[esan] Add handling of large stack size rlimits

[bruening]

Summary

Adds detection of large stack size rlimits (over 1 TB or unlimited), which
results in an mmap location that our shadow mapping does not support. We
re-exec the application in this situation. Adds a test of this behavior.

Adds general detection of mmap regions outside of our app regions. In the
future we want to try to adaptively handle these but for now we abort.

Moves the existing Linux-specific mmap code into a platform-specific file
where the new rlimit code lives.

[eugenis]

lib/esan/CMakeLists.txt

21 ↗

(On Diff #58825)

You append esan_linux.cpp to the list, but it's already in it.
Also, we usually do it in the source like this:
#include "sanitizer_common/sanitizer_platform.h"
#if SANITIZER_FREEBSD || SANITIZER_LINUX

lib/esan/esan_linux.cpp

47 ↗

(On Diff #58825)

MSan handles this by mprotect-ing all regions that don't have a shadow mapping, and then the kernel takes care of the rest. Is it hard to do here because of the variable shadow scale?

lib/esan/esan_shadow.h

44 ↗

(On Diff #58825)

typo: Linux

[bruening]

lib/esan/CMakeLists.txt

21 ↗

(On Diff #58825)

This is cmake, though. This is following how tsan adds tsan_platform_linux.cc (well tsan doesn't leave the file in the main list too ;)). Is there a cmake variable set in a parent file distinguishing Linux from BSD?

lib/esan/esan_linux.cpp

47 ↗

(On Diff #58825)

I don't see how that stops a MAP_FIXED mmap?

[bruening]

lib/esan/CMakeLists.txt

21 ↗

(On Diff #58825)

Or are you suggesting to not say "assume linux" here, and have the source file say "#if SANITIZER_LINUX" if it really won't work on BSD (should prob be _posix if it works on BSD)?

[eugenis]

lib/esan/CMakeLists.txt

21 ↗

(On Diff #58825)

Hm, I don't see why this cmake change would be necessary if the C++ source had the proper guards. The TSan thing could be legacy.

lib/esan/esan_linux.cpp

47 ↗

(On Diff #58825)

Right, it does not. Actually, MSan does not check this condition well enough - it used to have a simple mapping where if was sufficient to only check the start address, but now it can let through an invalid mmap...

[eugenis]

lib/esan/CMakeLists.txt

21 ↗

(On Diff #58825)

I'm saying that you should not need this cmake logic at all.

Regarding BSD code, I think it is generally in *_linux files, because they are so similar.

[bruening]

Switch to using guards on the platform-specific file.

[eugenis]

LGTM

compiler-rt/trunk/lib/esan/CMakeLists.txt

 # Build for the EfficiencySanitizer runtime support library.
 
 add_custom_target(esan)
 
 set(ESAN_RTL_CFLAGS ${SANITIZER_COMMON_CFLAGS})
 append_rtti_flag(OFF ESAN_RTL_CFLAGS)
 
 include_directories(..)
 
 set(ESAN_SOURCES
   esan.cpp
   esan_flags.cpp
   esan_interface.cpp
   esan_interceptors.cpp
+  esan_linux.cpp
   cache_frag.cpp
   working_set.cpp)
 
 foreach (arch ${ESAN_SUPPORTED_ARCH})
   add_compiler_rt_runtime(clang_rt.esan
     STATIC
     ARCHS ${arch}
     SOURCES ${ESAN_SOURCES}

compiler-rt/trunk/lib/esan/esan.h

 //   - Platform specific headers included only into platform-specific files (*).
 //
 //  (*) Except when inlining is critical for performance.
 //===----------------------------------------------------------------------===//
 
 #ifndef ESAN_H
 #define ESAN_H
 
+#include "interception/interception.h"
 #include "sanitizer_common/sanitizer_common.h"
 #include "esan_interface_internal.h"
 
 namespace __esan {
 
 extern bool EsanIsInitialized;
 
 extern ToolType WhichTool;
 
 void initializeLibrary(ToolType Tool);
 int finalizeLibrary();
 // Esan creates the variable per tool per compilation unit at compile time
 // and passes its pointer Ptr to the runtime library.
 void processCompilationUnitInit(void *Ptr);
 void processCompilationUnitExit(void *Ptr);
 void processRangeAccess(uptr PC, uptr Addr, int Size, bool IsWrite);
 void initializeInterceptors();
 
+// Platform-dependent routines.
+void verifyAddressSpace();
+bool fixMmapAddr(void **Addr, SIZE_T Size, int Flags);
+uptr checkMmapResult(uptr Addr, SIZE_T Size);
+
 } // namespace __esan
 
 #endif // ESAN_H

compiler-rt/trunk/lib/esan/esan.cpp

for (int i = 0; getShadowRegion(i, &ShadowAStart, &ShadowAEnd); ++i) {
       }
     }
   }
   return true;
 }
 #endif
 
 static void initializeShadow() {
+  verifyAddressSpace();
+
   DCHECK(verifyShadowScheme());
 
   Mapping.initialize(ShadowScale[WhichTool]);
 
   VPrintf(1, "Shadow scale=%d offset=%p\n", Mapping.Scale, Mapping.Offset);
 
   uptr ShadowStart, ShadowEnd;
   for (int i = 0; getShadowRegion(i, &ShadowStart, &ShadowEnd); ++i) {

compiler-rt/trunk/lib/esan/esan_interceptors.cpp

 #include "esan_shadow.h"
 #include "interception/interception.h"
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_libc.h"
 #include "sanitizer_common/sanitizer_stacktrace.h"
 
 using namespace __esan; // NOLINT
 
-// FIXME: if this gets more complex as more platforms are added we may
-// want to split pieces into separate platform-specific files.
-#if SANITIZER_LINUX
-// Sanitizer runtimes in general want to avoid including system headers.
-// We define the few constants we need here:
-const int EINVAL = 22; // from /usr/include/asm-generic/errno-base.h
-const int MAP_FIXED = 0x10; // from /usr/include/sys/mman.h
-extern "C" int *__errno_location();
-#define errno (*__errno_location())
-#else
-#error Other platforms are not yet supported.
-#endif
-
 #define CUR_PC() (StackTrace::GetCurrentPc())
 
 //===----------------------------------------------------------------------===//
 // Interception via sanitizer common interceptors
 //===----------------------------------------------------------------------===//
 
 // Get the per-platform defines for what is possible to intercept
 #include "sanitizer_common/sanitizer_platform_interceptors.h"

 
 //===----------------------------------------------------------------------===//
 // Shadow-related interceptors
 //===----------------------------------------------------------------------===//
 
 // These are candidates for sharing with all sanitizers if shadow memory
 // support is also standardized.
 
-static bool fixMmapAddr(void **addr, SIZE_T sz, int flags) {
-  if (*addr) {
-    uptr AppStart, AppEnd;
-    bool SingleApp = false;
-    for (int i = 0; getAppRegion(i, &AppStart, &AppEnd); ++i) {
-      if ((uptr)*addr >= AppStart && (uptr)*addr + sz - 1 <= AppEnd) {
-        SingleApp = true;
-        break;
-      }
-    }
-    if (!SingleApp) {
-      VPrintf(1, "mmap conflict: [%p-%p) is not in an app region\n",
-              *addr, (uptr)*addr + sz);
-      if (flags & MAP_FIXED) {
-        errno = EINVAL;
-        return false;
-      } else {
-        *addr = 0;
-      }
-    }
-  }
-  return true;
-}
-
 INTERCEPTOR(void *, mmap, void *addr, SIZE_T sz, int prot, int flags,
                  int fd, OFF_T off) {
   if (!fixMmapAddr(&addr, sz, flags))
     return (void *)-1;
-  return REAL(mmap)(addr, sz, prot, flags, fd, off);
+  void *result = REAL(mmap)(addr, sz, prot, flags, fd, off);
+  return (void *)checkMmapResult((uptr)result, sz);
 }
 
 #if SANITIZER_LINUX
 INTERCEPTOR(void *, mmap64, void *addr, SIZE_T sz, int prot, int flags,
                  int fd, OFF64_T off) {
   if (!fixMmapAddr(&addr, sz, flags))
     return (void *)-1;
-  return REAL(mmap64)(addr, sz, prot, flags, fd, off);
+  void *result = REAL(mmap64)(addr, sz, prot, flags, fd, off);
+  return (void *)checkMmapResult((uptr)result, sz);
 }
 #define ESAN_MAYBE_INTERCEPT_MMAP64 INTERCEPT_FUNCTION(mmap64)
 #else
 #define ESAN_MAYBE_INTERCEPT_MMAP64
 #endif
 
 namespace __esan {
 

compiler-rt/trunk/lib/esan/esan_linux.cpp

+//===-- esan.cpp ----------------------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file is a part of EfficiencySanitizer, a family of performance tuners.
+//
+// Linux-specific code for the Esan run-time.
+//===----------------------------------------------------------------------===//
+
+#include "sanitizer_common/sanitizer_platform.h"
+#if SANITIZER_FREEBSD || SANITIZER_LINUX
+
+#include "esan.h"
+#include "esan_shadow.h"
+#include "interception/interception.h"
+#include "sanitizer_common/sanitizer_common.h"
+#include <sys/mman.h>
+#include <errno.h>
+
+namespace __esan {
+
+void verifyAddressSpace() {
+#if SANITIZER_LINUX && defined(__x86_64__)
+  // The kernel determines its mmap base from the stack size limit.
+  // Our Linux 64-bit shadow mapping assumes the stack limit is less than a
+  // terabyte, which keeps the mmap region above 0x7e00'.
+  uptr StackLimit = GetStackSizeLimitInBytes();
+  if (StackSizeIsUnlimited() || StackLimit > MaxStackSize) {
+    VReport(1, "The stack size limit is beyond the maximum supported.\n"
+            "Re-execing with a stack size below 1TB.\n");
+    SetStackSizeLimitInBytes(MaxStackSize);
+    ReExec();
+  }
+#endif
+}
+
+static bool liesWithinSingleAppRegion(uptr Start, SIZE_T Size) {
+  uptr AppStart, AppEnd;
+  for (int i = 0; getAppRegion(i, &AppStart, &AppEnd); ++i) {
+    if (Start >= AppStart && Start + Size - 1 <= AppEnd) {
+      return true;
+    }
+  }
+  return false;
+}
+
+bool fixMmapAddr(void **Addr, SIZE_T Size, int Flags) {
+  if (*Addr) {
+    if (!liesWithinSingleAppRegion((uptr)*Addr, Size)) {
+      VPrintf(1, "mmap conflict: [%p-%p) is not in an app region\n",
+              *Addr, (uptr)*Addr + Size);
+      if (Flags & MAP_FIXED) {
+        errno = EINVAL;
+        return false;
+      } else {
+        *Addr = 0;
+      }
+    }
+  }
+  return true;
+}
+
+uptr checkMmapResult(uptr Addr, SIZE_T Size) {
+  if ((void *)Addr == MAP_FAILED)
+    return Addr;
+  if (!liesWithinSingleAppRegion(Addr, Size)) {
+    // FIXME: attempt to dynamically add this as an app region if it
+    // fits our shadow criteria.
+    // We could also try to remap somewhere else.
+    Printf("ERROR: unsupported mapping at [%p-%p)\n", Addr, Addr+Size);
+    Die();
+  }
+  return Addr;
+}
+
+} // namespace __esan
+
+#endif // SANITIZER_FREEBSD || SANITIZER_LINUX

compiler-rt/trunk/lib/esan/esan_shadow.h

 // [0x00007fff'ff601000, 0x00008000'00000000) libraries + stack, part 2
 // [0xffffffff'ff600000, 0xffffffff'ff601000) vsyscall
 //
 // Although we can ignore the vsyscall for the most part as there are few data
 // references there (other sanitizers ignore it), we enforce a gap inside the
 // library region to distinguish the vsyscall's shadow, considering this gap to
 // be an invalid app region.
 // We disallow application memory outside of those 5 regions.
+// Our regions assume that the stack rlimit is less than a terabyte (otherwise
+// the Linux kernel's default mmap region drops below 0x7e00'), which we enforce
+// at init time (we can support larger and unlimited sizes for shadow
+// scaledowns, but it is difficult for 1:1 mappings).
 //
 // Our shadow memory is scaled from a 1:1 mapping and supports a scale
 // specified at library initialization time that can be any power-of-2
 // scaledown (1x, 2x, 4x, 8x, 16x, etc.).
 //
 // We model our shadow memory after Umbra, a library used by the Dr. Memory
 // tool: https://github.com/DynamoRIO/drmemory/blob/master/umbra/umbra_x64.c.
 // We use Umbra's scheme as it was designed to support different
static const struct ApplicationRegion AppRegions[] = {
   // app regions, as the mappings interleave, and the gap between the 3rd and
   // 4th scales down below a page.
   {0x00007e0000000000u,   0x00007fffff600000u, false},
   {0x00007fffff601000u,   0x0000800000000000u, true},
   {0xffffffffff600000u,   0xffffffffff601000u, true},
 };
 static const u32 NumAppRegions = sizeof(AppRegions)/sizeof(AppRegions[0]);
 
+// See the comment above: we do not currently support a stack size rlimit
+// equal to or larger than 1TB.
+static const uptr MaxStackSize = (1ULL << 40) - 4096;
+
 class ShadowMapping {
 public:
   static const uptr Mask = 0x00000fffffffffffu;
   // The scale and offset vary by tool.
   uptr Scale;
   uptr Offset;
   void initialize(uptr ShadowScale) {
     static const uptr OffsetArray[3] = {

compiler-rt/trunk/lib/sanitizer_common/sanitizer_common.h

 // Returns -1 in case of an error.
 int WaitForProcess(pid_t pid);
 
 u32 GetUid();
 void ReExec();
 char **GetArgv();
 void PrintCmdline();
 bool StackSizeIsUnlimited();
+uptr GetStackSizeLimitInBytes();
 void SetStackSizeLimitInBytes(uptr limit);
 bool AddressSpaceIsUnlimited();
 void SetAddressSpaceUnlimited();
 void AdjustStackSize(void *attr);
 void PrepareForSandboxing(__sanitizer_sandbox_arguments *args);
 void CovPrepareForSandboxing(__sanitizer_sandbox_arguments *args);
 void SetSandboxingCallback(void (*f)());
 

compiler-rt/trunk/lib/sanitizer_common/sanitizer_posix_libcdep.cc

void DisableCoreDumperIfNecessary() {
   }
 }
 
 bool StackSizeIsUnlimited() {
   rlim_t stack_size = getlim(RLIMIT_STACK);
   return (stack_size == RLIM_INFINITY);
 }
 
+uptr GetStackSizeLimitInBytes() {
+  return (uptr)getlim(RLIMIT_STACK);
+}
+
 void SetStackSizeLimitInBytes(uptr limit) {
   setlim(RLIMIT_STACK, (rlim_t)limit);
   CHECK(!StackSizeIsUnlimited());
 }
 
 bool AddressSpaceIsUnlimited() {
   rlim_t as_size = getlim(RLIMIT_AS);
   return (as_size == RLIM_INFINITY);

compiler-rt/trunk/test/esan/TestCases/large-stack-linux.c

+// RUN: %clang_esan_wset -O0 %s -o %t 2>&1
+// RUN: %env_esan_opts=verbosity=1 %run %t %t 2>&1 | FileCheck %s
+
+#include <assert.h>
+#include <stdio.h>
+#include <sys/mman.h>
+#include <sys/resource.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+
+static void testChildStackLimit(rlim_t StackLimit, char *ToRun) {
+  int Res;
+  struct rlimit Limit;
+  Limit.rlim_cur = RLIM_INFINITY;
+  Limit.rlim_max = RLIM_INFINITY;
+  Res = setrlimit(RLIMIT_STACK, &Limit);
+  if (Res != 0) {
+    // Probably our environment had a large limit and we ourselves got
+    // re-execed and can no longer raise our limit.
+    // We have to bail and emulate the regular test.
+    // We'd prefer to have branches in our FileCheck output to ensure the
+    // initial program was re-execed but this is the best we can do for now.
+    fprintf(stderr, "in esan::initializeLibrary\n");
+    fprintf(stderr, "==1234==The stack size limit is beyond the maximum supported.\n");
+    fprintf(stderr, "Re-execing with a stack size below 1TB.\n");
+    fprintf(stderr, "in esan::initializeLibrary\n");
+    fprintf(stderr, "done\n");
+    fprintf(stderr, "in esan::finalizeLibrary\n");
+    return;
+  }
+
+  pid_t Child = fork();
+  assert(Child >= 0);
+  if (Child > 0) {
+    pid_t WaitRes = waitpid(Child, NULL, 0);
+    assert(WaitRes == Child);
+  } else {
+    char *Args[2];
+    Args[0] = ToRun;
+    Args[1] = NULL;
+    Res = execv(ToRun, Args);
+    assert(0); // Should not be reached.
+  }
+}
+
+int main(int argc, char *argv[]) {
+  // The path to the program to exec must be passed in the first time.
+  if (argc == 2) {
+    fprintf(stderr, "Testing child with infinite stack\n");
+    testChildStackLimit(RLIM_INFINITY, argv[1]);
+    fprintf(stderr, "Testing child with 1TB stack\n");
+    testChildStackLimit(1ULL << 40, argv[1]);
+  }
+  fprintf(stderr, "done\n");
+  // CHECK:      in esan::initializeLibrary
+  // CHECK:      Testing child with infinite stack
+  // CHECK-NEXT: in esan::initializeLibrary
+  // CHECK-NEXT: =={{[0-9]+}}==The stack size limit is beyond the maximum supported.
+  // CHECK-NEXT: Re-execing with a stack size below 1TB.
+  // CHECK-NEXT: in esan::initializeLibrary
+  // CHECK:      done
+  // CHECK:      in esan::finalizeLibrary
+  // CHECK:      Testing child with 1TB stack
+  // CHECK-NEXT: in esan::initializeLibrary
+  // CHECK-NEXT: =={{[0-9]+}}==The stack size limit is beyond the maximum supported.
+  // CHECK-NEXT: Re-execing with a stack size below 1TB.
+  // CHECK-NEXT: in esan::initializeLibrary
+  // CHECK:      done
+  // CHECK-NEXT: in esan::finalizeLibrary
+  // CHECK:      done
+  // CHECK-NEXT: in esan::finalizeLibrary
+  return 0;
+}

compiler-rt/trunk/test/esan/TestCases/mmap-shadow-conflict.c

int main(int argc, char **argv) {
   if (Map == (void *)-1)
     fprintf(stderr, "map failed\n");
   else
     fprintf(stderr, "mapped %p\n", Map);
   Map = mmap((void *)0x0000016000000000ULL, 0x1000, PROT_READ,
                    MAP_ANON|MAP_PRIVATE, -1, 0);
   fprintf(stderr, "mapped %p\n", Map);
   // CHECK:      in esan::initializeLibrary
-  // CHECK-NEXT: Shadow scale=2 offset=0x440000000000
+  // (There can be a re-exec for stack limit here.)
+  // CHECK:      Shadow scale=2 offset=0x440000000000
   // CHECK-NEXT: Shadow #0: [110000000000-114000000000) (256GB)
   // CHECK-NEXT: Shadow #1: [124000000000-12c000000000) (512GB)
   // CHECK-NEXT: Shadow #2: [148000000000-150000000000) (512GB)
   // CHECK-NEXT: mmap conflict: {{.*}}
   // CHECK-NEXT: map failed
   // CHECK-NEXT: mmap conflict: {{.*}}
   // CHECK-NEXT: mapped {{.*}}
   // CHECK-NEXT: in esan::finalizeLibrary
   return 0;
 }

compiler-rt/trunk/test/esan/TestCases/verbose-simple.c

 // RUN: %clang_esan_frag -O0 %s -o %t 2>&1
 // RUN: %env_esan_opts=verbosity=1 %run %t 2>&1 | FileCheck %s
 
 int main(int argc, char **argv) {
   // CHECK:      in esan::initializeLibrary
-  // CHECK-NEXT: Shadow scale=2 offset=0x440000000000
+  // (There can be a re-exec for stack limit here.)
+  // CHECK:      Shadow scale=2 offset=0x440000000000
   // CHECK-NEXT: Shadow #0: [110000000000-114000000000) (256GB)
   // CHECK-NEXT: Shadow #1: [124000000000-12c000000000) (512GB)
   // CHECK-NEXT: Shadow #2: [148000000000-150000000000) (512GB)
   // CHECK-NEXT: in esan::finalizeLibrary
   // CHECK-NEXT: {{.*}}EfficiencySanitizer is not finished: nothing yet to report
   return 0;
 }

compiler-rt/trunk/test/esan/TestCases/workingset-memset.cpp

 // RUN: %clang_esan_wset -O0 %s -o %t 2>&1
 // RUN: %run %t 2>&1 | FileCheck %s
 
 #include <stdlib.h>
 #include <string.h>
 #include <sys/mman.h>
 #include <assert.h>
 #include <string.h>
 
 int main(int argc, char **argv) {
-  const int iters = 630;
-  const int size = 64*iters;
-  char *p = (char *)malloc(size);
+  const int size = 128*1024*1024;
+  char *p = (char *)mmap(0, size, PROT_READ | PROT_WRITE,
+                         MAP_ANON | MAP_PRIVATE, -1, 0);
   // Test the slowpath at different cache line boundaries.
   for (int i = 0; i < 630; i++)
     memset((char *)p + 63*i, i, 63*i);
+  munmap(p, size);
   return 0;
   // FIXME: once the memory scan and size report is in place add it here.
   // CHECK: {{.*}}EfficiencySanitizer is not finished: nothing yet to report
 }