[scudo] Check for pvalloc overflow

[cryptoad]

Summary

Previously we were rounding up the size passed to pvalloc to the next
multiple of page size no matter what. There is an overflow possibility that
wasn't accounted for. So now, return null in the event of an overflow. The man
page doesn't seem to indicate the errno to set in this particular situation,
but the glibc unit tests go for ENOMEM (https://code.woboq.org/userspace/glibc/malloc/tst-pvalloc.c.html#54)
so we'll do the same.
Update the aligned allocation funtions tests to check for properly aligned
returned pointers, and the pvalloc corner cases.

@alekseyshl: do you want me to do the same in the other Sanitizers?

[alekseyshl]

Yep, please do it other sanitizers too. Seems like a reasonable change.

test/scudo/memalign.cpp

80

Spaces around -

84

Ditto

[cryptoad]

Do you prefer the other sanitizers in the same CL or a different one?

test/scudo/memalign.cpp

80

Just making sure: do you want spaces around the unary minus? I feel it's usually not the case.

[alekseyshl]

Let's have a cl per sanitizer.

test/scudo/memalign.cpp

80

Silly me :) ignore both

[cryptoad]

Move valloc & pvalloc tests to their own file.

lib/sanitizer_common/sanitizer_allocator_checks.h

 // Returns true if calloc(size, n) call overflows on size*n calculation.
 INLINE bool CheckForCallocOverflow(uptr size, uptr n) {
   if (!size)
     return false;
   uptr max = (uptr)-1L;
   return (max / size) < n;
 }
 
+// Returns true if the size passed to pvalloc overflows when rounded to the next
+// multiple of page_size.
+INLINE bool CheckForPvallocOverflow(uptr size, uptr page_size) {
+  return RoundUpTo(size, page_size) < size;
+}
+
 } // namespace __sanitizer
 
 #endif  // SANITIZER_ALLOCATOR_CHECKS_H

lib/scudo/scudo_allocator.cpp

 
 void *scudoValloc(uptr Size) {
   return SetErrnoOnNull(
       Instance.allocate(Size, GetPageSizeCached(), FromMemalign));
 }
 
 void *scudoPvalloc(uptr Size) {
   uptr PageSize = GetPageSizeCached();
+  if (UNLIKELY(CheckForPvallocOverflow(Size, PageSize))) {
+    errno = errno_ENOMEM;
+    return ScudoAllocator::FailureHandler::OnBadRequest();
+  }
   // pvalloc(0) should allocate one page.
   Size = Size ? RoundUpTo(Size, PageSize) : PageSize;
   return SetErrnoOnNull(Instance.allocate(Size, PageSize, FromMemalign));
 }
 
 void *scudoMemalign(uptr Alignment, uptr Size) {
   if (UNLIKELY(!IsPowerOfTwo(Alignment))) {
     errno = errno_EINVAL;

test/scudo/memalign.cpp

 // RUN: %clang_scudo %s -o %t
 // RUN: %run %t valid   2>&1
 // RUN: %run %t invalid 2>&1
 
 // Tests that the various aligned allocation functions work as intended. Also
 // tests for the condition where the alignment is not a power of 2.
 
 #include <assert.h>
 #include <errno.h>
 #include <malloc.h>
+#include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
-
-// Reduce the size of the quarantine, or the test can run out of aligned memory
-// on 32-bit for the larger alignments.
-extern "C" const char *__scudo_default_options() {
-  return "QuarantineSizeMb=1";
-}
+#include <unistd.h>
 
 // Sometimes the headers may not have this...
-extern "C" void *aligned_alloc (size_t alignment, size_t size);
+extern "C" void *aligned_alloc(size_t alignment, size_t size);
 
 int main(int argc, char **argv)
 {
   void *p = nullptr;
   size_t alignment = 1U << 12;
   size_t size = 1U << 12;
   int err;
 
   assert(argc == 2);
 
   if (!strcmp(argv[1], "valid")) {
     posix_memalign(&p, alignment, size);
     assert(p);
+    assert(((uintptr_t)p & (alignment - 1)) == 0);
     free(p);
     p = aligned_alloc(alignment, size);
     assert(p);
+    assert(((uintptr_t)p & (alignment - 1)) == 0);
     free(p);
     // Tests various combinations of alignment and sizes
     for (int i = (sizeof(void *) == 4) ? 3 : 4; i < 19; i++) {
       alignment = 1U << i;
       for (int j = 1; j < 33; j++) {
         size = 0x800 * j;
         for (int k = 0; k < 3; k++) {
           p = memalign(alignment, size - (2 * sizeof(void *) * k));
           assert(p);
+          assert(((uintptr_t)p & (alignment - 1)) == 0);
           free(p);
         }
       }
     }
     // For larger alignment, reduce the number of allocations to avoid running
     // out of potential addresses (on 32-bit).
     for (int i = 19; i <= 24; i++) {
       for (int k = 0; k < 3; k++) {
         p = memalign(alignment, 0x1000 - (2 * sizeof(void *) * k));
         assert(p);
+        assert(((uintptr_t)p & (alignment - 1)) == 0);
         free(p);
       }
     }
   }
   if (!strcmp(argv[1], "invalid")) {
     // Alignment is not a power of 2.
     p = memalign(alignment - 1, size);
     assert(!p);
     // Size is not a multiple of alignment.
     p = aligned_alloc(alignment, size >> 1);
     assert(!p);
     void *p_unchanged = (void *)0x42UL;
     p = p_unchanged;
     // Alignment is not a power of 2.
     err = posix_memalign(&p, 3, size);
     assert(p == p_unchanged);
     assert(err == EINVAL);
     // Alignment is a power of 2, but not a multiple of size(void *).
     err = posix_memalign(&p, 2, size);
     assert(p == p_unchanged);
     assert(err == EINVAL);
   }
   return 0;
 }

test/scudo/valloc.cpp

+// RUN: %clang_scudo %s -o %t
+// RUN: %run %t valid   2>&1
+// RUN: %run %t invalid 2>&1
+
+// Tests that valloc and pvalloc work as intended.
+
+#include <assert.h>
+#include <errno.h>
+#include <malloc.h>
+#include <stdint.h>
+#include <string.h>
+#include <unistd.h>
+
+size_t round_up_to(size_t size, size_t alignment) {
+  return (size + alignment - 1) & ~(alignment - 1);
+}
+
+int main(int argc, char **argv)
+{
+  void *p = nullptr;
+  size_t size, page_size;
+
+  assert(argc == 2);
+
+  page_size = sysconf(_SC_PAGESIZE);
+  // Check that the page size is a power of two.
+  assert((page_size & (page_size - 1)) == 0);
+
+  if (!strcmp(argv[1], "valid")) {
+    for (int i = (sizeof(void *) == 4) ? 3 : 4; i < 21; i++) {
+      size = 1U << i;
+      p = valloc(size - (2 * sizeof(void *)));
+      assert(p);
+      assert(((uintptr_t)p & (page_size - 1)) == 0);
+      free(p);
+      p = pvalloc(size - (2 * sizeof(void *)));
+      assert(p);
+      assert(((uintptr_t)p & (page_size - 1)) == 0);
+      assert(malloc_usable_size(p) >= round_up_to(size, page_size));
+      free(p);
+      p = valloc(size);
+      assert(p);
+      assert(((uintptr_t)p & (page_size - 1)) == 0);
+      free(p);
+      p = pvalloc(size);
+      assert(p);
+      assert(((uintptr_t)p & (page_size - 1)) == 0);
+      assert(malloc_usable_size(p) >= round_up_to(size, page_size));
+      free(p);
+    }
+  }
+  if (!strcmp(argv[1], "invalid")) {
+    // Size passed to pvalloc overflows when rounded up.
+    p = pvalloc((size_t)-1);
+    assert(!p);
+    assert(errno == ENOMEM);
+    errno = 0;
+    p = pvalloc((size_t)-page_size);
+    assert(!p);
+    assert(errno == ENOMEM);
+  }
+  return 0;
+}