Don't read non-readable address ranges during lsan pointer scanning

[fjricci]

Summary

This specifically addresses the Mach-O zero page, which we cannot read from.

[alekseyshl]

lib/sanitizer_common/sanitizer_linux_libcdep.cc

449

bool readable = phdr->p_flags & PF_R; and use it later

lib/sanitizer_common/sanitizer_procmaps_common.cc

145

Maybe "prot & kProtectionRead"?

lib/sanitizer_common/sanitizer_procmaps_mac.cc

266

Maybe "prot & kProtectionRead"?

[fjricci]

Address comments

lib/lsan/lsan_common_mac.cc

void ProcessGlobalRegions(Frontier *frontier) {
   memory_mapping.DumpListOfModules(&modules);
   for (uptr i = 0; i < modules.size(); ++i) {
     // Even when global scanning is disabled, we still need to scan
     // system libraries for stashed pointers
     if (!flags()->use_globals && modules[i].instrumented()) continue;
 
     for (const __sanitizer::LoadedModule::AddressRange &range :
          modules[i].ranges()) {
-      if (range.executable) continue;
+      if (range.executable || !range.readable) continue;
 
       ScanGlobalRange(range.beg, range.end, frontier);
     }
   }
 }
 
 void ProcessPlatformSpecificAllocations(Frontier *frontier) {
   CHECK(0 && "unimplemented");

lib/sanitizer_common/sanitizer_common.h

LoadedModule()
         instrumented_(false) {
     internal_memset(uuid_, 0, kModuleUUIDSize);
     ranges_.clear();
   }
   void set(const char *module_name, uptr base_address);
   void set(const char *module_name, uptr base_address, ModuleArch arch,
            u8 uuid[kModuleUUIDSize], bool instrumented);
   void clear();
-  void addAddressRange(uptr beg, uptr end, bool executable);
+  void addAddressRange(uptr beg, uptr end, bool executable, bool readable);
   bool containsAddress(uptr address) const;
 
   const char *full_name() const { return full_name_; }
   uptr base_address() const { return base_address_; }
   uptr max_executable_address() const { return max_executable_address_; }
   ModuleArch arch() const { return arch_; }
   const u8 *uuid() const { return uuid_; }
   bool instrumented() const { return instrumented_; }
 
   struct AddressRange {
     AddressRange *next;
     uptr beg;
     uptr end;
     bool executable;
+    bool readable;
 
-    AddressRange(uptr beg, uptr end, bool executable)
-        : next(nullptr), beg(beg), end(end), executable(executable) {}
+    AddressRange(uptr beg, uptr end, bool executable, bool readable)
+        : next(nullptr),
+          beg(beg),
+          end(end),
+          executable(executable),
+          readable(readable) {}
   };
 
   const IntrusiveList<AddressRange> &ranges() const { return ranges_; }
 
  private:
   char *full_name_;  // Owned.
   uptr base_address_;
   uptr max_executable_address_;

lib/sanitizer_common/sanitizer_common.cc

void LoadedModule::clear() {
   instrumented_ = false;
   while (!ranges_.empty()) {
     AddressRange *r = ranges_.front();
     ranges_.pop_front();
     InternalFree(r);
   }
 }
 
-void LoadedModule::addAddressRange(uptr beg, uptr end, bool executable) {
+void LoadedModule::addAddressRange(uptr beg, uptr end, bool executable,
+                                   bool readable) {
   void *mem = InternalAlloc(sizeof(AddressRange));
-  AddressRange *r = new(mem) AddressRange(beg, end, executable);
+  AddressRange *r = new(mem) AddressRange(beg, end, executable, readable);
   ranges_.push_back(r);
   if (executable && end > max_executable_address_)
     max_executable_address_ = end;
 }
 
 bool LoadedModule::containsAddress(uptr address) const {
   for (const AddressRange &r : ranges()) {
     if (r.beg <= address && address < r.end)

lib/sanitizer_common/sanitizer_linux_libcdep.cc

if (module_name[0] == '\0')
     return 0;
   LoadedModule cur_module;
   cur_module.set(module_name.data(), info->dlpi_addr);
   for (int i = 0; i < info->dlpi_phnum; i++) {
     const Elf_Phdr *phdr = &info->dlpi_phdr[i];
     if (phdr->p_type == PT_LOAD) {
       uptr cur_beg = info->dlpi_addr + phdr->p_vaddr;
       uptr cur_end = cur_beg + phdr->p_memsz;
       bool executable = phdr->p_flags & PF_X;
-      cur_module.addAddressRange(cur_beg, cur_end, executable);
+      cur_module.addAddressRange(cur_beg, cur_end, executable,
+                                 /*readable*/ true);
     }
   }
   data->modules->push_back(cur_module);
   return 0;
 }
 
 #if SANITIZER_ANDROID && __ANDROID_API__ < 21
 extern "C" __attribute__((weak)) int dl_iterate_phdr(

lib/sanitizer_common/sanitizer_procmaps_common.cc

for (uptr i = 0; Next(&cur_beg, &cur_end, &cur_offset, module_name.data(),
     //   is mapped to a fixed memory range).
     // * If a binary is compiled with -pie, all the modules are
     //   mapped high at address space (in particular, higher than
     //   shadow memory of the tool), so the module can't be the
     //   first entry.
     uptr base_address = (i ? cur_beg : 0) - cur_offset;
     LoadedModule cur_module;
     cur_module.set(cur_name, base_address);
-    cur_module.addAddressRange(cur_beg, cur_end, prot & kProtectionExecute);
+    cur_module.addAddressRange(cur_beg, cur_end, prot & kProtectionExecute,
+                               prot);
     modules->push_back(cur_module);
   }
 }
 
 void GetMemoryProfile(fill_profile_f cb, uptr *stats, uptr stats_size) {
   char *smaps = nullptr;
   uptr smaps_cap = 0;
   uptr smaps_len = 0;

lib/sanitizer_common/sanitizer_procmaps_mac.cc

if (!modules->empty() &&
         0 == internal_strcmp(cur_name, modules->back().full_name())) {
       cur_module = &modules->back();
     } else {
       modules->push_back(LoadedModule());
       cur_module = &modules->back();
       cur_module->set(cur_name, cur_beg, cur_arch, cur_uuid,
                       current_instrumented_);
     }
-    cur_module->addAddressRange(cur_beg, cur_end, prot & kProtectionExecute);
+    cur_module->addAddressRange(cur_beg, cur_end, prot & kProtectionExecute,
+                                prot);
   }
 }
 
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_MAC

lib/sanitizer_common/sanitizer_win.cc

for (size_t i = 0; i < num_modules; ++i) {
     // right DWARF CU. In the common case that the image is loaded at it's
     // preferred address, we will now print normal virtual addresses.
     uptr preferred_base = GetPreferredBase(&module_name[0]);
     uptr adjusted_base = base_address - preferred_base;
 
     LoadedModule cur_module;
     cur_module.set(module_name, adjusted_base);
     // We add the whole module as one single address range.
-    cur_module.addAddressRange(base_address, end_address, /*executable*/ true);
+    cur_module.addAddressRange(base_address, end_address, /*executable*/ true,
+                               /*readable*/ true);
     modules_.push_back(cur_module);
   }
   UnmapOrDie(hmodules, modules_buffer_size);
 };
 
 // We can't use atexit() directly at __asan_init time as the CRT is not fully
 // initialized at this point.  Place the functions into a vector and use
 // atexit() as soon as it is ready for use (i.e. after .CRT$XIC initializers).