata object is
 // discarded and the caller chooses another invocation path.
+ FastFFITrampolineConfig config{fn.ptr, closed, isolate};
 if (!node_ffi_create_fast_trampoline(
-fn.ptr, args.data(), args.size(), result, &metadata->trampoline)) {
+config, args.data(), args.size(), result, &metadata->trampoline)) {
 returnnullptr;
  }
 
@@ -348,6 +375,7 @@ std::unique_ptr<FastFFIMetadata> CreateFastFFIMetadata(const FFIFunction& fn) {
  : CFunctionInfo::Int64Representation::kNumber);
  metadata->c_function =
 v8::CFunction(metadata->trampoline.code, metadata->c_function_info.get());
+ metadata->guards_library = guards_library;
 return metadata;
 }
 

src/ffi/fast.h

@@ -36,6 +36,12 @@ struct FastFFITrampoline {
 size_t size = 0;
 };
 
+structFastFFITrampolineConfig {
+void* target;
+constbool* closed;
+ v8::Isolate* isolate;
+};
+
 structFastFFIMetadata {
 FastFFIMetadata() = default;
 ~FastFFIMetadata();
@@ -47,6 +53,7 @@ struct FastFFIMetadata {
  std::vector<v8::CTypeInfo> arg_info;
  std::unique_ptr<v8::CFunctionInfo> c_function_info;
  v8::CFunction c_function;
+bool guards_library = false;
 };
 
 // Public detection queries.
@@ -56,6 +63,7 @@ struct FastFFIMetadata {
 // of any particular signature — if this returns false, no signature can
 // use the fast-call path.
 boolIsFastCallSupported();
+boolIsFastLibraryGuardSupported();
 
 boolSignatureNeedsRawPointerConversions(const FFIFunction& fn);
 boolSignatureNeedsFastIntegerValidation(const FFIFunction& fn);
@@ -65,19 +73,23 @@ std::shared_ptr<FFIFunction> CloneWithRawPointerArgNames(
 const std::shared_ptr<FFIFunction>& fn);
 std::shared_ptr<FFIFunction> CloneWithFastBufferArgNames(
 const std::shared_ptr<FFIFunction>& fn);
-std::unique_ptr<FastFFIMetadata> CreateFastFFIMetadata(const FFIFunction& fn);
+std::unique_ptr<FastFFIMetadata> CreateFastFFIMetadata(const FFIFunction& fn,
+constbool* closed,
+ v8::Isolate* isolate);
 
 } // namespace node::ffi
 
 extern"C" {
 uintptr_tnode_ffi_fast_buffer_data(v8::Local<v8::Value> value,
  v8::FastApiCallbackOptions* options,
 uint32_t index);
-boolnode_ffi_create_fast_trampoline(void* target,
-const node::ffi::FastFFIType* args,
-size_t argc,
- node::ffi::FastFFIType result,
- node::ffi::FastFFITrampoline* out);
+voidnode_ffi_fast_library_closed(v8::Isolate* isolate);
+boolnode_ffi_create_fast_trampoline(
+const node::ffi::FastFFITrampolineConfig& config,
+const node::ffi::FastFFIType* args,
+size_t argc,
+ node::ffi::FastFFIType result,
+ node::ffi::FastFFITrampoline* out);
 voidnode_ffi_free_fast_trampoline(node::ffi::FastFFITrampoline* trampoline);
 }
 

src/ffi/platforms/arm64.cc

@@ -81,6 +81,14 @@ uint32_t LdrXSp(unsigned reg, unsigned offset) {
 return0xf94003e0 | ((offset / 8) << 10) | reg;
 }
 
+uint32_tLdrbW(unsigned dst, unsigned base) {
+return0x39400000 | (base << 5) | dst;
+}
+
+uint32_tCbzW(unsigned reg, unsigned instruction_offset) {
+return0x34000000 | ((instruction_offset & 0x7ffff) << 5) | reg;
+}
+
 uint32_tMovzW(unsigned dst, uint16_t value) {
 // Load a small immediate into a W register. The buffer helper's argument
 // index is uint32_t, but current Fast API signatures are capped well below
@@ -213,14 +221,15 @@ bool ProtectCode(void* code, size_t code_size) {
 } // namespace
 
 extern"C"boolnode_ffi_create_fast_trampoline(
-void* target,
+const node::ffi::FastFFITrampolineConfig& config,
 const node::ffi::FastFFIType* args,
 size_t argc,
  node::ffi::FastFFIType result,
  node::ffi::FastFFITrampoline* out) {
 // Null inputs mean the caller cannot safely create executable code for this
 // signature. Report rejection so the generic FFI path can be used instead.
-if (target == nullptr || out == nullptr) {
+if (config.target == nullptr || config.closed == nullptr ||
+ config.isolate == nullptr || out == nullptr) {
 returnfalse;
  }
 
@@ -275,6 +284,24 @@ extern "C" bool node_ffi_create_fast_trampoline(
 // call can return through this generated trampoline safely.
  *cursor++ = kStpFpLrPreIndex;
 
+// Fast calls bypass DynamicLibrary::InvokeFunction, so check the stable
+// FFIFunction::closed flag before touching the target address. The open
+// branch is the hot path. On close, schedule the standard JS exception and
+// return; V8 checks for pending exceptions after Fast API calls.
+EmitLoadX16(&cursor, reinterpret_cast<uintptr_t>(config.closed));
+ *cursor++ = LdrbW(17, 16);
+uint32_t* open_branch = cursor++;
+EmitLoadX16(&cursor, reinterpret_cast<uintptr_t>(config.isolate));
+ *cursor++ = MovX(0, 16);
+EmitLoadX16(
+ &cursor, reinterpret_cast<uintptr_t>(node_ffi_fast_library_closed));
+ *cursor++ = kBlrX16;
+ *cursor++ = MovX(0, 31);
+ *cursor++ = kLdpFpLrPostIndex;
+ *cursor++ = kRet;
+ *open_branch =
+CbzW(17, static_cast<unsigned>(cursor - open_branch));
+
 if (has_buffer_args) {
 // Buffer conversion calls a C++ helper before the target call, so spill all
 // incoming GP registers that may be clobbered by that helper.
@@ -361,7 +388,7 @@ extern "C" bool node_ffi_create_fast_trampoline(
 
 // Tail of the trampoline: load the actual library symbol address and call it
 // with arguments now arranged according to the native ABI.
-EmitLoadX16(&cursor, reinterpret_cast<uintptr_t>(target));
+EmitLoadX16(&cursor, reinterpret_cast<uintptr_t>(config.target));
  *cursor++ = kBlrX16;
 
 if (has_buffer_args) {
@@ -414,7 +441,7 @@ extern "C" void node_ffi_free_fast_trampoline(
  !(defined(__riscv) && __riscv_xlen == 64) && !defined(__s390x__)
 
 extern"C"boolnode_ffi_create_fast_trampoline(
-void* target,
+const node::ffi::FastFFITrampolineConfig& config,
 const node::ffi::FastFFIType* args,
 size_t argc,
  node::ffi::FastFFIType result,

src/ffi/platforms/loong64.cc

@@ -74,12 +74,12 @@ void FreeCode(void* code, size_t code_size) {
 } // namespace
 
 extern"C"boolnode_ffi_create_fast_trampoline(
-void* target,
+const node::ffi::FastFFITrampolineConfig& config,
 const node::ffi::FastFFIType* args,
 size_t argc,
  node::ffi::FastFFIType result,
  node::ffi::FastFFITrampoline* out) {
-if (target == nullptr || out == nullptr || IsNarrowType(result)) {
+if (config.target == nullptr || out == nullptr || IsNarrowType(result)) {
 returnfalse;
  }
 
@@ -126,7 +126,7 @@ extern "C" bool node_ffi_create_fast_trampoline(
 Emit32(&cursor, LdD(12, 12, 16)); // ld.d t0, t0, literal
 Emit32(&cursor, Jirl(0, 12, 0)); // jr t0
 Emit32(&cursor, Or(0, 0, 0)); // nop; align literal to 8 bytes
-Emit64(&cursor, reinterpret_cast<uintptr_t>(target));
+Emit64(&cursor, reinterpret_cast<uintptr_t>(config.target));
 
 constsize_t written = reinterpret_cast<uint8_t*>(cursor) -
 static_cast<uint8_t*>(code);