[HWASAN] Implement munmap interceptor for HWASAN

[kstoimenov]

Updated comment.

[kstoimenov]

Updated order.

[thurston]

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

216

HWASan's mmap interceptor does not tag memory or allow MAP_FIXED with a tagged address, so there should be no need to zero-tag memory in the munmap interceptor. (To the extent that zero-tagging fixes anything, it means there is a bug elsewhere.)

[thurston]

compiler-rt/test/hwasan/TestCases/munmap.c

26

What is the purpose of testing that this works? Tagging the pointer and memory for an mmap'ed allocation is not something that should happen in practice.

[kstoimenov]

compiler-rt/test/hwasan/TestCases/munmap.c

26

Here is my understanding of what is going on. Feel free to double-check with vitalybuka@. While we investigated a bug we figured out that the area for the stack is mmaped. After that HWASAN tags that memory during execution from instrumented code to detect UAR. What happens after that the process uses vfork to spawn a child process where we get the tag mismatch error. The reason is that the memory is unmmaped in the child process without being untagged and then the next mmap request returns the same memory with tagged shadow memory.

[thurston]

compiler-rt/test/hwasan/TestCases/munmap.c

26

Wouldn't it be better to zero-tag the memory in the mmap interceptor, rather than the munmap interceptor? It would mean that un-mmap'ed pages would continue to be protected against illegal accesses, until such time that the memory is actually reused by mmap.

[kstoimenov]

Fixed unmap.

[vitalybuka]

we need the same for Asan, in a separate patch

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

208

Let's do __hwasan::TagMemoryAligned(reinterpret_cast<uptr>(addr), length, 0); here as well

compiler-rt/test/hwasan/TestCases/munmap.c

26

pages are already protected as they are not mapped, so you'll get segv
TagMemoryAligned(...0) will also release unused physical pages

I guess it will not hurt to zero tag in mmap as well.
Reason is that some user code can mmap/munmap avoiding our interceptors, so these two checkpoints to fix them up

30

as this is hwasan test, you can use __hwasan_test_shadow, it's going to be simple:

__hwasan_tag_memory
mmap(fixed)
__hwasan_test_shadow

__hwasan_tag_memory
munmap
__hwasan_test_shadow

[kstoimenov]

Updated the test.

[kstoimenov]

compiler-rt/test/hwasan/TestCases/munmap.c

30

Also added some extra checks. PTAL.

[vitalybuka]

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

210

it need to be under
if (res != (void *)-1) {

compiler-rt/test/hwasan/TestCases/munmap.c

43

please add __hwasan_test_shadow(r) just after munmap

43

and then tag again before mmap(r, FIXED

[vitalybuka]

LGTM with fixes above

[kstoimenov]

Address comments.

[kstoimenov]

Updated to TagMem.

[kstoimenov]

Breaks the build bot. Will fix forward.

[kstoimenov]

Switched to unaligned.

[kstoimenov]

Will submit as separate patch.

compiler-rt/lib/hwasan/hwasan_interceptors.cpp

if (res != (void *)-1) {
     void *end_res = (char *)res + (rounded_length - 1);
     if (!MemIsApp(reinterpret_cast<uptr>(res)) ||
         !MemIsApp(reinterpret_cast<uptr>(end_res))) {
       // Application has attempted to map more memory than is supported by
       // HWASan. Act as if we ran out of memory.
       internal_munmap(res, length);
       errno = errno_ENOMEM;
       return (void *)-1;
     }
   }
 
   return res;
 }
 
+template <class Munmap>
+static int munmap_interceptor(Munmap real_munmap, void *addr, SIZE_T length) {
+  __hwasan::TagMemoryAligned(reinterpret_cast<uptr>(addr), length, 0);
+  return real_munmap(addr, length);
+}
+
 #    define COMMON_INTERCEPTOR_MMAP_IMPL(ctx, mmap, addr, length, prot, flags, \
                                          fd, offset)                           \
       do {                                                                     \
         (void)(ctx);                                                           \
         return mmap_interceptor(REAL(mmap), addr, sz, prot, flags, fd, off);   \
       } while (false)
 
+#    define COMMON_INTERCEPTOR_MUNMAP_IMPL(ctx, mmap, addr, length)            \
+      do {                                                                     \
+        (void)(ctx);                                                           \
+        return munmap_interceptor(REAL(mmap), addr, sz);                       \
+      } while (false)
+
 #    include "sanitizer_common/sanitizer_common_interceptors_memintrinsics.inc"
 #    include "sanitizer_common/sanitizer_common_interceptors.inc"
 
 struct ThreadStartArg {
   __sanitizer_sigset_t starting_sigset_;
 };
 
 static void *HwasanThreadStartFunc(void *arg) {

compiler-rt/test/hwasan/TestCases/munmap.c

+// RUN: %clang_hwasan  %s -o %t
+// RUN: %run %t 2>&1
+
+// REQUIRES: aarch64-target-arch
+
+#include <sanitizer/hwasan_interface.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <sys/mman.h>
+
+int main(int argc, char **argv) {
+  int size = 4096;
+  int tag = 74;
+  int val = 42;
+  void *r = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE,
+                 -1, 0);
+  int *p1 = __hwasan_tag_pointer(r, tag);
+  if (r == MAP_FAILED) {
+    fprintf(stderr, "Failed to mmap\n");
+    abort();
+  }
+  __hwasan_tag_memory(r, tag, size);
+  *p1 = 42;
+  munmap(r, size);
+  // Remap the same address and make sure we can access it with an untagged pointer.
+  int *p2 = (int*) mmap(r, size, PROT_READ | PROT_WRITE, MAP_ANON | MAP_PRIVATE,
+                 -1, 0);
+  *p2 = 42;
+  return 0;
+}
 No newline at end of file