[GWP-ASan] Handle wild touches of the guarded pool.

[hctim]

Summary

AllocMeta could be null when returned from __gwp_asan_get_metadata() for
a bad access into the GuardedPagePool that was never allocated.
Currently, then we dereference the null pointer, oops.

Hoist the check up and print a message (only once in recoverable mode)
about the bad memory access.

compiler-rt/lib/gwp_asan/optional/segv_handler_posix.cpp

OutOfBoundsAndUseAfterFreeWarning =
         "has already been overwritten and is likely bogus)";
   }
 
   Printf("%s%s at 0x%zx %sby thread %s here:\n", gwp_asan::ErrorToString(E),
          OutOfBoundsAndUseAfterFreeWarning, AccessPtr, DescriptionBuffer,
          ThreadBuffer);
 }
 
+static bool HasReportedBadPoolAccess = false;
+static const char *kUnknownCrashText =
+    "GWP-ASan cannot provide any more information about this error. This may "
+    "occur due to a wild memory access into the GWP-ASan pool, or an "
+    "overflow/underflow that is > 512B in length.\n";
+
 void dumpReport(uintptr_t ErrorPtr, const gwp_asan::AllocatorState *State,
                 const gwp_asan::AllocationMetadata *Metadata,
                 SegvBacktrace_t SegvBacktrace, Printf_t Printf,
                 PrintBacktrace_t PrintBacktrace, void *Context) {
   assert(State && "dumpReport missing Allocator State.");
   assert(Metadata && "dumpReport missing Metadata.");
   assert(Printf && "dumpReport missing Printf.");
   assert(__gwp_asan_error_is_mine(State, ErrorPtr) &&
          "dumpReport() called on a non-GWP-ASan error.");
 
   uintptr_t InternalErrorPtr =
       __gwp_asan_get_internal_crash_address(State, ErrorPtr);
   if (InternalErrorPtr)
     ErrorPtr = InternalErrorPtr;
 
   const gwp_asan::AllocationMetadata *AllocMeta =
       __gwp_asan_get_metadata(State, Metadata, ErrorPtr);
 
+  if (AllocMeta == nullptr) {
+    if (HasReportedBadPoolAccess) return;
+    HasReportedBadPoolAccess = true;
+    Printf("*** GWP-ASan detected a memory error ***\n");
+    ScopedEndOfReportDecorator Decorator(Printf);
+    Printf(kUnknownCrashText);
+    return;
+  }
+
   // It's unusual for a signal handler to be invoked multiple times for the same
   // allocation, but it's possible in various scenarios, like:
   //  1. A double-free or invalid-free was invoked in one thread at the same
   //     time as a buffer-overflow or use-after-free in another thread, or
   //  2. Two threads do a use-after-free or buffer-overflow at the same time.
   // In these instances, we've already dumped a report for this allocation, so
   // skip dumping this issue as well.
   if (AllocMeta->HasCrashed)
     return;
 
   Printf("*** GWP-ASan detected a memory error ***\n");
   ScopedEndOfReportDecorator Decorator(Printf);
 
   Error E = __gwp_asan_diagnose_error(State, Metadata, ErrorPtr);
   if (E == Error::UNKNOWN) {
-    Printf("GWP-ASan cannot provide any more information about this error. "
-           "This may occur due to a wild memory access into the GWP-ASan pool, "
-           "or an overflow/underflow that is > 512B in length.\n");
+    Printf(kUnknownCrashText);
     return;
   }
 
   // Print the error header.
   printHeader(E, ErrorPtr, AllocMeta, Printf);
 
   // Print the fault backtrace.
   static constexpr unsigned kMaximumStackFramesForCrashTrace = 512;
   uintptr_t Trace[kMaximumStackFramesForCrashTrace];
   size_t TraceLength =
       SegvBacktrace(Trace, kMaximumStackFramesForCrashTrace, Context);
 
   PrintBacktrace(Trace, TraceLength, Printf);
 
-  if (AllocMeta == nullptr)
-    return;
-
   // Maybe print the deallocation trace.
   if (__gwp_asan_is_deallocated(AllocMeta)) {
     uint64_t ThreadID = __gwp_asan_get_deallocation_thread_id(AllocMeta);
     if (ThreadID == gwp_asan::kInvalidThreadID)
       Printf("0x%zx was deallocated by thread <unknown> here:\n", ErrorPtr);
     else
       Printf("0x%zx was deallocated by thread %zu here:\n", ErrorPtr, ThreadID);
     TraceLength = __gwp_asan_get_deallocation_trace(

compiler-rt/lib/gwp_asan/tests/CMakeLists.txt

set(GWP_ASAN_UNITTESTS
   driver.cpp
   mutex_test.cpp
   slot_reuse.cpp
   thread_contention.cpp
   harness.cpp
   enable_disable.cpp
   late_init.cpp
   options.cpp
-  recoverable.cpp)
+  recoverable.cpp
+  never_allocated.cpp)
 
 set(GWP_ASAN_UNIT_TEST_HEADERS
   ${GWP_ASAN_HEADERS}
   harness.h)
 
 add_custom_target(GwpAsanUnitTests)
 set_target_properties(GwpAsanUnitTests PROPERTIES FOLDER "Compiler-RT Tests")
 

compiler-rt/lib/gwp_asan/tests/backtrace.cpp

EXPECT_TRUE(std::regex_search(
       GetOutputBuffer(),
       std::basic_regex(DeathRegex, std::regex_constants::extended)))
       << "Regex \"" << DeathRegex
       << "\" was not found in input:\n============\n"
       << GetOutputBuffer() << "\n============";
   ;
 }
 
-INSTANTIATE_TEST_SUITE_P(RecoverableSignalDeathTest,
-                         BacktraceGuardedPoolAllocatorDeathTest,
-                         /* Recoverable */ testing::Bool());
-
 TEST(Backtrace, Short) {
   gwp_asan::AllocationMetadata Meta;
   Meta.AllocationTrace.RecordBacktrace(
       [](uintptr_t *TraceBuffer, size_t /* Size */) -> size_t {
         TraceBuffer[0] = 123u;
         TraceBuffer[1] = 321u;
         return 2u;
       });

compiler-rt/lib/gwp_asan/tests/harness.h

 }; // namespace test
 }; // namespace gwp_asan
 
 char *AllocateMemory(gwp_asan::GuardedPoolAllocator &GPA);
 void DeallocateMemory(gwp_asan::GuardedPoolAllocator &GPA, void *Ptr);
 void DeallocateMemory2(gwp_asan::GuardedPoolAllocator &GPA, void *Ptr);
 void TouchMemory(void *Ptr);
 
+void CheckOnlyOneGwpAsanCrash(const std::string &OutputBuffer);
+
 class DefaultGuardedPoolAllocator : public Test {
 public:
   void SetUp() override {
     gwp_asan::options::Options Opts;
     Opts.setDefaults();
     MaxSimultaneousAllocations = Opts.MaxSimultaneousAllocations;
 
     Opts.InstallForkHandlers = gwp_asan::test::OnlyOnce();

compiler-rt/lib/gwp_asan/tests/harness.cpp

 //===-- harness.cpp ---------------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "gwp_asan/tests/harness.h"
 
+#include <string>
+
 namespace gwp_asan {
 namespace test {
 bool OnlyOnce() {
   static int x = 0;
   return !x++;
 }
 } // namespace test
 } // namespace gwp_asan

 }
 __attribute__((optnone)) void
 DeallocateMemory2(gwp_asan::GuardedPoolAllocator &GPA, void *Ptr) {
   GPA.deallocate(Ptr);
 }
 __attribute__((optnone)) void TouchMemory(void *Ptr) {
   *(reinterpret_cast<volatile char *>(Ptr)) = 7;
 }
+
+void CheckOnlyOneGwpAsanCrash(const std::string &OutputBuffer) {
+  const char *kGwpAsanErrorString = "GWP-ASan detected a memory error";
+  size_t FirstIndex = OutputBuffer.find(kGwpAsanErrorString);
+  ASSERT_NE(FirstIndex, std::string::npos) << "Didn't detect a GWP-ASan crash";
+  ASSERT_EQ(OutputBuffer.find(kGwpAsanErrorString, FirstIndex + 1),
+            std::string::npos)
+      << "Detected more than one GWP-ASan crash:\n"
+      << OutputBuffer;
+}
+
+INSTANTIATE_TEST_SUITE_P(RecoverableTests, BacktraceGuardedPoolAllocator,
+                         /* Recoverable */ testing::Values(true));
+INSTANTIATE_TEST_SUITE_P(RecoverableAndNonRecoverableTests,
+                         BacktraceGuardedPoolAllocatorDeathTest,
+                         /* Recoverable */ testing::Bool());

compiler-rt/lib/gwp_asan/tests/never_allocated.cpp

+//===-- never_allocated.cpp -------------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include <string>
+
+#include "gwp_asan/common.h"
+#include "gwp_asan/crash_handler.h"
+#include "gwp_asan/tests/harness.h"
+
+TEST_P(BacktraceGuardedPoolAllocatorDeathTest, NeverAllocated) {
+  SCOPED_TRACE("");
+  void *Ptr = GPA.allocate(0x1000);
+  GPA.deallocate(Ptr);
+
+  std::string DeathNeedle =
+      "GWP-ASan cannot provide any more information about this error";
+
+  // Trigger a guard page in a completely different slot that's never allocated.
+  // Previously, there was a bug that this would result in nullptr-dereference
+  // in the posix crash handler.
+  char *volatile NeverAllocatedPtr = static_cast<char *>(Ptr) + 0x3000;
+  if (!Recoverable) {
+    ASSERT_DEATH(*NeverAllocatedPtr = 0, DeathNeedle);
+    return;
+  }
+
+  *NeverAllocatedPtr = 0;
+  CheckOnlyOneGwpAsanCrash(GetOutputBuffer());
+  ASSERT_NE(std::string::npos, GetOutputBuffer().find(DeathNeedle));
+
+  // Check that subsequent invalid touches of the pool don't print a report.
+  GetOutputBuffer().clear();
+  for (size_t i = 0; i < 100; ++i) {
+    *NeverAllocatedPtr = 0;
+    *(NeverAllocatedPtr + 0x2000) = 0;
+    *(NeverAllocatedPtr + 0x3000) = 0;
+    ASSERT_TRUE(GetOutputBuffer().empty());
+  }
+
+  // Check that reports on the other slots still report a double-free, but only
+  // once.
+  GetOutputBuffer().clear();
+  GPA.deallocate(Ptr);
+  ASSERT_NE(std::string::npos, GetOutputBuffer().find("Double Free"));
+  GetOutputBuffer().clear();
+  for (size_t i = 0; i < 100; ++i) {
+    DeallocateMemory(GPA, Ptr);
+    ASSERT_TRUE(GetOutputBuffer().empty());
+  }
+}

compiler-rt/lib/gwp_asan/tests/recoverable.cpp

 #include <string>
 #include <thread>
 #include <vector>
 
 #include "gwp_asan/common.h"
 #include "gwp_asan/crash_handler.h"
 #include "gwp_asan/tests/harness.h"
 
-void CheckOnlyOneGwpAsanCrash(const std::string &OutputBuffer) {
-  const char *kGwpAsanErrorString = "GWP-ASan detected a memory error";
-  size_t FirstIndex = OutputBuffer.find(kGwpAsanErrorString);
-  ASSERT_NE(FirstIndex, std::string::npos) << "Didn't detect a GWP-ASan crash";
-  ASSERT_EQ(OutputBuffer.find(kGwpAsanErrorString, FirstIndex + 1),
-            std::string::npos)
-      << "Detected more than one GWP-ASan crash:\n"
-      << OutputBuffer;
-}
-
 TEST_P(BacktraceGuardedPoolAllocator, MultipleDoubleFreeOnlyOneOutput) {
   SCOPED_TRACE("");
   void *Ptr = AllocateMemory(GPA);
   DeallocateMemory(GPA, Ptr);
   // First time should generate a crash report.
   DeallocateMemory(GPA, Ptr);
   CheckOnlyOneGwpAsanCrash(GetOutputBuffer());
   ASSERT_NE(std::string::npos, GetOutputBuffer().find("Double Free"));

 }
 
 TEST_P(BacktraceGuardedPoolAllocator, InterThreadThrashingSingleAlloc) {
   SCOPED_TRACE("");
   constexpr unsigned kNumIterations = 100000;
   runInterThreadThrashingSingleAlloc(kNumIterations, &GPA);
   CheckOnlyOneGwpAsanCrash(GetOutputBuffer());
 }
-
-INSTANTIATE_TEST_SUITE_P(RecoverableTests, BacktraceGuardedPoolAllocator,
-                         /* Recoverable */ testing::Values(true));