[asan] Switch to using dynamic shadow offset on iOS

[zaks.anna]

Summary

The VM layout is not stable between iOS version releases, so switch to dynamic shadow offset.

[kcc]

LGTM
Does it deserve any kind of test?

lib/sanitizer_common/sanitizer_mac.cc

753

if() instead of #if, please

[zaks.anna]

Does it deserve any kind of test?

We have internal buildbots testing a majority of asan tests on iOS. With this patch, dynamic offset will be the default and all tests should still pass. (Unfortunately, our iOS test scripts will not be usable for external developers, so we keep them private.)

Dynamic shadow also works on macOS. However, to test it in CI, we'd need to add an option to TSan runtime that would force to always use dynamic shadow. It would only work on the mac or Windows. Since dynamic shadow is not needed on the mac, so I am not sure it's worth adding the complexity.

[pcc]

Hi Anna,

This change broke one of Chromium's Mac buildbots because the mach_vm.h header is not available.
https://build.chromium.org/p/chromium.fyi/builders/ClangToTMac/builds/11485/steps/gclient%20runhooks/logs/stdio

Do you know what the status of that header is? Is it publically available?

lib/asan/asan_mapping.h

 #  else
 #    define SHADOW_OFFSET kDefaultShadowOffset32
 #  endif
 #else
 #  if SANITIZER_IOS
 #    if SANITIZER_IOSSIM
 #      define SHADOW_OFFSET kIosSimShadowOffset64
 #    else
-#      define SHADOW_OFFSET kIosShadowOffset64
+#      define SHADOW_OFFSET __asan_shadow_memory_dynamic_address
 #    endif
 #  elif defined(__aarch64__)
 #    define SHADOW_OFFSET kAArch64_ShadowOffset64
 #  elif defined(__powerpc64__)
 #    define SHADOW_OFFSET kPPC64_ShadowOffset64
 #  elif defined(__s390x__)
 #    define SHADOW_OFFSET kSystemZ_ShadowOffset64
 #  elif SANITIZER_FREEBSD

lib/sanitizer_common/sanitizer_linux.cc

 # error "Unsupported arch"
 #endif
 }
 
 void MaybeReexec() {
   // No need to re-exec on Linux.
 }
 
+uptr FindAvailableMemoryRange(uptr size, uptr alignment, uptr left_padding) {
+  UNREACHABLE("FindAvailableMemoryRange is not available");
+  return 0;
+}
+
 } // namespace __sanitizer
 
 #endif // SANITIZER_FREEBSD || SANITIZER_LINUX

lib/sanitizer_common/sanitizer_mac.cc

 
 #include <asl.h>
 #include <dlfcn.h>  // for dladdr()
 #include <errno.h>
 #include <fcntl.h>
 #include <libkern/OSAtomic.h>
 #include <mach-o/dyld.h>
 #include <mach/mach.h>
+#include <mach/mach_vm.h>
 #include <mach/vm_statistics.h>
 #include <pthread.h>
 #include <sched.h>
 #include <signal.h>
 #include <stdlib.h>
 #include <sys/mman.h>
 #include <sys/resource.h>
 #include <sys/stat.h>
void MaybeReexec() {
   LeakyResetEnv(kDyldInsertLibraries, new_env);
 }
 #endif  // SANITIZER_GO
 
 char **GetArgv() {
   return *_NSGetArgv();
 }
 
+uptr FindAvailableMemoryRange(uptr shadow_size,
+                              uptr alignment,
+                              uptr left_padding) {
+  typedef vm_region_submap_short_info_data_64_t RegionInfo;
+  enum { kRegionInfoSize = VM_REGION_SUBMAP_SHORT_INFO_COUNT_64 };
+  // Start searching for available memory region past PAGEZERO, which is
+  // 4KB on 32-bit and 4GB on 64-bit.
+#if SANITIZER_WORDSIZE == 32
+  #define START_ADDRESS 0x000000001000;
+#else
+  #define START_ADDRESS 0x000100000000;
+#endif
+
+  mach_vm_address_t address = START_ADDRESS;
+  mach_vm_address_t free_begin = START_ADDRESS;
+  kern_return_t kr = KERN_SUCCESS;
+  while (kr == KERN_SUCCESS) {
+    mach_vm_size_t vmsize = 0;
+    natural_t depth = 0;
+    RegionInfo vminfo;
+    mach_msg_type_number_t count = kRegionInfoSize;
+    kr = mach_vm_region_recurse(mach_task_self(), &address, &vmsize, &depth,
+                                (vm_region_info_t)&vminfo, &count);
+    if (free_begin != address) {
+      // We found a free region [free_begin..address-1].
+      uptr shadow_address = RoundUpTo((uptr)free_begin + left_padding,
+                                      alignment);
+      if (shadow_address + shadow_size < (uptr)address) {
+        return shadow_address;
+      }
+    }
+    // Move to the next region.
+    address += vmsize;
+    free_begin = address;
+  }
+
+  // We looked at all free regions and could not find one large enough.
+  return 0;
+}
+
 // FIXME implement on this platform.
 void GetMemoryProfile(fill_profile_f cb, uptr *stats, uptr stats_size) { }
 
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_MAC

lib/sanitizer_common/sanitizer_posix.cc

SignalContext SignalContext::Create(void *siginfo, void *context) {
   uptr addr = (uptr)si->si_addr;
   uptr pc, sp, bp;
   GetPcSpBp(context, &pc, &sp, &bp);
   WriteFlag write_flag = GetWriteFlag(context);
   bool is_memory_access = si->si_signo == SIGSEGV;
   return SignalContext(context, addr, pc, sp, bp, is_memory_access, write_flag);
 }
 
-uptr FindAvailableMemoryRange(uptr size, uptr alignment, uptr left_padding) {
-  UNREACHABLE("FindAvailableMemoryRange is not available");
-  return 0;
-}
-
 } // namespace __sanitizer
 
 #endif // SANITIZER_POSIX