[sanitizer] Switch dlsym hack to internal_allocator

[vitalybuka]

Summary

Since glibc 2.34, dlsym does

1. malloc 1
2. malloc 2
3. free pointer from malloc 1
4. free pointer from malloc 2

These sequence was not handled by trivial dlsym hack.

This fixes https://bugs.llvm.org/show_bug.cgi?id=52278

[vitalybuka]

compiler-rt/lib/asan/asan_malloc_linux.cpp

79

I realy don't like were we are going. What if we need 3 soon?

Any idea why we can't use internal_allocator()?

if we can't use internal allocator here I propose the following to simplify this.

1. AllocateFromLocalPool store size at (return value - 1) location.
2. so DeallocateFromLocalPool can find size from there.
3. To create byte(or bit) map to mark used words.
4. AllocateFromLocalPool will use last_dlsym_alloc_size_in_words_index to walkback and find start of unused bytest (or maybe just remove last_dlsym_alloc_size_in_words_index and scan full range)

[vitalybuka]

compiler-rt/lib/asan/asan_malloc_linux.cpp

79

Please let me know if you are going to implement suggested changes.
If if not, you are fixing a real issue, and I will do that myself.

[hjl.tools]

compiler-rt/lib/asan/asan_malloc_linux.cpp

79

Please let me know if you are going to implement suggested changes.
If if not, you are fixing a real issue, and I will do that myself.

I am not familiar with the code. Could you please fix it? Thanks.

[vitalybuka]

upload

[vitalybuka]

remove global

[morehouse]

compiler-rt/lib/memprof/memprof_malloc_linux.cpp

37 ↗

(On Diff #386394)

Shouldn't this be GET_STACK_TRACE_MALLOC?

[eugenis]

compiler-rt/lib/asan/asan_malloc_linux.cpp

146

Why do we need to specialize ReallocImpl? And do we even need stack traces here?

[vitalybuka]

Add root region hooks

[vitalybuka]

compiler-rt/lib/asan/asan_malloc_linux.cpp

67

This one is annoying. To keep behavioral closer to original I use root regions.
What I see is that "dlsym hack" allocations contains pointers to later regular dlerror allocations.

it would be nice to investigate if dlerror is special. If so we can remove regions in followup patches
and add dlerror interceptors to lsan and asan.

[eugenis]

compiler-rt/lib/sanitizer_common/sanitizer_allocator_dlsym.h

67 ↗

(On Diff #386756)

I'd rather call OnFree(p) before deallocating, even if it does not matter for lsan.
Or does it?

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_allocator_dlsym.h

67 ↗

(On Diff #386756)

we do on like 52

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_allocator_dlsym.h

67 ↗

(On Diff #386756)

if the question about Details::OnAllocate Details::OnFree order then
the point to keep at least one of buffers, ptr or new_ptr, in lsan roots.

[vitalybuka]

redo Realloc

[eugenis]

LGTM

compiler-rt/lib/asan/asan_malloc_linux.cpp

 #  include "sanitizer_common/sanitizer_allocator_checks.h"
 #  include "sanitizer_common/sanitizer_errno.h"
 #  include "sanitizer_common/sanitizer_tls_get_addr.h"
 
 // ---------------------- Replacement functions ---------------- {{{1
 using namespace __asan;
 
 static uptr allocated_for_dlsym;
-static uptr last_dlsym_alloc_size_in_words;
+static uptr last_dlsym_alloc_size_in_words[2];
+const void *last_dlsym_alloc[2];
+static int last_dlsym_alloc_size_in_words_index = -1;
+const void *last_freed_dlsym_alloc;
 static const uptr kDlsymAllocPoolSize = 1024;
 static uptr alloc_memory_for_dlsym[kDlsymAllocPoolSize];
 
 static inline bool IsInDlsymAllocPool(const void *ptr) {
   uptr off = (uptr)ptr - (uptr)alloc_memory_for_dlsym;
   return off < allocated_for_dlsym * sizeof(alloc_memory_for_dlsym[0]);
 }
 
 static void *AllocateFromLocalPool(uptr size_in_bytes) {
   uptr size_in_words = RoundUpTo(size_in_bytes, kWordSize) / kWordSize;
   void *mem = (void*)&alloc_memory_for_dlsym[allocated_for_dlsym];
-  last_dlsym_alloc_size_in_words = size_in_words;
+  last_dlsym_alloc_size_in_words_index++;
+  last_dlsym_alloc_size_in_words_index &= 1;
+  last_dlsym_alloc_size_in_words[last_dlsym_alloc_size_in_words_index]
+    = size_in_words;
+  last_dlsym_alloc[last_dlsym_alloc_size_in_words_index] = mem;
   allocated_for_dlsym += size_in_words;
   CHECK_LT(allocated_for_dlsym, kDlsymAllocPoolSize);
   return mem;
 }
 
 static void DeallocateFromLocalPool(const void *ptr) {
   // Hack: since glibc 2.27 dlsym no longer uses stack-allocated memory to store
   // error messages and instead uses malloc followed by free. To avoid pool
   // exhaustion due to long object filenames, handle that special case here.
-  uptr prev_offset = allocated_for_dlsym - last_dlsym_alloc_size_in_words;
-  void *prev_mem = (void*)&alloc_memory_for_dlsym[prev_offset];
+  uptr prev_dlsym_alloc_size_in_words;
+  uptr prev_offset;
+  void *prev_mem;
+  if (last_dlsym_alloc_size_in_words_index == 0) {
+    prev_dlsym_alloc_size_in_words = last_dlsym_alloc_size_in_words[0];
+    prev_offset = allocated_for_dlsym - prev_dlsym_alloc_size_in_words;
+    prev_mem = (void*)&alloc_memory_for_dlsym[prev_offset];
     if (prev_mem == ptr) {
-    REAL(memset)(prev_mem, 0, last_dlsym_alloc_size_in_words * kWordSize);
+      REAL(memset)(prev_mem, 0, prev_dlsym_alloc_size_in_words * kWordSize);
       allocated_for_dlsym = prev_offset;
-    last_dlsym_alloc_size_in_words = 0;
+      last_dlsym_alloc_size_in_words[0] = 0;
+      last_dlsym_alloc[0] = nullptr;
+      last_dlsym_alloc_size_in_words_index = -1;
+      last_freed_dlsym_alloc = nullptr;
+      return;
+    }
   }
+
+  if (last_dlsym_alloc_size_in_words_index == 1) {
+    // Hack: Since glibc 2.34, dlsym does
+    //   1. malloc 1
+    //   2. malloc 2
+    //   3. free pointer from malloc 1
+    //   4. free pointer from malloc 2
+    // Free memory from malloc 1 and malloc 2 together.
+    if (last_freed_dlsym_alloc == last_dlsym_alloc[0] &&
+        ptr == last_dlsym_alloc[1]) {
+      prev_dlsym_alloc_size_in_words = last_dlsym_alloc_size_in_words[0]
+        + last_dlsym_alloc_size_in_words[1];
+      prev_offset = allocated_for_dlsym - prev_dlsym_alloc_size_in_words;
+      void *prev_mem = (void*)&alloc_memory_for_dlsym[prev_offset];
+      if (prev_mem == last_freed_dlsym_alloc) {
+        REAL(memset)(prev_mem, 0, prev_dlsym_alloc_size_in_words * kWordSize);
+        allocated_for_dlsym = prev_offset;
+        last_dlsym_alloc_size_in_words[0] = 0;
+        last_dlsym_alloc_size_in_words[1] = 0;
+        last_dlsym_alloc[0] = nullptr;
+        last_dlsym_alloc[1] = nullptr;
+        last_dlsym_alloc_size_in_words_index = -1;
+        last_freed_dlsym_alloc = nullptr;
+        return;
+      }
+    }
+  }
+
+  last_freed_dlsym_alloc = ptr;
 }
 
 static int PosixMemalignFromLocalPool(void **memptr, uptr alignment,
                                       uptr size_in_bytes) {
   if (UNLIKELY(!CheckPosixMemalignAlignment(alignment)))
     return errno_EINVAL;
 
   CHECK(alignment >= kWordSize);
static void *ReallocFromLocalPool(void *ptr, uptr size) {
   const uptr offset = (uptr)ptr - (uptr)alloc_memory_for_dlsym;
   const uptr copy_size = Min(size, kDlsymAllocPoolSize - offset);
   void *new_ptr;
   if (UNLIKELY(UseLocalPool())) {
     new_ptr = AllocateFromLocalPool(size);
   } else {
     ENSURE_ASAN_INITED();
     GET_STACK_TRACE_MALLOC;
     new_ptr = asan_malloc(size, &stack);
   }
   internal_memcpy(new_ptr, ptr, copy_size);
   return new_ptr;
 }
 
 INTERCEPTOR(void, free, void *ptr) {
   if (UNLIKELY(IsInDlsymAllocPool(ptr))) {
     DeallocateFromLocalPool(ptr);