Add __sanitizer_get_allocation_bounds API and implementations

[thurston]

Summary

This function will return whether a pointer lies within an allocation, and if so,
the start and size of the allocation.

It will be useful for detecting dynamic TLS allocations in glibc >=2.25, which
uses malloc (see https://github.com/google/sanitizers/issues/1409#issuecomment-1214244142).

[thurston]

Meant to be part of https://reviews.llvm.org/D147005

compiler-rt/include/sanitizer/allocator_interface.h

#endif
   /* Returns true if p was returned by the allocator and
      is not yet freed. */
   int __sanitizer_get_ownership(const volatile void *p);
 
   /* Returns the number of bytes reserved for the pointer p.
      Requires (get_ownership(p) == true) or (p == 0). */
   size_t __sanitizer_get_allocated_size(const volatile void *p);
 
+  /* If a pointer lies within an allocation (not necessarily the start), it
+     will return 1, and store the start and size in the referenced parameters.
+     Otherwise, it returns 0. */
+  int __sanitizer_get_allocation_bounds(const void *p, void **start,
+                                        unsigned long long *size);
+
   /* Number of bytes, allocated and not yet freed by the application. */
   size_t __sanitizer_get_current_allocated_bytes(void);
 
   /* Number of bytes, mmaped by the allocator to fulfill allocation requests.
      Generally, for request of X bytes, allocator can reserve and add to free
      lists a large number of chunks of size X to use them for future requests.
      All these chunks count toward the heap size. Currently, allocator never
      releases memory to OS (instead, it just puts freed chunks to free

compiler-rt/lib/asan/asan_allocator.cpp

uptr __sanitizer_get_allocated_size(const void *p) {
   // Die if p is not malloced or if it is already freed.
   if (allocated_size == 0) {
     GET_STACK_TRACE_FATAL_HERE;
     ReportSanitizerGetAllocatedSizeNotOwned(ptr, &stack);
   }
   return allocated_size;
 }
 
+int __sanitizer_get_allocation_bounds(const void *p, void **start, unsigned long long *size) {
+  AsanChunk *m = __asan::instance.GetAsanChunkByAddr((uptr)p);
+  if (!m) return 0;
+  if (atomic_load(&m->chunk_state, memory_order_acquire) != CHUNK_ALLOCATED)
+    return 0;
+  if (m->UsedSize() == 0) return 0;
+  *start = (void*)(m->Beg());
+  *size = m->UsedSize();
+  return 1;
+}
+
 void __sanitizer_purge_allocator() {
   GET_STACK_TRACE_MALLOC;
   instance.Purge(&stack);
 }
 
 int __asan_update_allocation_context(void* addr) {
   GET_STACK_TRACE_MALLOC;
   return instance.UpdateAllocationStack((uptr)addr, &stack);
 }

compiler-rt/lib/dfsan/dfsan_allocator.cpp

 
 uptr __sanitizer_get_unmapped_bytes() { return 1; }
 
 uptr __sanitizer_get_estimated_allocated_size(uptr size) { return size; }
 
 int __sanitizer_get_ownership(const void *p) { return AllocationSize(p) != 0; }
 
 uptr __sanitizer_get_allocated_size(const void *p) { return AllocationSize(p); }
+
+int __sanitizer_get_allocation_bounds(const void *p, void **start,
+                                      unsigned long long *size) {
+  if (!p)
+    return 0;
+  const void *beg = allocator.GetBlockBegin(p);
+  if (beg == nullptr)
+    return 0;
+  Metadata *b = (Metadata *)allocator.GetMetaData(beg);
+  if (b == nullptr)
+    return 0;
+  if (b->requested_size == 0)
+    return 0;
+  *start = (void *)beg;
+  *size = b->requested_size;
+  return 1;
+}

compiler-rt/lib/hwasan/hwasan_allocator.cpp

 
 uptr __sanitizer_get_unmapped_bytes() { return 1; }
 
 uptr __sanitizer_get_estimated_allocated_size(uptr size) { return size; }
 
 int __sanitizer_get_ownership(const void *p) { return AllocationSize(p) != 0; }
 
 uptr __sanitizer_get_allocated_size(const void *p) { return AllocationSize(p); }
+
+int __sanitizer_get_allocation_bounds(const void *p, void **start, unsigned long long *size) {
+  const void *untagged_ptr = UntagPtr(p);
+  if (!untagged_ptr) return 0;
+  const void *beg = allocator.GetBlockBegin(untagged_ptr);
+  if (beg == nullptr) return 0;
+  Metadata *b = (Metadata *)allocator.GetMetaData(beg);
+  if (b->GetRequestedSize() == 0) return 0;
+  *start = (void*)beg;
+  *size = b->GetRequestedSize();
+  return 1;
+}

compiler-rt/lib/lsan/lsan_allocator.cpp

 SANITIZER_INTERFACE_ATTRIBUTE
 int __sanitizer_get_ownership(const void *p) { return Metadata(p) != nullptr; }
 
 SANITIZER_INTERFACE_ATTRIBUTE
 uptr __sanitizer_get_allocated_size(const void *p) {
   return GetMallocUsableSize(p);
 }
 
+SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
+int __sanitizer_get_allocation_bounds(const void *p, void **start, unsigned long long *size) {
+  if (!p) return 0;
+  const void *beg = allocator.GetBlockBegin(p);
+  if (beg == nullptr) return 0;
+  ChunkMetadata *m = Metadata(beg);
+  if (m == nullptr) return 0;
+  if (!m->allocated) return 0;
+  if (m->requested_size == 0) return 0;
+  *start = (void*)beg;
+  *size = m->requested_size;
+  return 1;
+}
+
 } // extern "C"

compiler-rt/lib/memprof/memprof_allocator.cpp

 int __sanitizer_get_ownership(const void *p) {
   return memprof_malloc_usable_size(p, 0, 0) != 0;
 }
 
 uptr __sanitizer_get_allocated_size(const void *p) {
   return memprof_malloc_usable_size(p, 0, 0);
 }
 
+int __sanitizer_get_allocation_bounds(const void *p, void **start, unsigned long long *size) {
+  u64 user_requested_size;
+  MemprofChunk *m = instance.GetMemprofChunkByAddr((uptr)p, user_requested_size);
+  if (!m)
+    return 0;
+  if (user_requested_size == 0) return 0;
+  *start = (void*)m->Beg();
+  *size = user_requested_size;
+  return 1;
+}
+
 int __memprof_profile_dump() {
   instance.FinishAndWrite();
   // In the future we may want to return non-zero if there are any errors
   // detected during the dumping process.
   return 0;
 }

compiler-rt/lib/msan/msan_allocator.cpp

 
 uptr __sanitizer_get_unmapped_bytes() { return 1; }
 
 uptr __sanitizer_get_estimated_allocated_size(uptr size) { return size; }
 
 int __sanitizer_get_ownership(const void *p) { return AllocationSize(p) != 0; }
 
 uptr __sanitizer_get_allocated_size(const void *p) { return AllocationSize(p); }
+
+int __sanitizer_get_allocation_bounds(const void *p, void **start, unsigned long long *size) {
+  if (!p) return 0;
+  const void *beg = allocator.GetBlockBegin(p);
+  if (beg == nullptr) return 0;
+  Metadata *b = (Metadata *)allocator.GetMetaData(beg);
+  if (b == nullptr) return 0;
+  if (b->requested_size == 0) return 0;
+  *start = (void*)beg;
+  *size = b->requested_size;
+  return 1;
+}

compiler-rt/lib/sanitizer_common/sanitizer_allocator_interface.h

SANITIZER_INTERFACE_ATTRIBUTE int __sanitizer_install_malloc_and_free_hooks(
     void (*malloc_hook)(const void *, uptr),
     void (*free_hook)(const void *));
 
 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
     void __sanitizer_malloc_hook(void *ptr, uptr size);
 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
     void __sanitizer_free_hook(void *ptr);
 
+SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE int
+__sanitizer_get_allocation_bounds(const void *p, void **start,
+                                  unsigned long long *size);
+
 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE void
 __sanitizer_purge_allocator();
 
 SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE void
 __sanitizer_print_memory_profile(uptr top_percent, uptr max_number_of_contexts);
 }  // extern "C"
 
 #endif  // SANITIZER_ALLOCATOR_INTERFACE_H

compiler-rt/lib/sanitizer_common/sanitizer_common_interface.inc

 INTERFACE_WEAK_FUNCTION(__sanitizer_weak_hook_strncmp)
 INTERFACE_WEAK_FUNCTION(__sanitizer_weak_hook_strstr)
 // Stacktrace interface.
 INTERFACE_FUNCTION(__sanitizer_get_module_and_offset_for_pc)
 INTERFACE_FUNCTION(__sanitizer_symbolize_global)
 INTERFACE_FUNCTION(__sanitizer_symbolize_pc)
 // Allocator interface.
 INTERFACE_FUNCTION(__sanitizer_get_allocated_size)
+INTERFACE_FUNCTION(__sanitizer_get_allocation_bounds)
 INTERFACE_FUNCTION(__sanitizer_get_current_allocated_bytes)
 INTERFACE_FUNCTION(__sanitizer_get_estimated_allocated_size)
 INTERFACE_FUNCTION(__sanitizer_get_free_bytes)
 INTERFACE_FUNCTION(__sanitizer_get_heap_size)
 INTERFACE_FUNCTION(__sanitizer_get_ownership)
 INTERFACE_FUNCTION(__sanitizer_get_unmapped_bytes)
 INTERFACE_FUNCTION(__sanitizer_install_malloc_and_free_hooks)
 INTERFACE_FUNCTION(__sanitizer_purge_allocator)
 INTERFACE_FUNCTION(__sanitizer_print_memory_profile)
 INTERFACE_WEAK_FUNCTION(__sanitizer_free_hook)
 INTERFACE_WEAK_FUNCTION(__sanitizer_malloc_hook)

compiler-rt/lib/tsan/rtl/tsan_mman.cpp

 int __sanitizer_get_ownership(const void *p) {
   return allocator()->GetBlockBegin(p) != 0;
 }
 
 uptr __sanitizer_get_allocated_size(const void *p) {
   return user_alloc_usable_size(p);
 }
 
+int __sanitizer_get_allocation_bounds(const void *p, void **start, unsigned long long *size) {
+  if (p == 0 || !IsAppMem((uptr)p))
+    return 0;
+  const void *beg = allocator()->GetBlockBegin(p);
+  if (beg == nullptr) return 0;
+
+  MBlock *b = ctx->metamap.GetBlock((uptr)beg);
+  if (!b)
+    return 0; // Not a valid pointer.
+
+  *start = (void*)beg;
+
+  if (b->siz == 0) {
+    *size = 1; // Zero-sized allocations are actually 1 byte.
+  } else {
+    *size = b->siz;
+  }
+  return 1;
+}
+
 void __tsan_on_thread_idle() {
   ThreadState *thr = cur_thread();
   allocator()->SwallowCache(&thr->proc()->alloc_cache);
   internal_allocator()->SwallowCache(&thr->proc()->internal_alloc_cache);
   ctx->metamap.OnProcIdle(thr->proc());
 }
 }  // extern "C"

compiler-rt/test/sanitizer_common/TestCases/get_allocation_bounds.cpp

+// RUN: %clangxx -O0 -g %s -o %t && %run %t
+
+#include <assert.h>
+#include <sanitizer/allocator_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+
+// Based on lib/msan/tests/msan_test.cpp::get_allocated_size_and_ownership
+int main(void) {
+  char *array = reinterpret_cast<char *>(malloc(100));
+  int *int_ptr = new int;
+  printf("array: %p\n", array);
+  printf("int_ptr: %p\n", int_ptr);
+
+  // Bogus values to unpoison these. Calling __sanitizer_get_allocation_bounds
+  // does not unpoison them.
+  void *start = NULL;
+  unsigned long long size = 666;
+  for (int i = 0; i < 100; i++) {
+    printf("i: %d\n", i);
+
+    printf("Bounds ok? %d\n",
+           __sanitizer_get_allocation_bounds(array + i, &start, &size));
+    fflush(stdout);
+    assert(__sanitizer_get_allocation_bounds(array + i, &start, &size));
+    printf("Size: %llu\n", size);
+    fflush(stdout);
+    printf("Start: %p\n", start);
+    fflush(stdout);
+    assert(array == start);
+    assert(100U == size);
+  }
+
+  assert(__sanitizer_get_allocation_bounds(int_ptr, &start, &size));
+  assert(int_ptr == start);
+  assert(sizeof(*int_ptr) == size);
+
+  void *wild_addr = reinterpret_cast<void *>(4096 * 160);
+  assert(!__sanitizer_get_allocation_bounds(wild_addr, &start, &size));
+
+  wild_addr = reinterpret_cast<void *>(0x1);
+  assert(!__sanitizer_get_allocation_bounds(wild_addr, &start, &size));
+
+  // NULL is a valid argument for GetAllocatedSize but is not owned.
+  assert(!__sanitizer_get_allocation_bounds(NULL, &start, &size));
+
+  free(array);
+  for (int i = 0; i < 100; i++) {
+    assert(!__sanitizer_get_allocation_bounds(array + i, &start, &size));
+  }
+
+  delete int_ptr;
+  assert(!__sanitizer_get_allocation_bounds(int_ptr, &start, &size));
+
+  return 0;
+}