[hwasan] Add report for wild frees.

[fmayer]

cosmetic change

[fmayer]

rebase

[fmayer]

rebase

[fmayer]

also cover realloc

[eugenis]

From the user PoV, wild-free is not different from invalid-free, and the extra info in the invalid-free reports helps. It's useful to know that the bad free-ed pointer is actually a stack pointer, or maybe a valid heap pointer + 4 bytes, or something like that.

If the concern is with the shadow access in ReportInvalidFree overflowing, that can be checked.

[fmayer]

report wild free as invalid free.

[fmayer]

add test case for free() on shadow memory.

[fmayer]

In D107577#2935501, @eugenis wrote:

From the user PoV, wild-free is not different from invalid-free, and the extra info in the invalid-free reports helps. It's useful to know that the bad free-ed pointer is actually a stack pointer, or maybe a valid heap pointer + 4 bytes, or something like that.

If the concern is with the shadow access in ReportInvalidFree overflowing, that can be checked.

Done.

[fmayer]

simplify condition

[eugenis]

Add a test case for something like free(malloc() + 4) - it should include the original allocation info.

compiler-rt/lib/hwasan/hwasan_allocator.cpp

214

Merge this with the previous if() block.

compiler-rt/lib/hwasan/hwasan_checks.h

70 ↗

(On Diff #365726)

Why? This is implied by the following check.

[fmayer]

address comments

[fmayer]

In D107577#2940461, @eugenis wrote:

Add a test case for something like free(malloc() + 4) - it should include the original allocation info.

Thanks! Added test and fixed division by null triggered by this.

compiler-rt/lib/hwasan/hwasan_checks.h

70 ↗

(On Diff #365726)

Ah yes of course, with sz > 0 you are correct.

This was to make sure we don't try to access memory that's not mapped (so it should not have shadow memory).

[eugenis]

LGTM

[hctim]

compiler-rt/lib/hwasan/hwasan_allocator.cpp

207

This is now an mmap -> copy of secondary metadata -> O(n) walk of the secondary on each secondary-deallocation.

For performance reasons, I think we should only do this for the primary (guard with allocator.FromPrimary(..)). Secondary invalid-free is possible, but requires some changes to the secondary allocator itself.

compiler-rt/lib/hwasan/hwasan_allocator.cpp

static bool PointerAndMemoryTagsMatch(void *tagged_ptr) {
   tag_t mem_tag = *reinterpret_cast<tag_t *>(
       MemToShadow(reinterpret_cast<uptr>(UntagPtr(tagged_ptr))));
   return PossiblyShortTagMatches(mem_tag, tagged_uptr, 1);
 }
 
 static void HwasanDeallocate(StackTrace *stack, void *tagged_ptr) {
   CHECK(tagged_ptr);
   HWASAN_FREE_HOOK(tagged_ptr);
+  void *untagged_ptr = InTaggableRegion(reinterpret_cast<uptr>(tagged_ptr))
+                           ? UntagPtr(tagged_ptr)
+                           : tagged_ptr;
+  if (!allocator.PointerIsMine(untagged_ptr))
+    ReportWildFree(stack,
+                   reinterpret_cast<uptr>(untagged_ptr));  // does not return.
 
   if (!PointerAndMemoryTagsMatch(tagged_ptr))
     ReportInvalidFree(stack, reinterpret_cast<uptr>(tagged_ptr));
 
-  void *untagged_ptr = InTaggableRegion(reinterpret_cast<uptr>(tagged_ptr))
-                           ? UntagPtr(tagged_ptr)
-                           : tagged_ptr;
   void *aligned_ptr = reinterpret_cast<void *>(
       RoundDownTo(reinterpret_cast<uptr>(untagged_ptr), kShadowAlignment));
   tag_t pointer_tag = GetTagFromPointer(reinterpret_cast<uptr>(tagged_ptr));
   Metadata *meta =
       reinterpret_cast<Metadata *>(allocator.GetMetaData(aligned_ptr));
   uptr orig_size = meta->get_requested_size();
   u32 free_context_id = StackDepotPut(*stack);
   u32 alloc_context_id = meta->alloc_context_id;

compiler-rt/lib/hwasan/hwasan_report.h

 void ReportStats();
 void ReportTagMismatch(StackTrace *stack, uptr addr, uptr access_size,
                        bool is_store, bool fatal, uptr *registers_frame);
 void ReportInvalidFree(StackTrace *stack, uptr addr);
 void ReportTailOverwritten(StackTrace *stack, uptr addr, uptr orig_size,
                            const u8 *expected);
 void ReportRegisters(uptr *registers_frame, uptr pc);
 void ReportAtExitStatistics();
-
+void ReportWildFree(StackTrace *stack, uptr addr);
 
 }  // namespace __hwasan
 
 #endif  // HWASAN_REPORT_H

compiler-rt/lib/hwasan/hwasan_report.cpp

void ReportRegisters(uptr *frame, uptr pc) {
   Printf("    x24 %016llx  x25 %016llx  x26 %016llx  x27 %016llx\n",
        frame[24], frame[25], frame[26], frame[27]);
   // hwasan_check* reduces the stack pointer by 256, then __hwasan_tag_mismatch
   // passes it to this function.
   Printf("    x28 %016llx  x29 %016llx  x30 %016llx   sp %016llx\n", frame[28],
          frame[29], frame[30], reinterpret_cast<u8 *>(frame) + 256);
 }
 
+void ReportWildFree(StackTrace *stack, uptr untagged_addr) {
+  ScopedReport report(/*fatal=*/true);
+  uptr pc = GetTopPc(stack);
+  const Thread *thread = GetCurrentThread();
+  if (thread) {
+    Report("ERROR: %s: wild-free on address %p at pc %p on thread T%zd\n",
+           SanitizerToolName, untagged_addr, pc, thread->unique_id());
+  } else {
+    Report("ERROR: %s: wild-free on address %p at pc %p on unknown thread\n",
+           SanitizerToolName, untagged_addr, pc);
+  }
+  stack->Print();
+}
+
 }  // namespace __hwasan
 
 void __hwasan_set_error_report_callback(void (*callback)(const char *)) {
   __hwasan::ScopedReport::SetErrorReportCallback(callback);
 }

compiler-rt/test/hwasan/TestCases/wild-free.c

+// RUN: %clang_hwasan %s -o %t && not %run %t 2>&1 | FileCheck %s
+// REQUIRES: stable-runtime
+
+#include <stdlib.h>
+
+int main() {
+  char *p = (char *)malloc(1);
+  free(p + 0x10000000000);
+  // CHECK: ERROR: HWAddressSanitizer: wild-free on address {{.*}} at pc {{[0x]+}}[[PC:.*]] on thread T{{[0-9]+}}
+  // CHECK: #0 {{[0x]+}}{{.*}}[[PC]] in free
+  // CHECK: #1 {{.*}} in main {{.*}}wild-free.c:[[@LINE-3]]
+  // CHECK-NOT: Segmentation fault
+  // CHECK-NOT: SIGSEGV
+  return 0;
+}