This is an archive of the discontinued LLVM Phabricator instance.

[Sanitizers][Darwin] Fix for shadow memory allocation which fails on some iOS devices under certain conditions
AbandonedPublic

Authored by wrotki on Aug 11 2022, 6:34 PM.

Details

Summary
An application running with ASAN can fail during shadow memory allocation, with an error
indicating a failure to map shadow memory region due to negative size parameter passed to mmap.
It can happen when iOS decides to limit the top of the virtual memory address space to be very low and,
when the application itself is relatively complex (with lots of dependencies - like Spotify).

What really happens, is that evaluating kHighMemBeg, kHighShadowBeg and kHighShadowEnd macros, when computed as usual (for dynamic shadow area locations) 
leads to nonsensical situation where kHighMemEnd <= (MEM_TO_SHADOW(kHighMemEnd) + 1). It results in a negative
value of an expression passed to the mmap as the size of high shadow.

To remedy this case, when this condition (kHighMemEnd <= (MEM_TO_SHADOW(kHighMemEnd) + 1)) is detected, 
an alternate high shadow memory layout is applied. It is really a mitigation, some issues
involving high memory access might be missed - but, without the mitigation, the ASANified
app will just crash. The mitigation allows it to work and detect most of typical issues ASAN detects.

Diff Detail

Event Timeline

wrotki created this revision.Aug 11 2022, 6:34 PM
Herald added a project: Restricted Project. · View Herald TranscriptAug 11 2022, 6:34 PM
Herald added a subscriber: Enna1. · View Herald Transcript
wrotki requested review of this revision.Aug 11 2022, 6:34 PM
Herald added a project: Restricted Project. · View Herald TranscriptAug 11 2022, 6:34 PM
Herald added a subscriber: Restricted Project. · View Herald Transcript
wrotki updated this revision to Diff 458571.Sep 7 2022, 2:52 PM
wrotki retitled this revision from [Sanitizers][Darwin] Fix for shadow memory allocation which fails on some iOS devices to [Sanitizers][Darwin] Fix for shadow memory allocation which fails on some iOS devices under certain conditions.
wrotki edited the summary of this revision. (Show Details)
  • Simplify expression deciding that high memory limit is low
  • Fine tune the IS_HIGH_MEM_LOW comment
wrotki abandoned this revision.Sep 28 2022, 3:36 PM

After discussion I decided to come up with a different, separate fix.