[compiler-rt] update detect_write_exec option for apple devices

[devnexen]

Summary

• Taking in account MAP_JIT which allows W/X pages on hardened environments (and is essential on arm64 arch).

[devnexen]

ping :)

[vitalybuka]

LGTM with a test
maybe Apple folks want to take a look?

compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_report.cpp

93–95

it would be nice to separate NFC changes like this and functional into a separate patches.

[yln]

compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_report.cpp

93–95

+1

97

SANITIZER_MAC implies SANITIZER_IOS; it's poorly named, but it essentially means: "any Apple platform"

98

Maybe fold this into one #if.

[devnexen]

compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_report.cpp

97

ah good to know :)

compiler-rt/lib/dfsan/dfsan_interceptors.cpp

#define COMMON_INTERCEPTOR_ENTER(func, ...) \
   if (__dfsan::dfsan_init_is_running)       \
     return REAL(func)(__VA_ARGS__);         \
   ENSURE_DFSAN_INITED();                    \
   dfsan_set_label(0, __errno_location(), sizeof(int));
 
 INTERCEPTOR(void *, mmap, void *addr, SIZE_T length, int prot, int flags,
             int fd, OFF_T offset) {
   if (common_flags()->detect_write_exec)
-    ReportMmapWriteExec(prot);
+    ReportMmapWriteExec(prot, flags);
   if (!__dfsan::dfsan_inited)
     return (void *)internal_mmap(addr, length, prot, flags, fd, offset);
   COMMON_INTERCEPTOR_ENTER(mmap, addr, length, prot, flags, fd, offset);
   void *res = REAL(mmap)(addr, length, prot, flags, fd, offset);
   if (res != (void *)-1) {
     dfsan_set_label(0, res, RoundUpTo(length, GetPageSizeCached()));
   }
   return res;
 }
 
 INTERCEPTOR(void *, mmap64, void *addr, SIZE_T length, int prot, int flags,
             int fd, OFF64_T offset) {
   if (common_flags()->detect_write_exec)
-    ReportMmapWriteExec(prot);
+    ReportMmapWriteExec(prot, flags);
   if (!__dfsan::dfsan_inited)
     return (void *)internal_mmap(addr, length, prot, flags, fd, offset);
   COMMON_INTERCEPTOR_ENTER(mmap64, addr, length, prot, flags, fd, offset);
   void *res = REAL(mmap64)(addr, length, prot, flags, fd, offset);
   if (res != (void *)-1) {
     dfsan_set_label(0, res, RoundUpTo(length, GetPageSizeCached()));
   }
   return res;

compiler-rt/lib/sanitizer_common/sanitizer_common.h

 // Same as above, but construct error_message as:
 //   error_type file:line[:column][ function]
 void ReportErrorSummary(const char *error_type, const AddressInfo &info,
                         const char *alt_tool_name = nullptr);
 // Same as above, but obtains AddressInfo by symbolizing top stack trace frame.
 void ReportErrorSummary(const char *error_type, const StackTrace *trace,
                         const char *alt_tool_name = nullptr);
 
-void ReportMmapWriteExec(int prot);
+void ReportMmapWriteExec(int prot, int mflags);
 
 // Math
 #if SANITIZER_WINDOWS && !defined(__clang__) && !defined(__GNUC__)
 extern "C" {
 unsigned char _BitScanForward(unsigned long *index, unsigned long mask);
 unsigned char _BitScanReverse(unsigned long *index, unsigned long mask);
 #if defined(_WIN64)
 unsigned char _BitScanForward64(unsigned long *index, unsigned __int64 mask);

compiler-rt/lib/sanitizer_common/sanitizer_common_interceptors.inc

 #define INIT_STRLCPY
 #endif
 
 #if SANITIZER_INTERCEPT_MMAP
 INTERCEPTOR(void *, mmap, void *addr, SIZE_T sz, int prot, int flags, int fd,
             OFF_T off) {
   void *ctx;
   if (common_flags()->detect_write_exec)
-    ReportMmapWriteExec(prot);
+    ReportMmapWriteExec(prot, flags);
   if (COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED)
     return (void *)internal_mmap(addr, sz, prot, flags, fd, off);
   COMMON_INTERCEPTOR_ENTER(ctx, mmap, addr, sz, prot, flags, fd, off);
   COMMON_INTERCEPTOR_MMAP_IMPL(ctx, mmap, addr, sz, prot, flags, fd, off);
 }
 
 INTERCEPTOR(int, mprotect, void *addr, SIZE_T sz, int prot) {
   void *ctx;
   if (common_flags()->detect_write_exec)
-    ReportMmapWriteExec(prot);
+    ReportMmapWriteExec(prot, 0);
   if (COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED)
     return (int)internal_mprotect(addr, sz, prot);
   COMMON_INTERCEPTOR_ENTER(ctx, mprotect, addr, sz, prot);
   MprotectMallocZones(addr, prot);
   return REAL(mprotect)(addr, sz, prot);
 }
 #define INIT_MMAP                                                              \
   COMMON_INTERCEPT_FUNCTION(mmap);                                             \
   COMMON_INTERCEPT_FUNCTION(mprotect);
 #else
 #define INIT_MMAP
 #endif
 
 #if SANITIZER_INTERCEPT_MMAP64
 INTERCEPTOR(void *, mmap64, void *addr, SIZE_T sz, int prot, int flags, int fd,
             OFF64_T off) {
   void *ctx;
   if (common_flags()->detect_write_exec)
-    ReportMmapWriteExec(prot);
+    ReportMmapWriteExec(prot, flags);
   if (COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED)
     return (void *)internal_mmap(addr, sz, prot, flags, fd, off);
   COMMON_INTERCEPTOR_ENTER(ctx, mmap64, addr, sz, prot, flags, fd, off);
   COMMON_INTERCEPTOR_MMAP_IMPL(ctx, mmap64, addr, sz, prot, flags, fd, off);
 }
 #define INIT_MMAP64 COMMON_INTERCEPT_FUNCTION(mmap64);
 #else
 #define INIT_MMAP64

compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_report.cpp

#if !SANITIZER_GO
   // Maybe sometimes we need to choose another frame (e.g. skip memcpy/etc).
   uptr pc = StackTrace::GetPreviousInstructionPc(stack->trace[0]);
   SymbolizedStack *frame = Symbolizer::GetOrInit()->SymbolizePC(pc);
   ReportErrorSummary(error_type, frame->info, alt_tool_name);
   frame->ClearAll();
 #endif
 }
 
-void ReportMmapWriteExec(int prot) {
+void ReportMmapWriteExec(int prot, int flags) {
 #if SANITIZER_POSIX && (!SANITIZER_GO && !SANITIZER_ANDROID)
-  if ((prot & (PROT_WRITE | PROT_EXEC)) != (PROT_WRITE | PROT_EXEC))
+  int pflags = (PROT_WRITE | PROT_EXEC);
+  if ((prot & pflags) != pflags)
     return;
 
+#  if SANITIZER_MAC || SANITIZER_IOS
+#    if defined(MAP_JIT)
+  if ((flags & MAP_JIT) == MAP_JIT)
+    return;
+#    endif
+#  endif
+
   ScopedErrorReportLock l;
   SanitizerCommonDecorator d;
 
   InternalMmapVector<BufferedStackTrace> stack_buffer(1);
   BufferedStackTrace *stack = stack_buffer.data();
   stack->Reset();
   uptr top = 0;
   uptr bottom = 0;

compiler-rt/lib/tsan/rtl/tsan_platform_mac.cpp

 }
 #endif
 
 void InitializePlatformEarly() {
 #  if !SANITIZER_GO && SANITIZER_IOS
   uptr max_vm = GetMaxUserVirtualAddress() + 1;
   if (max_vm != HiAppMemEnd()) {
     Printf("ThreadSanitizer: unsupported vm address limit %p, expected %p.\n",
-           max_vm, HiAppMemEnd());
+           (void *)max_vm, (void *)HiAppMemEnd());
     Die();
   }
 #endif
 }
 
 static uptr longjmp_xor_key = 0;
 
 void InitializePlatform() {

compiler-rt/test/sanitizer_common/TestCases/Posix/mmap_write_exec.cpp

 // RUN: %clangxx %s -o %t
 // RUN: %env_tool_opts=detect_write_exec=1 %run %t 2>&1 | FileCheck %s
 // RUN: %env_tool_opts=detect_write_exec=0 %run %t 2>&1 | FileCheck %s \
 // RUN:   --check-prefix=CHECK-DISABLED
 // ubsan and lsan do not install mmap interceptors UNSUPPORTED: ubsan, lsan
 
 // TODO: Fix option on Android, it hangs there for unknown reasons.
 // XFAIL: android
 
+#include <pthread.h>
 #include <stdio.h>
 #include <sys/mman.h>
 
 int main(int argc, char **argv) {
   char *p = (char *)mmap(0, 1024, PROT_READ | PROT_WRITE | PROT_EXEC,
                          MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
   // CHECK: WARNING: {{.*}}Sanitizer: writable-executable page usage
   // CHECK: #{{[0-9]+.*}}main{{.*}}mmap_write_exec.cpp:[[@LINE-3]]
   // CHECK: SUMMARY: {{.*}}Sanitizer: w-and-x-usage
 
   char *q = (char *)mmap(p, 64, PROT_READ | PROT_WRITE,
                          MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
   (void)mprotect(q, 64, PROT_WRITE | PROT_EXEC);
   // CHECK: WARNING: {{.*}}Sanitizer: writable-executable page usage
   // CHECK: #{{[0-9]+.*}}main{{.*}}mmap_write_exec.cpp:[[@LINE-2]]
   // CHECK: SUMMARY: {{.*}}Sanitizer: w-and-x-usage
 
   char *a = (char *)mmap(0, 1024, PROT_READ | PROT_WRITE,
                          MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
   char *b = (char *)mmap(a, 64, PROT_READ | PROT_WRITE,
                          MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED, -1, 0);
   (void)mprotect(q, 64, PROT_READ | PROT_EXEC);
   // CHECK-NOT: Sanitizer
+#if defined(__APPLE__)
+  pthread_jit_write_protect_np(false);
+  char *c = (char *)mmap(0, 128, PROT_WRITE | PROT_EXEC,
+             MAP_ANONYMOUS | MAP_PRIVATE | MAP_JIT, -1, 0);
+  // CHECK-NOT: Sanitizer
+#endif
 
   printf("done\n");
   // CHECK-DISABLED-NOT: Sanitizer
   // CHECK-DISABLED: done
 }