Dynamically allocate scudo allocation buffer.

[fmayer]

Summary

This is so we can increase the buffer size for finding elusive bugs.

Tested by hand with this program

int main(int argc, char** argv) {
  if (argc < 2)
    return 1;
  int n = atoi(argv[1]);
  char* x = reinterpret_cast<char*>(malloc(1));
  *((volatile char*)x) = 1;
  free(x);
  for (; n > 0; --n) {
    char* y = reinterpret_cast<char*>(malloc(1024));
    *((volatile char*)y) = 1;
    free(y);
  }
  *x = 2;
  return 0;
}

SCUDO_OPTIONS=allocation_ring_buffer_size=30000 ./uaf 1000000
-> no allocation trace
SCUDO_OPTIONS=allocation_ring_buffer_size=30000000 ./uaf 1000000
-> allocation trace

[fmayer]

unneeded includes

[Chia-hungDuan]

compiler-rt/lib/scudo/standalone/combined.h

1051

I'm thinking if we do something like the concept in llvm::TrailingObjects, such as

struct TrailingEntries {
  ... GetRingBufferEntry(...);
};

struct AllocationRingBuffer : TrailingEntries {
...
};

Will it look better?

[fmayer]

compiler-rt/lib/scudo/standalone/combined.h

1051

I thought about this, but getting this right in a standards-compliant way is a quite subtle exercise. E.g. I think we cannot just use the this pointer from the AllocationRingBuffer, because that would be going over the object boundaries from a C++ standards perspective. This is why I separately retain the RawRingBuffer pointer.

All in all I am not sure it's worth it.

[Chia-hungDuan]

compiler-rt/lib/scudo/standalone/combined.h

1051

I see. I think casting this to access the memory address before/after it may be safe if we manage the entire raw memory by ourselves. But l agree with you, I'm not so certain if there's any tricky part.

I'm trying to make the allocator(in this combined.h) look simpler so if we can bundle certain functionalities together, the later code restructuring may be easier. That's why I was thinking the trailing structure. But I think it's better to have this first (it reduces the scudo metadata size on certain platforms that don't need a big entry buffer). Thus don't worry about this suggestion, thanks!

[hctim]

compiler-rt/lib/scudo/standalone/combined.h

181–182

not sure what extra information this comment is telling me...

947–959

why not just allow the fuzzer to replace the entire ringbuffer?

952

this seems unnecessary, the regular API can be used?

1066–1069

can you have just RingBuffer and not have this raw variant? it seems to be only used in two places (there are more references to the name but they're just from the same-named argument).

the invariant doesn't always hold and seems tricky to maintain. for example, it doesn't hold when fuzzing is under operation.

[fmayer]

remove comment

compiler-rt/lib/scudo/standalone/combined.h

947–959

No, this is not how this gets used. The fuzzer creates the buffer for itself, and then uses a STATIC method on that. As such, what's in the Allocator object doesn't matter. What does matter is that the Size member of the RingBuffer is consistent with its size, otherwise we will trivially get loads of crashes.

952

See other comment about fuzzer API.

1066–1069

This is to be strictly standards compliant (and to retain some convenience). I think what we could do is _only_ keep the RawRingBuffer and cast it for all uses of RingBuffer.

[fmayer]

compiler-rt/lib/scudo/standalone/combined.h

1066–1069

the invariant doesn't always hold and seems tricky to maintain. for example, it doesn't hold when fuzzing is under operation.

It does always hold. This only gets assigned in one place. Fuzzing is irrelevant because it doesn't use an Allocator object.

[hctim]

compiler-rt/lib/scudo/standalone/combined.h

947–959

yeah, so the fuzzer calls getErrorInfo using a fuzzer-generated ringbuffer.

previously getRingBufferErrorInfo used AllocationRingBuffer::NumEntries to determine the size of the ringbuffer, so that definition was ifdef'd.

now the size of the ringbuffer is dynamic and accessed through RingBuffer->Size.

so why not just allow the fuzzer to control the size AND contentx of the ringbuffer, and just set RingBuffer->Size to the right value?

i assumed that there was some reference during getErrorInfo to the ringbuffer via. the allocator, but if that's not the case, just delete these functions (getRingBufferSizeForFuzzer, setRingBufferForFuzzing)?

[fmayer]

change fuzzer

[fmayer]

compiler-rt/lib/scudo/standalone/combined.h

947–959

I really disagree to leak the structs to the fuzzer (as discussed offline), it's much less neat than providing one function to it to fix up the Size. Either way we are adding an API for the fuzzer: either through two structs and implicit invariants about them, or with one function and the fuzzer can otherwise still treat the RingBuffer as an opaque blob.

The other suggestion is a good point, I allowed the fuzzer to control both the Size and the content.

[cryptoad]

If you could please change InitRingBuffer & RingBufferSizeInBytes to abide to the LLVM coding standard (https://llvm.org/docs/CodingStandards.html#name-types-functions-variables-and-enumerators-properly)

[fmayer]

style

[fmayer]

more style

[fmayer]

In D140932#4045007, @cryptoad wrote:

If you could please change InitRingBuffer & RingBufferSizeInBytes to abide to the LLVM coding standard (https://llvm.org/docs/CodingStandards.html#name-types-functions-variables-and-enumerators-properly)

Thanks. Also changed GetRingBufferEntry to getRingBufferEntry.

[eugenis]

LGTM

compiler-rt/lib/scudo/standalone/combined.h

1066–1069

I think what we could do is _only_ keep the RawRingBuffer and cast it for all uses of RingBuffer.

I'd like this. Add an accessor function or something - the current code wastes memory, however little.

[fmayer]

evgenii's comment

[shafik]

compiler-rt/lib/scudo/standalone/combined.h

1267

On my local build I am seeing the following diagnostic:

combined.h:1267:47: error: conversion from ‘scudo::uptr’ {aka ‘long unsigned int’} to ‘scudo::u32’ {aka ‘unsigned int’} may change value [-Werror=conversion]
         getRingBufferEntry(RawRingBuffer, Pos % getRingBuffer()->Size);
                                           ~~~~^~~~~~~~~~~~~~~~~~~~~~~

[fmayer]

compiler-rt/lib/scudo/standalone/combined.h

1267

Sorry, should be fixed in rGed864f0a09d1fc7eae96faa4eb35b33880e6c478

[amyk]

Hi, I realized that the clang-ppc64le-rhel bot is exhibiting the following error when building this patch (https://lab.llvm.org/buildbot/#/builders/57/builds/23848/steps/7/logs/stdio):

FAILED: compiler-rt/lib/scudo/standalone/tests/ScudoUnitTestsObjects.combined_test.cpp.powerpc64le.o /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/build/runtimes/runtimes-bins/compiler-rt/lib/scudo/standalone/tests/ScudoUnitTestsObjects.combined_test.cpp.powerpc64le.o 
cd /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/build/runtimes/runtimes-bins/compiler-rt/lib/scudo/standalone/tests && /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/build/./bin/clang -fPIC -fno-semantic-interposition -fvisibility-inlines-hidden -Werror -Werror=date-time -Werror=unguarded-availability-new -Wall -Wextra -Wno-unused-parameter -Wwrite-strings -Wcast-qual -Wmissing-field-initializers -Wimplicit-fallthrough -Wcovered-switch-default -Wno-noexcept-type -Wnon-virtual-dtor -Wdelete-non-virtual-dtor -Wsuggest-override -Wno-comment -Wstring-conversion -Wmisleading-indentation -Wctad-maybe-unsupported -fdiagnostics-color -ffunction-sections -fdata-sections -Wall -Werror -Wno-unused-parameter -Wno-unknown-warning-option -Wthread-safety -Wthread-safety-reference -Wthread-safety-beta -g -Wno-covered-switch-default -Wno-suggest-override -DGTEST_NO_LLVM_SUPPORT=1 -DGTEST_HAS_RTTI=0 -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/include -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/include -DGTEST_HAS_RTTI=0 -g -Wno-mismatched-new-delete -m64 -fno-function-sections -c -o ScudoUnitTestsObjects.combined_test.cpp.powerpc64le.o /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp
In file included from /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:10:
In file included from /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/scudo_unit_test.h:15:
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include/gtest/gtest.h:1628:28: error: comparison of integers of different signs: 'const unsigned long' and 'const int' [-Werror,-Wsign-compare]
GTEST_IMPL_CMP_HELPER_(GT, >);
~~~~~~~~~~~~~~~~~~~~~~~~~~~^~
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include/gtest/gtest.h:1608:12: note: expanded from macro 'GTEST_IMPL_CMP_HELPER_'
  if (val1 op val2) {\
      ~~~~ ^  ~~~~
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:708:3: note: in instantiation of function template specialization 'testing::internal::CmpHelperGT<unsigned long, int>' requested here
  ASSERT_GT(Size, 0);
  ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include/gtest/gtest.h:2076:32: note: expanded from macro 'ASSERT_GT'
# define ASSERT_GT(val1, val2) GTEST_ASSERT_GT(val1, val2)
                               ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include/gtest/gtest.h:2050:44: note: expanded from macro 'GTEST_ASSERT_GT'
  ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperGT, val1, val2)
                                           ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:705:1: note: in instantiation of member function 'ScudoCombinedTestRingBufferSize<scudo::AndroidSvelteConfig>::Run' requested here
SCUDO_TYPED_TEST(ScudoCombinedTest, RingBufferSize) {
^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:129:3: note: expanded from macro 'SCUDO_TYPED_TEST'
  SCUDO_TYPED_TEST_ALL_TYPES(FIXTURE, NAME)                                    \
  ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:115:3: note: expanded from macro 'SCUDO_TYPED_TEST_ALL_TYPES'
  SCUDO_TYPED_TEST_TYPE(FIXTURE, NAME, AndroidSvelteConfig)                    \
  ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:122:70: note: expanded from macro 'SCUDO_TYPED_TEST_TYPE'
  TEST_F(FIXTURE##NAME##_##TYPE, NAME) { FIXTURE##NAME<scudo::TYPE>::Run(); }
                                                                     ^
1 error generated.

Would you be able to assist in resolving this issue?

[fmayer]

In D140932#4056785, @amyk wrote:

Hi, I realized that the clang-ppc64le-rhel bot is exhibiting the following error when building this patch (https://lab.llvm.org/buildbot/#/builders/57/builds/23848/steps/7/logs/stdio):

FAILED: compiler-rt/lib/scudo/standalone/tests/ScudoUnitTestsObjects.combined_test.cpp.powerpc64le.o /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/build/runtimes/runtimes-bins/compiler-rt/lib/scudo/standalone/tests/ScudoUnitTestsObjects.combined_test.cpp.powerpc64le.o 
cd /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/build/runtimes/runtimes-bins/compiler-rt/lib/scudo/standalone/tests && /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/build/./bin/clang -fPIC -fno-semantic-interposition -fvisibility-inlines-hidden -Werror -Werror=date-time -Werror=unguarded-availability-new -Wall -Wextra -Wno-unused-parameter -Wwrite-strings -Wcast-qual -Wmissing-field-initializers -Wimplicit-fallthrough -Wcovered-switch-default -Wno-noexcept-type -Wnon-virtual-dtor -Wdelete-non-virtual-dtor -Wsuggest-override -Wno-comment -Wstring-conversion -Wmisleading-indentation -Wctad-maybe-unsupported -fdiagnostics-color -ffunction-sections -fdata-sections -Wall -Werror -Wno-unused-parameter -Wno-unknown-warning-option -Wthread-safety -Wthread-safety-reference -Wthread-safety-beta -g -Wno-covered-switch-default -Wno-suggest-override -DGTEST_NO_LLVM_SUPPORT=1 -DGTEST_HAS_RTTI=0 -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/include -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone -I/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/include -DGTEST_HAS_RTTI=0 -g -Wno-mismatched-new-delete -m64 -fno-function-sections -c -o ScudoUnitTestsObjects.combined_test.cpp.powerpc64le.o /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp
In file included from /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:10:
In file included from /home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/scudo_unit_test.h:15:
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include/gtest/gtest.h:1628:28: error: comparison of integers of different signs: 'const unsigned long' and 'const int' [-Werror,-Wsign-compare]
GTEST_IMPL_CMP_HELPER_(GT, >);
~~~~~~~~~~~~~~~~~~~~~~~~~~~^~
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include/gtest/gtest.h:1608:12: note: expanded from macro 'GTEST_IMPL_CMP_HELPER_'
  if (val1 op val2) {\
      ~~~~ ^  ~~~~
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:708:3: note: in instantiation of function template specialization 'testing::internal::CmpHelperGT<unsigned long, int>' requested here
  ASSERT_GT(Size, 0);
  ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include/gtest/gtest.h:2076:32: note: expanded from macro 'ASSERT_GT'
# define ASSERT_GT(val1, val2) GTEST_ASSERT_GT(val1, val2)
                               ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/runtimes/../third-party/unittest/googletest/include/gtest/gtest.h:2050:44: note: expanded from macro 'GTEST_ASSERT_GT'
  ASSERT_PRED_FORMAT2(::testing::internal::CmpHelperGT, val1, val2)
                                           ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:705:1: note: in instantiation of member function 'ScudoCombinedTestRingBufferSize<scudo::AndroidSvelteConfig>::Run' requested here
SCUDO_TYPED_TEST(ScudoCombinedTest, RingBufferSize) {
^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:129:3: note: expanded from macro 'SCUDO_TYPED_TEST'
  SCUDO_TYPED_TEST_ALL_TYPES(FIXTURE, NAME)                                    \
  ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:115:3: note: expanded from macro 'SCUDO_TYPED_TEST_ALL_TYPES'
  SCUDO_TYPED_TEST_TYPE(FIXTURE, NAME, AndroidSvelteConfig)                    \
  ^
/home/buildbots/docker-RHEL84-buildbot/SetupBot/worker_env/ppc64le-clang-rhel-test/clang-ppc64le-rhel/llvm-project/compiler-rt/lib/scudo/standalone/tests/combined_test.cpp:122:70: note: expanded from macro 'SCUDO_TYPED_TEST_TYPE'
  TEST_F(FIXTURE##NAME##_##TYPE, NAME) { FIXTURE##NAME<scudo::TYPE>::Run(); }
                                                                     ^
1 error generated.

Would you be able to assist in resolving this issue?

Seems like this was fixed in rG6be602f79cbf501f0e67cee3f926c11fa7490d4f

compiler-rt/lib/scudo/standalone/combined.h

void init() {
 
     Stats.init();
     const s32 ReleaseToOsIntervalMs = getFlags()->release_to_os_interval_ms;
     Primary.init(ReleaseToOsIntervalMs);
     Secondary.init(&Stats, ReleaseToOsIntervalMs);
     Quarantine.init(
         static_cast<uptr>(getFlags()->quarantine_size_kb << 10),
         static_cast<uptr>(getFlags()->thread_local_quarantine_size_kb << 10));
+
+    initRingBuffer();
   }
 
   // Initialize the embedded GWP-ASan instance. Requires the main allocator to
   // be functional, best called from PostInitCallback.
   void initGwpAsan() {
 #ifdef GWP_ASAN_HOOKS
     gwp_asan::options::Options Opt;
     Opt.Enabled = getFlags()->GWP_ASAN_Enabled;
     Opt.MaxSimultaneousAllocations =
#endif // GWP_ASAN_HOOKS
   const char *getRegionInfoArrayAddress() const {
     return Primary.getRegionInfoArrayAddress();
   }
 
   static uptr getRegionInfoArraySize() {
     return PrimaryT::getRegionInfoArraySize();
   }
 
-  const char *getRingBufferAddress() const {
-    return reinterpret_cast<const char *>(&RingBuffer);
+  const char *getRingBufferAddress() {
+    initThreadMaybe();
+    return reinterpret_cast<const char *>(getRingBuffer());
   }
 
-  static uptr getRingBufferSize() { return sizeof(RingBuffer); }
+  uptr getRingBufferSize() {
+    initThreadMaybe();
+    return ringBufferSizeInBytes(getRingBuffer()->Size);
+  }
+
+  static bool setRingBufferSizeForBuffer(char *Buffer, size_t Size) {
+    // Need at least one entry.
+    if (Size < sizeof(AllocationRingBuffer) +
+                   sizeof(typename AllocationRingBuffer::Entry)) {
+      return false;
+    }
+    AllocationRingBuffer *RingBuffer =
+        reinterpret_cast<AllocationRingBuffer *>(Buffer);
+    RingBuffer->Size = (Size - sizeof(AllocationRingBuffer)) /
+                       sizeof(typename AllocationRingBuffer::Entry);
+    return true;
+  }
 
   static const uptr MaxTraceSize = 64;
 
   static void collectTraceMaybe(const StackDepot *Depot,
                                 uintptr_t (&Trace)[MaxTraceSize], u32 Hash) {
     uptr RingPos, Size;
     if (!Depot->find(Hash, &RingPos, &Size))
       return;
     for (unsigned I = 0; I != Size && I != MaxTraceSize; ++I)

 
 #ifdef GWP_ASAN_HOOKS
   gwp_asan::GuardedPoolAllocator GuardedAlloc;
   uptr GuardedAllocSlotSize = 0;
 #endif // GWP_ASAN_HOOKS
 
   StackDepot Depot;
 
   struct AllocationRingBuffer {
     struct Entry {
       atomic_uptr Ptr;
       atomic_uptr AllocationSize;
       atomic_u32 AllocationTrace;
       atomic_u32 AllocationTid;
       atomic_u32 DeallocationTrace;
       atomic_u32 DeallocationTid;
     };
 
     atomic_uptr Pos;
-#ifdef SCUDO_FUZZ
-    static const uptr NumEntries = 2;
-#else
-    static const uptr NumEntries = 32768;
-#endif
-    Entry Entries[NumEntries];
+    u32 Size;
+    // An array of Size (at least one) elements of type Entry is immediately
+    // following to this struct.
   };
-  AllocationRingBuffer RingBuffer = {};
+  // Pointer to memory mapped area starting with AllocationRingBuffer struct,
+  // and immediately followed by Size elements of type Entry.
+  char *RawRingBuffer = {};
 
   // The following might get optimized out by the compiler.
   NOINLINE void performSanityChecks() {
     // Verify that the header offset field can hold the maximum offset. In the
     // case of the Secondary allocator, it takes care of alignment and the
     // offset will always be small. In the case of the Primary, the worst case
     // scenario happens in the last size class, when the backend allocation
     // would already be aligned on the requested alignment, which would happen
     // to be the maximum alignment that would fit in that size class. As a
void storePrimaryAllocationStackMaybe(Options Options, void *Ptr) {
     auto *Ptr32 = reinterpret_cast<u32 *>(Ptr);
     Ptr32[MemTagAllocationTraceIndex] = collectStackTrace();
     Ptr32[MemTagAllocationTidIndex] = getThreadID();
   }
 
   void storeRingBufferEntry(void *Ptr, u32 AllocationTrace, u32 AllocationTid,
                             uptr AllocationSize, u32 DeallocationTrace,
                             u32 DeallocationTid) {
-    uptr Pos = atomic_fetch_add(&RingBuffer.Pos, 1, memory_order_relaxed);
+    uptr Pos = atomic_fetch_add(&getRingBuffer()->Pos, 1, memory_order_relaxed);
     typename AllocationRingBuffer::Entry *Entry =
-        &RingBuffer.Entries[Pos % AllocationRingBuffer::NumEntries];
+        getRingBufferEntry(RawRingBuffer, Pos % getRingBuffer()->Size);
 
     // First invalidate our entry so that we don't attempt to interpret a
     // partially written state in getSecondaryErrorInfo(). The fences below
     // ensure that the compiler does not move the stores to Ptr in between the
     // stores to the other fields.
     atomic_store_relaxed(&Entry->Ptr, 0);
 
     __atomic_signal_fence(__ATOMIC_SEQ_CST);
#endif // GWP_ASAN_HOOKS
 
   static void getRingBufferErrorInfo(struct scudo_error_info *ErrorInfo,
                                      size_t &NextErrorReport,
                                      uintptr_t FaultAddr,
                                      const StackDepot *Depot,
                                      const char *RingBufferPtr) {
     auto *RingBuffer =
         reinterpret_cast<const AllocationRingBuffer *>(RingBufferPtr);
+    if (!RingBuffer)
+      return; //  just in case; called before init
     uptr Pos = atomic_load_relaxed(&RingBuffer->Pos);
 
-    for (uptr I = Pos - 1; I != Pos - 1 - AllocationRingBuffer::NumEntries &&
-                           NextErrorReport != NumErrorReports;
+    for (uptr I = Pos - 1;
+         I != Pos - 1 - RingBuffer->Size && NextErrorReport != NumErrorReports;
          --I) {
-      auto *Entry = &RingBuffer->Entries[I % AllocationRingBuffer::NumEntries];
+      auto *Entry = getRingBufferEntry(RingBufferPtr, I % RingBuffer->Size);
       uptr EntryPtr = atomic_load_relaxed(&Entry->Ptr);
       if (!EntryPtr)
         continue;
 
       uptr UntaggedEntryPtr = untagPointer(EntryPtr);
       uptr EntrySize = atomic_load_relaxed(&Entry->AllocationSize);
       u32 AllocationTrace = atomic_load_relaxed(&Entry->AllocationTrace);
       u32 AllocationTid = atomic_load_relaxed(&Entry->AllocationTid);
#endif // GWP_ASAN_HOOKS
   }
 
   uptr getStats(ScopedString *Str) {
     Primary.getStats(Str);
     Secondary.getStats(Str);
     Quarantine.getStats(Str);
     return Str->length();
   }
+
+  static typename AllocationRingBuffer::Entry *
+  getRingBufferEntry(char *RawRingBuffer, u32 N) {
+    return &reinterpret_cast<typename AllocationRingBuffer::Entry *>(
+        &RawRingBuffer[sizeof(AllocationRingBuffer)])[N];
+  }
+  static const typename AllocationRingBuffer::Entry *
+  getRingBufferEntry(const char *RawRingBuffer, u32 N) {
+    return &reinterpret_cast<const typename AllocationRingBuffer::Entry *>(
+        &RawRingBuffer[sizeof(AllocationRingBuffer)])[N];
+  }
+
+  void initRingBuffer() {
+    u32 AllocationRingBufferSize =
+        static_cast<u32>(getFlags()->allocation_ring_buffer_size);
+    // Have at least one entry so we don't need to special case.
+    if (AllocationRingBufferSize < 1)
+      AllocationRingBufferSize = 1;
+    MapPlatformData Data = {};
+    RawRingBuffer = static_cast<char *>(
+        map(/*Addr=*/nullptr, ringBufferSizeInBytes(AllocationRingBufferSize),
+            "AllocatorRingBuffer", /*Flags=*/0, &Data));
+    auto *RingBuffer = reinterpret_cast<AllocationRingBuffer *>(RawRingBuffer);
+    RingBuffer->Size = AllocationRingBufferSize;
+    static_assert(sizeof(AllocationRingBuffer) %
+                          alignof(typename AllocationRingBuffer::Entry) ==
+                      0,
+                  "invalid alignment");
+  }
+
+  static constexpr u32 ringBufferSizeInBytes(u32 AllocationRingBufferSize) {
+    return sizeof(AllocationRingBuffer) +
+           AllocationRingBufferSize *
+               sizeof(typename AllocationRingBuffer::Entry);
+  }
+
+  inline AllocationRingBuffer *getRingBuffer() {
+    return reinterpret_cast<AllocationRingBuffer *>(RawRingBuffer);
+  }
 };
 
 } // namespace scudo
 
 #endif // SCUDO_COMBINED_H_

compiler-rt/lib/scudo/standalone/flags.inc

 SCUDO_FLAG(int, hard_rss_limit_mb, 0,
            "Hard RSS Limit in Mb. If non-zero, once the limit is achieved, "
            "abort the process")
 
 SCUDO_FLAG(int, soft_rss_limit_mb, 0,
            "Soft RSS Limit in Mb. If non-zero, once the limit is reached, all "
            "subsequent calls will fail or return NULL until the RSS goes below "
            "the soft limit")
+
+SCUDO_FLAG(int, allocation_ring_buffer_size, 32768,
+           "Entries to keep in the allocation ring buffer for scudo.")

compiler-rt/lib/scudo/standalone/fuzz/get_error_info_fuzzer.cpp

std::string RegionInfoBytes =
       FDP.ConsumeRandomLengthString(FDP.remaining_bytes());
   std::vector<char> RegionInfo(AllocatorT::getRegionInfoArraySize(), 0);
   for (size_t i = 0; i < RegionInfoBytes.length() && i < RegionInfo.size();
        ++i) {
     RegionInfo[i] = RegionInfoBytes[i];
   }
 
   std::string RingBufferBytes = FDP.ConsumeRemainingBytesAsString();
-  std::vector<char> RingBuffer(AllocatorT::getRingBufferSize(), 0);
-  for (size_t i = 0; i < RingBufferBytes.length() && i < RingBuffer.size();
-       ++i) {
-    RingBuffer[i] = RingBufferBytes[i];
-  }
+  // RingBuffer is too short.
+  if (!AllocatorT::setRingBufferSizeForBuffer(RingBufferBytes.data(),
+                                              RingBufferBytes.size()))
+    return 0;
 
   scudo_error_info ErrorInfo;
   AllocatorT::getErrorInfo(&ErrorInfo, FaultAddr, StackDepot.data(),
-                           RegionInfo.data(), RingBuffer.data(), Memory,
+                           RegionInfo.data(), RingBufferBytes.data(), Memory,
                            MemoryTags, MemoryAddr, MemorySize);
   return 0;
 }

compiler-rt/lib/scudo/standalone/tests/combined_test.cpp

for (int i = 0; i < nPtrs; ++i) {
       Ptrs.push_back(P);
     }
 
     for (int i = 0; i < nPtrs; ++i)
       Allocator->deallocate(Ptrs[i], Origin);
   }
 }
 
+SCUDO_TYPED_TEST(ScudoCombinedTest, RingBufferSize) {
+  auto *Allocator = this->Allocator.get();
+  auto Size = Allocator->getRingBufferSize();
+  ASSERT_GT(Size, 0);
+  EXPECT_EQ(Allocator->getRingBufferAddress()[Size - 1], '\0');
+}
+
+SCUDO_TYPED_TEST(ScudoCombinedTest, RingBufferAddress) {
+  auto *Allocator = this->Allocator.get();
+  auto *Addr = Allocator->getRingBufferAddress();
+  EXPECT_NE(Addr, nullptr);
+  EXPECT_EQ(Addr, Allocator->getRingBufferAddress());
+}
+
 #if SCUDO_CAN_USE_PRIMARY64
 #if SCUDO_TRUSTY
 
 // TrustyConfig is designed for a domain-specific allocator. Add a basic test
 // which covers only simple operations and ensure the configuration is able to
 // compile.
 TEST(ScudoCombinedTest, BasicTrustyConfig) {
   using AllocatorT = scudo::Allocator<scudo::TrustyConfig>;