sanitizer_common: use permanent pipes for checking memory ranges

[azat]

Summary

Otherwise if RLIMIT_NOFILE exceeds the UBsan reports false-positive
reports, because it cannot correctly check types:

pipe() <-- fails on EMFILE and IsAccessibleMemoryRange() returns false
__sanitizer::IsAccessibleMemoryRange(unsigned long, unsigned long)
__ubsan::checkDynamicType(void*, void*, unsigned long) + 271
HandleDynamicTypeCacheMiss(__ubsan::DynamicTypeCacheMissData*, unsigned long, unsigned long, __ubsan::ReportOptions) + 34
__ubsan_handle_dynamic_type_cache_miss_abort + 58

But there are some issues with this patch, first of all it will leave
pair of file descriptors in each thread, although it initialize them
lazily.
Another option is to simply ignore pipe() error, i.e. return true from
IsAccessibleMemoryRange() instead of false (like was before this patch).

And also it uses global destructor, and there is a compile warning
(although I saw other places in compiler-rt that does this, i.e.
compiler-rt/lib/asan/asan_posix.cpp).
But, if this is not a good thing to go, this can be fixed by using some
initialize and destructor.

v2: tried /dev/null
v3: read data from pipe to avoid stall
v4: add a test for pipe capacity exceed
v5: thread local
v6: test with RLIMIT_NOFILE
v7: ignore unavailable pipe errors

[vitalybuka]

Please clang-format

[vitalybuka]

Would you be able to create lit-test case which demonstrates RLIMIT_NOFILE problem?

[azat]

Please clang-format

@vitalybuka I've created the diff by intention w/ --nolint option since the difference was too huge (and even code around was touched in the test files, in particular list of includes), so I though that clang-format does not properly configured, but OK I will resubmit with clang-format applied.

Would you be able to create lit-test case which demonstrates RLIMIT_NOFILE problem?

Sure, it is already there, take a look at IsAccessibleMemoryRange_NOFILE test.

[azat]

Run clang-format

[azat]

Run clang-format (via git clang-format instead of arc --lint, since later is not complete)

compiler-rt/lib/sanitizer_common/sanitizer_posix_libcdep.cpp

#endif  // __powerpc__
   // unaligned memory access.
   auto si = static_cast<const siginfo_t *>(siginfo);
   return IsStackAccess &&
          (si->si_code == si_SEGV_MAPERR || si->si_code == si_SEGV_ACCERR);
 }
 
 #endif  // SANITIZER_GO
 
+namespace {
+struct ScopedPipe {
+  ScopedPipe(const ScopedPipe &) = delete;
+  ScopedPipe(const ScopedPipe &&) = delete;
+  ScopedPipe() = default;
+  ~ScopedPipe() {
+    if (pair_[0] != -1)
+      internal_close(pair_[0]);
+    if (pair_[1] != -1)
+      internal_close(pair_[1]);
+    UnmapOrDie(buffer_, bufferSize());
+  }
+  bool initialize() {
+    if (pair_[0] == -1 && pipe(pair_) == -1)
+      return false;
+    if (!buffer_)
+      buffer_ = (char *)MmapOrDie(bufferSize(), __func__);
+    return true;
+  }
+  int get(size_t i) const { return pair_[i]; }
+  char *buffer() const { return buffer_; }
+
+  static size_t bufferSize() { return GetPageSizeCached() * 10; }
+
+ private:
+  char *buffer_ = nullptr;
+  int pair_[2] = {-1, -1};
+};
+
+thread_local ScopedPipe memory_range_pipe;
+}  // namespace
+
 bool IsAccessibleMemoryRange(uptr beg, uptr size) {
-  uptr page_size = GetPageSizeCached();
   // Checking too large memory ranges is slow.
-  CHECK_LT(size, page_size * 10);
-  int sock_pair[2];
-  if (pipe(sock_pair))
-    return false;
+  CHECK_LT(size, ScopedPipe::bufferSize());
+  // If pipe is not available, ignore access check to avoid false-positive.
+  if (!memory_range_pipe.initialize())
+    return true;
   uptr bytes_written =
-      internal_write(sock_pair[1], reinterpret_cast<void *>(beg), size);
+      internal_write(memory_range_pipe.get(1), reinterpret_cast<void *>(beg), size);
   int write_errno;
   bool result;
   if (internal_iserror(bytes_written, &write_errno)) {
     CHECK_EQ(EFAULT, write_errno);
     result = false;
   } else {
     result = (bytes_written == size);
+    internal_read(memory_range_pipe.get(1), memory_range_pipe.buffer(), bytes_written);
   }
-  internal_close(sock_pair[0]);
-  internal_close(sock_pair[1]);
   return result;
 }
 
 void PlatformPrepareForSandboxing(__sanitizer_sandbox_arguments *args) {
   // Some kinds of sandboxes may forbid filesystem access, so we won't be able
   // to read the file mappings from /proc/self/maps. Luckily, neither the
   // process will be able to load additional libraries, so it's fine to use the
   // cached mappings.

compiler-rt/lib/sanitizer_common/tests/sanitizer_posix_test.cpp

 //===-- sanitizer_posix_test.cpp ------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //
 // Tests for POSIX-specific code.
 //
 //===----------------------------------------------------------------------===//
 
 #include "sanitizer_common/sanitizer_platform.h"
 #if SANITIZER_POSIX
 
-#include "sanitizer_common/sanitizer_common.h"
-#include "gtest/gtest.h"
-
-#include <pthread.h>
-#include <sys/mman.h>
+#  include <fcntl.h>
+#  include <pthread.h>
+#  include <sys/mman.h>
+#  include <sys/resource.h>
+
+#  include "gtest/gtest.h"
+#  include "sanitizer_common/sanitizer_common.h"
 
 namespace __sanitizer {
 
 static pthread_key_t key;
 static bool destructor_executed;
 
 extern "C"
 void destructor(void *arg) {
TEST(SanitizerCommon, IsAccessibleMemoryRange) {
   EXPECT_TRUE(IsAccessibleMemoryRange(mem, page_size));
   EXPECT_FALSE(IsAccessibleMemoryRange(mem, page_size + 1));
   EXPECT_TRUE(IsAccessibleMemoryRange(mem + page_size - 1, 1));
   EXPECT_FALSE(IsAccessibleMemoryRange(mem + page_size - 1, 2));
   EXPECT_FALSE(IsAccessibleMemoryRange(mem + 2 * page_size - 1, 1));
   EXPECT_TRUE(IsAccessibleMemoryRange(mem + 2 * page_size, page_size));
   EXPECT_FALSE(IsAccessibleMemoryRange(mem, 3 * page_size));
   EXPECT_FALSE(IsAccessibleMemoryRange(0x0, 2));
+
+  // No stuck even if pipe capaciity exceeds.
+  for (size_t i = 0; i < 32 << 10; ++i) EXPECT_FALSE(IsAccessibleMemoryRange(0x0, 2));
+}
+
+TEST(SanitizerCommon, IsAccessibleMemoryRange_NOFILE) {
+  const int page_size = GetPageSize();
+  uptr mem = (uptr)mmap(0, 3 * page_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+  // Protect the middle page.
+  mprotect((void *)(mem + page_size), page_size, PROT_NONE);
+  EXPECT_TRUE(IsAccessibleMemoryRange(mem, page_size - 1));
+  EXPECT_FALSE(IsAccessibleMemoryRange(mem, page_size + 1));
+
+  // Use ASSERT_DEATH to change RLIMIT_NOFILE in child
+  ASSERT_DEATH(
+      {
+        int fd = open("/dev/null", O_WRONLY);
+        close(fd);
+
+        rlimit rlim{};
+        rlim.rlim_cur = rlim.rlim_max = fd;
+        int rc = setrlimit(RLIMIT_NOFILE, &rlim);
+        ASSERT_EQ(rc, 0);
+
+        fd = open("/dev/null", O_WRONLY);
+        ASSERT_EQ(fd, -1);
+        ASSERT_EQ(errno, EMFILE);
+
+        ASSERT_TRUE(IsAccessibleMemoryRange(mem, page_size - 1));
+        ASSERT_FALSE(IsAccessibleMemoryRange(mem, page_size + 1));
+
+        _Exit(1);
+      },
+      ".*" /* failed ASSERT will raise "illegal return in test statement." anyway */);
 }
 
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_POSIX