MemoryImageSlot doesn't handle the case where RuntimeLinearMemory::byte_size is not host page-aligned

[sunshowers]

Discovered this while working on #9652.

Looking at LocalMemory::new:

wasmtime/crates/wasmtime/src/runtime/vm/memory.rs

Lines 484 to 487 in bc656c7

	let mut slot = MemoryImageSlot::create(
	alloc.base_ptr().cast(),
	alloc.byte_size(),
	alloc.byte_capacity(),

It passes in alloc.byte_size() as the accessible parameter to MemoryImageSlot::create:

wasmtime/crates/wasmtime/src/runtime/vm/cow.rs

Lines 337 to 345 in bc656c7

	pub(crate) fn create(base_addr: *mut c_void, accessible: usize, static_size: usize) -> Self {
	MemoryImageSlot {
	base: NonNull::new(base_addr.cast()).unwrap().into(),
	static_size,
	accessible,
	image: None,
	dirty: false,
	clear_on_drop: true,
	}

self.accessible is not rounded up to the host page size and is instead stored directly. But other places assume that self.accessible is page-aligned, for example:

wasmtime/crates/wasmtime/src/runtime/vm/cow.rs

Line 425 in bc656c7

self.set_protection(self.accessible..initial_size_bytes_page_aligned, true)?;

This ends up resolving to mprotect:

wasmtime/crates/wasmtime/src/runtime/vm/sys/unix/vm.rs

Lines 9 to 11 in bc656c7

	pub unsafe fn expose_existing_mapping(ptr: *mut u8, len: usize) -> io::Result<()> {
	mprotect(ptr.cast(), len, MprotectFlags::READ | MprotectFlags::WRITE)?;
	Ok(())

mprotect requires that its address is page-aligned, and will produce an EINVAL if it isn't.

I think there are likely also places where it panics or possibly even causes UB.

[sunshowers]

In Zulip we decided to:

• for now, skip attempting to do CoW if byte_size is smaller than the host page size
• in the future, extend MemoryImageSlot to track both the accessible size and a rounded-up form of it.