Add support for custom loaders to the sanitizer symbolizer

[fjricci]

Summary

Adds a fallback mode to procmaps when the symbolizer
fails to locate a module for a given address by using
dl_iterate_phdr.

[eugenis]

I don't understand. What are these custom loaders that fail to list all modules? What prevents FindModuleForAddress from going into infinite recursion if an address is not found even in proc/maps?

[fjricci]

modules_.enableFallbackInit() will only return true once (if use_fallback_init_ is already enabled, it returns false), so there shouldn't be an infinite recursion anywhere.

The issue that this is trying to solve is that the Linux LoadedModules uses dl_iterate_phdr by default. This is an api function of the system loader, so it works fine for libraries loaded by the system loader, but won't find any libraries not loaded by the system loader. If you use a custom loader (for example, Faulty.lib) to load some of your libraries, they won't appear in dl_iterate_phdr, because the system loader didn't load them. They are still loaded in the memory map though, so they will appear in procmaps.

[fjricci]

ping - I'm open to alternate ways of dealing with this, but it's pretty important for our use case (and presumably affects anyone else using faulty or other custom loaders).

[eugenis]

lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc

192

Does this branch need to set modules_fresh_ to false to trigger reinitialization in the recursive call?

This function got super confusing and difficult to reason about. Could you rewrite it without recursion? The real logic behind this is very simple - if dl_iterate_phdr fails, use procmaps. There is nothing recursive about it.

[fjricci]

lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc

192

Yeah, that makes sense. I mainly went for recursion because that's the way the existing fallback case works (I actually wonder whether that needs to be recursive, maybe I can change that one too). Will refactor.

[fjricci]

Remove recursion and refactor to make more understandable

[eugenis]

This implementation never returns to dl_iterate_phdr once it finds the first module lookup error. This is not great, because proc/maps does not provide reliable base address for DSOs (see the comment in MemoryMappingLayout::DumpListOfModules).

I suggest keeping the fallback list of modules in parallel with the primary list, and always trying the latter first.

lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc

186

consider early exit here and below: if (module) return module;

192

This will do extra work on platforms where fallbackInit == init. Move it under smth like if (hasFallback()) ?

[fjricci]

Address comments

[eugenis]

lib/sanitizer_common/sanitizer_symbolizer.h

155

Please make sure that this does not allocate memory unless it's necessary.
Looks like it can be done by switching ListOfModules to InternalMmapVectorNoCtor.

[fjricci]

Use NoCtor

[fjricci]

Fix build issues

[fjricci]

ping - I think this should be pretty close to finished at this point

[vitalybuka]

LGTM, but lets wait a little to see if eugenis wants other changes

[eugenis]

lib/sanitizer_common/sanitizer_common.h

790

Is not this backwards?

[fjricci]

Fix conditional

[fjricci]

This caused a hang on one of the linux buildbots: http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux/builds/4146

I'm not sure why this would affect only that buildbot, as it seems like a pretty generic one. I don't see any linux issues locally. My only idea is potentially that initialized could introduce a race condition leading to double-initialization, but I don't understand how two threads could be using the ListOfModules at the same time (or why that would cause a hang instead of data corruption/leaking). I can try introducing a mutex there if it seems problematic.

[fjricci]

Actually, I think I'll try splitting this up into a few smaller commits to diagnose where the issue is. There are a few pieces that seem NFC/low risk, so hopefully merging those will help figure out which of the remaining parts actually broke the buildbot.

[fjricci]

Rebase onto rL314520 and rL314518

[fjricci]

Once it looks like all the buildbots are happy with those two NFC revisions, I'll merge the NoCtor part of this change (which I suspect is the problematic part).

[fjricci]

Interestingly, the buildbot also looks happy with the NoCtor change (rL314533): http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux/builds/4167. Must be that the fallbackInit causes issues somehow.

[fjricci]

Rebase onto rL314533

[fjricci]

Interestingly, this small change still causes a hang somewhere on the gcc sanitizer buildbot: http://lab.llvm.org:8011/builders/sanitizer-x86_64-linux/builds/4222. Reverted again.

[eugenis]

#0  atomic_exchange<__sanitizer::atomic_uint32_t> ()
    at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_atomic_clang.h:68
#1  Lock () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux.cc:620
#2  0x00000000004dcf82 in GenericScopedLock () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_mutex.h:187
#3  SymbolizePC () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc:76
#4  0x00000000004dba18 in Print () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_stacktrace_libcdep.cc:35
#5  0x00000000004c38ef in AsanCheckFailed () at /code/llvm-project/compiler-rt/lib/asan/asan_rtl.cc:69
#6  0x00000000004d8910 in CheckFailed () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_termination.cc:79
#7  0x00000000004d44d8 in MemoryMappingLayout ()
    at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_procmaps_common.cc:80
#8  0x00000000004daad4 in procmapsInit () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cc:477
#9  fallbackInit () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cc:496
#10 0x00000000004dd34a in RefreshModules ()
    at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc:168
#11 FindModuleForAddress () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc:186
#12 0x00000000004dcf98 in FindModuleNameAndOffsetForAddress ()
    at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc:157
#13 SymbolizePC () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc:81
#14 0x00000000004dba18 in Print () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_stacktrace_libcdep.cc:35
#15 0x00000000004d92c4 in ReportDeadlySignalImpl ()
    at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_common_libcdep.cc:242
#16 ReportDeadlySignal () at /code/llvm-project/compiler-rt/lib/sanitizer_common/sanitizer_common_libcdep.cc:255
#17 0x00000000004c0225 in ~ScopedInErrorReport () at /code/llvm-project/compiler-rt/lib/asan/asan_report.cc:138
#18 0x00000000004bffb2 in ReportDeadlySignal () at /code/llvm-project/compiler-rt/lib/asan/asan_report.cc:211
#19 0x00000000004bf9a3 in AsanOnDeadlySignal () at /code/llvm-project/compiler-rt/lib/asan/asan_posix.cc:39
#20 <signal handler called>
#21 0x00000000004eabe0 in main ()
    at /code/llvm-project/compiler-rt/test/asan/TestCases/Linux/sanbox_read_proc_self_maps_test.cc:26

Hope it helps.

[fjricci]

Thanks!

[fjricci]

aha - looks like that test removes access to proc/maps, which then causes reading procmaps to fail. Not sure why that failure wasn't reproducing locally, but I'll try to figure out a way to handle that case.

[fjricci]

Looks like PrepareForSandboxing could perhaps shut off the fallbackInit somehow

[fjricci]

Actually, I'm pretty sure that fixing this is as easy as allowing the fallback cache for the LoadedModule list.

[fjricci]

Allow fallback cache - should fix sandboxing issues

lib/sanitizer_common/sanitizer_common.h

 
 // List of LoadedModules. OS-dependent implementation is responsible for
 // filling this information.
 class ListOfModules {
  public:
   ListOfModules() : modules_(kInitialCapacity) {}
   ~ListOfModules() { clear(); }
   void init();
+  void fallbackInit();  // Uses fallback init if available, otherwise clears
   const LoadedModule *begin() const { return modules_.begin(); }
   LoadedModule *begin() { return modules_.begin(); }
   const LoadedModule *end() const { return modules_.end(); }
   LoadedModule *end() { return modules_.end(); }
   uptr size() const { return modules_.size(); }
   const LoadedModule &operator[](uptr i) const {
     CHECK_LT(i, modules_.size());
     return modules_[i];
   }
 
  private:
   void clear() {
     for (auto &module : modules_) module.clear();
     modules_.clear();
   }
 
   InternalMmapVector<LoadedModule> modules_;
   // We rarely have more than 16K loaded modules.
   static const uptr kInitialCapacity = 1 << 14;
 };
 
 // Callback type for iterating over a set of memory ranges.
 typedef void (*RangeIteratorCallback)(uptr begin, uptr end, void *arg);
 
 enum AndroidApiLevel {

lib/sanitizer_common/sanitizer_linux_libcdep.cc

 #include "sanitizer_atomic.h"
 #include "sanitizer_common.h"
 #include "sanitizer_flags.h"
 #include "sanitizer_freebsd.h"
 #include "sanitizer_linux.h"
 #include "sanitizer_placement_new.h"
 #include "sanitizer_procmaps.h"
 #include "sanitizer_stacktrace.h"
+#include "sanitizer_symbolizer.h"
 
 #include <dlfcn.h>  // for dlsym()
 #include <link.h>
 #include <pthread.h>
 #include <signal.h>
 #include <sys/resource.h>
 #include <syslog.h>
 
static int dl_iterate_phdr_cb(dl_phdr_info *info, size_t size, void *arg) {
   return 0;
 }
 
 #if SANITIZER_ANDROID && __ANDROID_API__ < 21
 extern "C" __attribute__((weak)) int dl_iterate_phdr(
     int (*)(struct dl_phdr_info *, size_t, void *), void *);
 #endif
 
-void ListOfModules::init() {
-  clear();
+static bool requiresProcmaps() {
 #if SANITIZER_ANDROID && __ANDROID_API__ <= 22
-  u32 api_level = AndroidGetApiLevel();
   // Fall back to /proc/maps if dl_iterate_phdr is unavailable or broken.
   // The runtime check allows the same library to work with
   // both K and L (and future) Android releases.
-  if (api_level <= ANDROID_LOLLIPOP_MR1) { // L or earlier
-    MemoryMappingLayout memory_mapping(false);
-    memory_mapping.DumpListOfModules(&modules_);
-    return;
-  }
-#endif
+  return AndroidGetApiLevel() <= ANDROID_LOLLIPOP_MR1;
+#else
+  return false;
+#endif
+}
+
+static void procmapsInit(InternalMmapVector<LoadedModule> *modules) {
+  memory_mapping.DumpListOfModules(modules);
+
+void ListOfModules::init() {
+  clear();
+  if (requiresProcmaps()) {
+    procmapsInit(&modules_);
+  } else {
     DlIteratePhdrData data = {&modules_, true};
     dl_iterate_phdr(dl_iterate_phdr_cb, &data);
   }
+}
+
+// When a custom loader is used, dl_iterate_phdr may not contain the full
+// list of modules. Allow callers to fall back to using procmaps.
+void ListOfModules::fallbackInit() {
+  clear();
+  if (!requiresProcmaps()) procmapsInit(&modules_);
+}
 
 // getrusage does not give us the current RSS, only the max RSS.
 // Still, this is better than nothing if /proc/self/statm is not available
 // for some reason, e.g. due to a sandbox.
 static uptr GetRSSFromGetrusage() {
   struct rusage usage;
   if (getrusage(RUSAGE_SELF, &usage))  // Failed, probably due to a sandbox.
     return 0;

lib/sanitizer_common/sanitizer_mac.cc

 }
 
 void ListOfModules::init() {
   clear();
   MemoryMappingLayout memory_mapping(false);
   memory_mapping.DumpListOfModules(&modules_);
 }
 
+void ListOfModules::fallbackInit() { clear(); }
+
 static HandleSignalMode GetHandleSignalModeImpl(int signum) {
   switch (signum) {
     case SIGABRT:
       return common_flags()->handle_abort;
     case SIGILL:
       return common_flags()->handle_sigill;
     case SIGFPE:
       return common_flags()->handle_sigfpe;

lib/sanitizer_common/sanitizer_symbolizer.h

public:
   // to distinguish system library calls made in user code from calls made
   // during in-process symbolization.
   typedef void (*StartSymbolizationHook)();
   typedef void (*EndSymbolizationHook)();
   // May be called at most once.
   void AddHooks(StartSymbolizationHook start_hook,
                 EndSymbolizationHook end_hook);
 
+  void RefreshModules();
   const LoadedModule *FindModuleForAddress(uptr address);
 
   void InvalidateModuleList();
 
  private:
   // GetModuleNameAndOffsetForPC has to return a string to the caller.
   // Since the corresponding module might get unloaded later, we should create
   // our owned copies of the strings that we can safely return.
private:
 
   /// Platform-specific function for creating a Symbolizer object.
   static Symbolizer *PlatformInit();
 
   bool FindModuleNameAndOffsetForAddress(uptr address, const char **module_name,
                                          uptr *module_offset,
                                          ModuleArch *module_arch);
   ListOfModules modules_;
+  ListOfModules fallback_modules_;
   // If stale, need to reload the modules before looking up addresses.
   bool modules_fresh_;
 
   // Platform-specific default demangler, must not return nullptr.
   const char *PlatformDemangle(const char *name);
   void PlatformPrepareForSandboxing();
 
   static Symbolizer *symbolizer_;

lib/sanitizer_common/sanitizer_symbolizer_libcdep.cc

bool Symbolizer::FindModuleNameAndOffsetForAddress(uptr address,
   if (module == nullptr)
     return false;
   *module_name = module->full_name();
   *module_offset = address - module->base_address();
   *module_arch = module->arch();
   return true;
 }
 
-const LoadedModule *Symbolizer::FindModuleForAddress(uptr address) {
-  bool modules_were_reloaded = false;
-  if (!modules_fresh_) {
-    modules_.init();
-    RAW_CHECK(modules_.size() > 0);
-    modules_fresh_ = true;
-    modules_were_reloaded = true;
-  }
-  for (uptr i = 0; i < modules_.size(); i++) {
-    if (modules_[i].containsAddress(address)) {
-      return &modules_[i];
+void Symbolizer::RefreshModules() {
+  fallback_modules_.fallbackInit();
+
+static const LoadedModule *SearchForModule(const ListOfModules &modules,
+                                           uptr address) {
+  for (uptr i = 0; i < modules.size(); i++) {
+    if (modules[i].containsAddress(address)) {
+      return &modules[i];
     }
   }
+  return nullptr;
+}
+
+const LoadedModule *Symbolizer::FindModuleForAddress(uptr address) {
+  bool modules_were_reloaded = false;
+  if (!modules_fresh_) {
+    RefreshModules();
+    modules_were_reloaded = true;
+  }
+  const LoadedModule *module = SearchForModule(modules_, address);
+  if (module) return module;
+
     // dlopen/dlclose interceptors invalidate the module list, but when
     // interception is disabled, we need to retry if the lookup fails in
     // case the module list changed.
 #if !SANITIZER_INTERCEPT_DLOPEN_DLCLOSE
   if (!modules_were_reloaded) {
-    modules_fresh_ = false;
-    return FindModuleForAddress(address);
+    RefreshModules();
+    module = SearchForModule(modules_, address);
+    if (module) return module;
   }
 #endif
-  return 0;
+
+  if (fallback_modules_.size()) {
+    module = SearchForModule(fallback_modules_, address);
+  }
+  return module;
 }
 
 Symbolizer *Symbolizer::GetOrInit() {
   SpinMutexLock l(&init_mu_);
   if (symbolizer_)
     return symbolizer_;
   symbolizer_ = PlatformInit();
   CHECK(symbolizer_);

lib/sanitizer_common/sanitizer_win.cc

for (size_t i = 0; i < num_modules; ++i) {
     LoadedModule cur_module;
     cur_module.set(module_name, adjusted_base);
     // We add the whole module as one single address range.
     cur_module.addAddressRange(base_address, end_address, /*executable*/ true,
                                /*writable*/ true);
     modules_.push_back(cur_module);
   }
   UnmapOrDie(hmodules, modules_buffer_size);
-};
+}
+
+void ListOfModules::fallbackInit() { clear(); }
 
 // We can't use atexit() directly at __asan_init time as the CRT is not fully
 // initialized at this point.  Place the functions into a vector and use
 // atexit() as soon as it is ready for use (i.e. after .CRT$XIC initializers).
 InternalMmapVectorNoCtor<void (*)(void)> atexit_functions;
 
 int Atexit(void (*function)(void)) {
   atexit_functions.push_back(function);