[hwasan] Add report for wild frees.

[fmayer]

cosmetic change

[fmayer]

rebase

[fmayer]

rebase

[fmayer]

also cover realloc

[eugenis]

From the user PoV, wild-free is not different from invalid-free, and the extra info in the invalid-free reports helps. It's useful to know that the bad free-ed pointer is actually a stack pointer, or maybe a valid heap pointer + 4 bytes, or something like that.

If the concern is with the shadow access in ReportInvalidFree overflowing, that can be checked.

[fmayer]

report wild free as invalid free.

[fmayer]

add test case for free() on shadow memory.

[fmayer]

In D107577#2935501, @eugenis wrote:

From the user PoV, wild-free is not different from invalid-free, and the extra info in the invalid-free reports helps. It's useful to know that the bad free-ed pointer is actually a stack pointer, or maybe a valid heap pointer + 4 bytes, or something like that.

If the concern is with the shadow access in ReportInvalidFree overflowing, that can be checked.

Done.

[fmayer]

simplify condition

[eugenis]

Add a test case for something like free(malloc() + 4) - it should include the original allocation info.

compiler-rt/lib/hwasan/hwasan_allocator.cpp

212

Merge this with the previous if() block.

compiler-rt/lib/hwasan/hwasan_checks.h

70

Why? This is implied by the following check.

[fmayer]

address comments

[fmayer]

In D107577#2940461, @eugenis wrote:

Add a test case for something like free(malloc() + 4) - it should include the original allocation info.

Thanks! Added test and fixed division by null triggered by this.

compiler-rt/lib/hwasan/hwasan_checks.h

70

Ah yes of course, with sz > 0 you are correct.

This was to make sure we don't try to access memory that's not mapped (so it should not have shadow memory).

[eugenis]

LGTM

[hctim]

compiler-rt/lib/hwasan/hwasan_allocator.cpp

207

This is now an mmap -> copy of secondary metadata -> O(n) walk of the secondary on each secondary-deallocation.

For performance reasons, I think we should only do this for the primary (guard with allocator.FromPrimary(..)). Secondary invalid-free is possible, but requires some changes to the secondary allocator itself.

compiler-rt/lib/hwasan/hwasan_allocator.cpp

static bool PointerAndMemoryTagsMatch(void *tagged_ptr) {
   uptr tagged_uptr = reinterpret_cast<uptr>(tagged_ptr);
   if (!InTaggableRegion(tagged_uptr))
     return true;
   tag_t mem_tag = *reinterpret_cast<tag_t *>(
       MemToShadow(reinterpret_cast<uptr>(UntagPtr(tagged_ptr))));
   return PossiblyShortTagMatches(mem_tag, tagged_uptr, 1);
 }
 
-static void HwasanDeallocate(StackTrace *stack, void *tagged_ptr) {
-  CHECK(tagged_ptr);
-  HWASAN_FREE_HOOK(tagged_ptr);
+static bool CheckInvalidFree(StackTrace *stack, void *untagged_ptr,
+                             void *tagged_ptr) {
+  // This function can return true if halt_on_error is false.
+  if (!allocator.PointerIsMine(untagged_ptr)) {
+    ReportInvalidFree(stack, reinterpret_cast<uptr>(tagged_ptr));
+    return true;
+  }
 
-  if (!PointerAndMemoryTagsMatch(tagged_ptr))
+  if (!PointerAndMemoryTagsMatch(tagged_ptr)) {
     ReportInvalidFree(stack, reinterpret_cast<uptr>(tagged_ptr));
+    return true;
+  }
+  return false;
+}
 
+static void HwasanDeallocate(StackTrace *stack, void *tagged_ptr) {
+  CHECK(tagged_ptr);
+  HWASAN_FREE_HOOK(tagged_ptr);
   void *untagged_ptr = InTaggableRegion(reinterpret_cast<uptr>(tagged_ptr))
                            ? UntagPtr(tagged_ptr)
                            : tagged_ptr;
+  if (CheckInvalidFree(stack, untagged_ptr, tagged_ptr))
+    return;
+
   void *aligned_ptr = reinterpret_cast<void *>(
       RoundDownTo(reinterpret_cast<uptr>(untagged_ptr), kShadowAlignment));
   tag_t pointer_tag = GetTagFromPointer(reinterpret_cast<uptr>(tagged_ptr));
   Metadata *meta =
       reinterpret_cast<Metadata *>(allocator.GetMetaData(aligned_ptr));
   uptr orig_size = meta->get_requested_size();
   u32 free_context_id = StackDepotPut(*stack);
   u32 alloc_context_id = meta->alloc_context_id;
if (t) {
     SpinMutexLock l(&fallback_mutex);
     AllocatorCache *cache = &fallback_allocator_cache;
     allocator.Deallocate(cache, aligned_ptr);
   }
 }
 
 static void *HwasanReallocate(StackTrace *stack, void *tagged_ptr_old,
                               uptr new_size, uptr alignment) {
-  if (!PointerAndMemoryTagsMatch(tagged_ptr_old))
-    ReportInvalidFree(stack, reinterpret_cast<uptr>(tagged_ptr_old));
-
+  void *untagged_ptr_old =
+      InTaggableRegion(reinterpret_cast<uptr>(tagged_ptr_old))
+          ? UntagPtr(tagged_ptr_old)
+          : tagged_ptr_old;
+  if (CheckInvalidFree(stack, untagged_ptr_old, tagged_ptr_old))
+    return nullptr;
   void *tagged_ptr_new =
       HwasanAllocate(stack, new_size, alignment, false /*zeroise*/);
   if (tagged_ptr_old && tagged_ptr_new) {
-    void *untagged_ptr_old =  UntagPtr(tagged_ptr_old);
     Metadata *meta =
         reinterpret_cast<Metadata *>(allocator.GetMetaData(untagged_ptr_old));
     internal_memcpy(
         UntagPtr(tagged_ptr_new), untagged_ptr_old,
         Min(new_size, static_cast<uptr>(meta->get_requested_size())));
     HwasanDeallocate(stack, tagged_ptr_old);
   }
   return tagged_ptr_new;
 }
 
 static void *HwasanCalloc(StackTrace *stack, uptr nmemb, uptr size) {
   if (UNLIKELY(CheckForCallocOverflow(size, nmemb))) {
     if (AllocatorMayReturnNull())
       return nullptr;
     ReportCallocOverflow(nmemb, size, stack);
   }
   return HwasanAllocate(stack, nmemb * size, sizeof(u64), true);
 }
 
 HwasanChunkView FindHeapChunkByAddress(uptr address) {
+  if (!allocator.PointerIsMine(reinterpret_cast<void *>(address)))
+    return HwasanChunkView();
   void *block = allocator.GetBlockBegin(reinterpret_cast<void*>(address));
   if (!block)
     return HwasanChunkView();
   Metadata *metadata =
       reinterpret_cast<Metadata*>(allocator.GetMetaData(block));
   return HwasanChunkView(reinterpret_cast<uptr>(block), metadata);
 }
 

compiler-rt/lib/hwasan/hwasan_checks.h

#endif
   // __builtin_unreachable();
 }
 
 __attribute__((always_inline, nodebug)) static bool PossiblyShortTagMatches(
     tag_t mem_tag, uptr ptr, uptr sz) {
   tag_t ptr_tag = GetTagFromPointer(ptr);
   if (ptr_tag == mem_tag)
     return true;
-  if (mem_tag >= kShadowAlignment)
+  if (mem_tag >= kShadowAlignment || mem_tag == 0)
     return false;
   if ((ptr & (kShadowAlignment - 1)) + sz > mem_tag)
     return false;
 #ifndef __aarch64__
   ptr = UntagAddr(ptr);
 #endif
   return *(u8 *)(ptr | (kShadowAlignment - 1)) == ptr_tag;
 }

compiler-rt/lib/hwasan/hwasan_report.cpp

 
 void PrintAddressDescription(
     uptr tagged_addr, uptr access_size,
     StackAllocationsRingBuffer *current_stack_allocations) {
   Decorator d;
   int num_descriptions_printed = 0;
   uptr untagged_addr = UntagAddr(tagged_addr);
 
+  if (MemIsShadow(untagged_addr)) {
+    Printf("%s%p is HWAsan shadow memory.\n%s", d.Location(), untagged_addr,
+           d.Default());
+    return;
+  }
+
   // Print some very basic information about the address, if it's a heap.
   HwasanChunkView chunk = FindHeapChunkByAddress(untagged_addr);
   if (uptr beg = chunk.Beg()) {
     uptr size = chunk.ActualSize();
     Printf("%s[%p,%p) is a %s %s heap chunk; "
            "size: %zd offset: %zd\n%s",
            d.Location(),
            beg, beg + size,
return stack->size ? StackTrace::GetPreviousInstructionPc(stack->trace[0])
                      : 0;
 }
 
 void ReportInvalidFree(StackTrace *stack, uptr tagged_addr) {
   ScopedReport R(flags()->halt_on_error);
 
   uptr untagged_addr = UntagAddr(tagged_addr);
   tag_t ptr_tag = GetTagFromPointer(tagged_addr);
-  tag_t *tag_ptr = reinterpret_cast<tag_t*>(MemToShadow(untagged_addr));
-  tag_t mem_tag = *tag_ptr;
+  tag_t *tag_ptr = nullptr;
+  tag_t mem_tag = 0;
+  if (MemIsApp(untagged_addr)) {
+    tag_ptr = reinterpret_cast<tag_t *>(MemToShadow(untagged_addr));
+    if (MemIsShadow(reinterpret_cast<uptr>(tag_ptr)))
+      mem_tag = *tag_ptr;
+    else
+      tag_ptr = nullptr;
+  }
   Decorator d;
   Printf("%s", d.Error());
   uptr pc = GetTopPc(stack);
   const char *bug_type = "invalid-free";
   const Thread *thread = GetCurrentThread();
   if (thread) {
     Report("ERROR: %s: %s on address %p at pc %p on thread T%zd\n",
            SanitizerToolName, bug_type, untagged_addr, pc, thread->unique_id());
   } else {
     Report("ERROR: %s: %s on address %p at pc %p on unknown thread\n",
            SanitizerToolName, bug_type, untagged_addr, pc);
   }
   Printf("%s", d.Access());
+  if (tag_ptr)
     Printf("tags: %02x/%02x (ptr/mem)\n", ptr_tag, mem_tag);
   Printf("%s", d.Default());
 
   stack->Print();
 
   PrintAddressDescription(tagged_addr, 0, nullptr);
 
+  if (tag_ptr)
     PrintTagsAroundAddr(tag_ptr);
 
   ReportErrorSummary(bug_type, stack);
 }
 
 void ReportTailOverwritten(StackTrace *stack, uptr tagged_addr, uptr orig_size,
                            const u8 *expected) {
   uptr tail_size = kShadowAlignment - (orig_size % kShadowAlignment);
   ScopedReport R(flags()->halt_on_error);

compiler-rt/test/hwasan/TestCases/wild-free-realloc.c

+// RUN: %clang_hwasan %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+#include <stdlib.h>
+
+int main() {
+  char *p = (char *)malloc(1);
+  realloc(p + 0x10000000000, 2);
+  // CHECK: ERROR: HWAddressSanitizer: invalid-free on address {{.*}} at pc {{[0x]+}}[[PC:.*]] on thread T{{[0-9]+}}
+  // CHECK: #0 {{[0x]+}}{{.*}}[[PC]] in realloc
+  // CHECK: #1 {{.*}} in main {{.*}}wild-free-realloc.c:[[@LINE-3]]
+  // CHECK-NOT: Segmentation fault
+  // CHECK-NOT: SIGSEGV
+  return 0;
+}

compiler-rt/test/hwasan/TestCases/wild-free-shadow.c

+// RUN: %clang_hwasan %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+#include <stdlib.h>
+
+extern void *__hwasan_shadow_memory_dynamic_address;
+
+int main() {
+  char *p = (char *)malloc(1);
+  free(__hwasan_shadow_memory_dynamic_address);
+  // CHECK: ERROR: HWAddressSanitizer: invalid-free on address {{[0x]+}}[[PTR:.*]] at pc {{[0x]+}}[[PC:.*]] on thread T{{[0-9]+}}
+  // CHECK: #0 {{[0x]+}}{{.*}}[[PC]] in free
+  // CHECK: #1 {{.*}} in main {{.*}}wild-free-shadow.c:[[@LINE-3]]
+  // CHECK: {{[0x]+}}{{.*}}[[PTR]] is HWAsan shadow memory.
+  // CHECK-NOT: Segmentation fault
+  // CHECK-NOT: SIGSEGV
+  return 0;
+}

compiler-rt/test/hwasan/TestCases/wild-free.c

+// RUN: %clang_hwasan %s -o %t && not %run %t 2>&1 | FileCheck %s
+
+#include <stdlib.h>
+
+int main() {
+  char *p = (char *)malloc(1);
+  free(p + 0x10000000000);
+  // CHECK: ERROR: HWAddressSanitizer: invalid-free on address {{.*}} at pc {{[0x]+}}[[PC:.*]] on thread T{{[0-9]+}}
+  // CHECK: #0 {{[0x]+}}{{.*}}[[PC]] in free
+  // CHECK: #1 {{.*}} in main {{.*}}wild-free.c:[[@LINE-3]]
+  // CHECK-NOT: Segmentation fault
+  // CHECK-NOT: SIGSEGV
+  return 0;
+}