[scudo] Implement stricter separation of C vs C++

[cryptoad]

Summary

Initially, Scudo had a monolithic design where both C and C++ functions were
living in the same library. This was not necessarily ideal, and with the work
on -fsanitize=scudo, it became more apparent that this needed to change.

We are splitting the new/delete interceptor in their own C++ library. This
allows more flexibility, notably with regard to std::bad_alloc when the work is
done. This also allows us to not link new & delete when using pure C.

Additionally, we add the UBSan runtimes with Scudo, in order to be able to have
a -fsanitize=scudo,undefined in Clang (see work in D39334).

The changes in this patch:

• split the cxx specific code in the scudo cmake file into a new library; (remove the spurious foreach loop, that was not necessary)
• add the UBSan runtimes (both C and C++);
• change the test cmake file to allow for specific C & C++ tests;
• make C tests pure C, rename their extension accordingly.

[alekseyshl]

test/scudo/lit.cfg

31

Super nit :)
cxx_flags = (c_flags + config.cxx_mode_flags + ["-std=c++11"])

[cryptoad]

Addressing review comment.

[cryptoad]

Adding the UBSan runtimes to the Shared library rule.

[cryptoad]

Changing the dynamic library preload test to be C++y.

lib/scudo/CMakeLists.txt

 add_compiler_rt_component(scudo)
 
 include_directories(..)
 
 set(SCUDO_CFLAGS ${SANITIZER_COMMON_CFLAGS})
 # SANITIZER_COMMON_CFLAGS include -fno-builtin, but we actually want builtins!
 list(APPEND SCUDO_CFLAGS -fbuiltin)
 append_rtti_flag(OFF SCUDO_CFLAGS)
 
 set(SCUDO_SOURCES
   scudo_allocator.cpp
   scudo_flags.cpp
   scudo_crc32.cpp
   scudo_interceptors.cpp
-  scudo_new_delete.cpp
   scudo_termination.cpp
   scudo_tsd_exclusive.cpp
   scudo_tsd_shared.cpp
   scudo_utils.cpp)
 
+set(SCUDO_CXX_SOURCES
+  scudo_new_delete.cpp)
+
 # Enable the SSE 4.2 instruction set for scudo_crc32.cpp, if available.
 if (COMPILER_RT_HAS_MSSE4_2_FLAG)
   set_source_files_properties(scudo_crc32.cpp PROPERTIES COMPILE_FLAGS -msse4.2)
 endif()
 
 # Enable the AArch64 CRC32 feature for scudo_crc32.cpp, if available.
 # Note that it is enabled by default starting with armv8.1-a.
 if (COMPILER_RT_HAS_MCRC_FLAG)
   set_source_files_properties(scudo_crc32.cpp PROPERTIES COMPILE_FLAGS -mcrc)
 endif()
 
 if(COMPILER_RT_HAS_SCUDO)
   set(SCUDO_DYNAMIC_LIBS ${SANITIZER_COMMON_LINK_LIBS})
   append_list_if(COMPILER_RT_HAS_LIBDL dl SCUDO_DYNAMIC_LIBS)
   append_list_if(COMPILER_RT_HAS_LIBRT rt SCUDO_DYNAMIC_LIBS)
   append_list_if(COMPILER_RT_HAS_LIBPTHREAD pthread SCUDO_DYNAMIC_LIBS)
   append_list_if(COMPILER_RT_HAS_LIBLOG log SCUDO_DYNAMIC_LIBS)
 
-  foreach(arch ${SCUDO_SUPPORTED_ARCH})
-    add_compiler_rt_runtime(clang_rt.scudo
-      STATIC
-      ARCHS ${arch}
-      SOURCES ${SCUDO_SOURCES}
-      OBJECT_LIBS RTSanitizerCommonNoTermination
-                  RTSanitizerCommonLibc
-                  RTInterception
-      CFLAGS ${SCUDO_CFLAGS}
-      PARENT_TARGET scudo)
+    ARCHS ${SCUDO_SUPPORTED_ARCH}
+                RTUbsan
+    CFLAGS ${SCUDO_CFLAGS}
+    PARENT_TARGET scudo)
+
+  add_compiler_rt_runtime(clang_rt.scudo_cxx
+    STATIC
+    ARCHS ${SCUDO_SUPPORTED_ARCH}
+    SOURCES ${SCUDO_CXX_SOURCES}
+    OBJECT_LIBS RTUbsan_cxx
 
-    add_compiler_rt_runtime(clang_rt.scudo
-      SHARED
-      ARCHS ${arch}
-      SOURCES ${SCUDO_SOURCES}
-      OBJECT_LIBS RTSanitizerCommonNoTermination
-                  RTSanitizerCommonLibc
-                  RTInterception
-      CFLAGS ${SCUDO_CFLAGS}
-      LINK_LIBS ${SCUDO_DYNAMIC_LIBS}
-      PARENT_TARGET scudo)
-  endforeach()
+    ARCHS ${SCUDO_SUPPORTED_ARCH}
+    SOURCES ${SCUDO_SOURCES} ${SCUDO_CXX_SOURCES}
+                RTUbsan
+                RTUbsan_cxx
 endif()

test/scudo/alignment.c

 #include <string.h>
 
 int main(int argc, char **argv)
 {
   assert(argc == 2);
   if (!strcmp(argv[1], "pointers")) {
     void *p = malloc(1U << 16);
     assert(p);
-    free(reinterpret_cast<void *>(reinterpret_cast<uintptr_t>(p) | 1));
+    free((void *)((uintptr_t)p | 1));
   }
   return 0;
 }
 
 // CHECK: ERROR: attempted to deallocate a chunk not properly aligned

test/scudo/double-free.cpp

-// RUN: %clang_scudo %s -o %t
+// RUN: %clangxx_scudo %s -o %t
 // RUN: not %run %t malloc   2>&1 | FileCheck %s
 // RUN: not %run %t new      2>&1 | FileCheck %s
 // RUN: not %run %t newarray 2>&1 | FileCheck %s
 // RUN: not %run %t memalign 2>&1 | FileCheck %s
 
 // Tests double-free error on pointers allocated with different allocation
 // functions.
 

test/scudo/interface.cpp

-// RUN: %clang_scudo %s -lstdc++ -o %t
+// RUN: %clangxx_scudo %s -lstdc++ -o %t
 // RUN: %run %t ownership          2>&1
 // RUN: %run %t ownership-and-size 2>&1
 // RUN: %run %t heap-size          2>&1
 
 // Tests that the sanitizer interface functions behave appropriately.
 
 #include <stdlib.h>
 #include <assert.h>

test/scudo/lit.cfg

 # -*- Python -*-
 
 import os
 
 # Setup config name.
 config.name = 'Scudo' + config.name_suffix
 
 # Setup source root.
 config.test_source_root = os.path.dirname(__file__)
 
 # Path to the shared & static libraries
 shared_libscudo = os.path.join(config.compiler_rt_libdir, "libclang_rt.scudo-%s.so" % config.target_arch)
 static_libscudo = os.path.join(config.compiler_rt_libdir, "libclang_rt.scudo-%s.a" % config.target_arch)
+static_libscudo_cxx = os.path.join(config.compiler_rt_libdir, "libclang_rt.scudo_cxx-%s.a" % config.target_arch)
+
 whole_archive = "-Wl,-whole-archive %s -Wl,-no-whole-archive " % static_libscudo
+whole_archive_cxx = "-Wl,-whole-archive %s -Wl,-no-whole-archive " % static_libscudo_cxx
 
 # Test suffixes.
 config.suffixes = ['.c', '.cc', '.cpp']
 
-# C flags.
+# C & CXX flags.
 c_flags = ([config.target_cflags] +
-           ["-std=c++11",
-           "-pthread",
+           ["-pthread",
            "-fPIE",
            "-pie",
            "-O0",
            "-UNDEBUG",
            "-ldl",
            "-Wl,--gc-sections"])
+cxx_flags = (c_flags + config.cxx_mode_flags + ["-std=c++11"])
 
 # Android doesn't want -lrt.
 if not config.android:
   c_flags += ["-lrt"]
 
 def build_invocation(compile_flags):                                            
   return " " + " ".join([config.compile_wrapper, config.clang] + compile_flags) + " "                   
 
 # Add clang substitutions.
 config.substitutions.append(("%clang ", build_invocation(c_flags)))
 config.substitutions.append(("%clang_scudo ", build_invocation(c_flags) + whole_archive))
+config.substitutions.append(("%clangxx_scudo ", build_invocation(cxx_flags) + whole_archive + whole_archive_cxx))
 config.substitutions.append(("%shared_libscudo", shared_libscudo))
 
 # Platform-specific default SCUDO_OPTIONS for lit tests.
 default_scudo_opts = ''
 if config.android:
   # Android defaults to abort_on_error=1, which doesn't work for us.
   default_scudo_opts = 'abort_on_error=0'
 

test/scudo/malloc.cpp

-// RUN: %clang_scudo %s -lstdc++ -o %t
+// RUN: %clangxx_scudo %s -lstdc++ -o %t
 // RUN: %run %t 2>&1
 
 // Tests that a regular workflow of allocation, memory fill and free works as
 // intended. Tests various sizes serviced by the primary and secondary
 // allocators.
 
 #include <assert.h>
 #include <stdlib.h>

test/scudo/memalign.c

 #include <errno.h>
 #include <malloc.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
 
 // Sometimes the headers may not have this...
-extern "C" void *aligned_alloc(size_t alignment, size_t size);
+void *aligned_alloc(size_t alignment, size_t size);
 
 int main(int argc, char **argv)
 {
-  void *p = nullptr;
+  void *p = NULL;
   size_t alignment = 1U << 12;
   size_t size = 1U << 12;
   int err;
 
   assert(argc == 2);
 
   if (!strcmp(argv[1], "valid")) {
     posix_memalign(&p, alignment, size);

test/scudo/mismatch.cpp

-// RUN: %clang_scudo %s -o %t
+// RUN: %clangxx_scudo %s -o %t
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=1 not %run %t mallocdel       2>&1 | FileCheck --check-prefix=CHECK-dealloc %s
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=0     %run %t mallocdel       2>&1
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=1 not %run %t newfree         2>&1 | FileCheck --check-prefix=CHECK-dealloc %s
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=0     %run %t newfree         2>&1
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=1 not %run %t memaligndel     2>&1 | FileCheck --check-prefix=CHECK-dealloc %s
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=0     %run %t memaligndel     2>&1
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=1 not %run %t memalignrealloc 2>&1 | FileCheck --check-prefix=CHECK-realloc %s
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=0     %run %t memalignrealloc 2>&1

test/scudo/options.cpp

-// RUN: %clang_scudo %s -o %t
+// RUN: %clangxx_scudo %s -o %t
 // RUN:                                                %run %t 2>&1
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=0     %run %t 2>&1
 // RUN: %env_scudo_opts=DeallocationTypeMismatch=1 not %run %t 2>&1 | FileCheck %s
 
 // Tests that the options can be passed using getScudoDefaultOptions, and that
 // the environment ones take precedence over them.
 
 #include <assert.h>

test/scudo/overflow.c

 // RUN: %clang_scudo %s -o %t
 // RUN:                                     not %run %t malloc     2>&1 | FileCheck %s
 // RUN: %env_scudo_opts=QuarantineSizeKb=64 not %run %t quarantine 2>&1 | FileCheck %s
 
 // Tests that header corruption of an allocated or quarantined chunk is caught.
 
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
 
 int main(int argc, char **argv)
 {
   ssize_t offset = sizeof(void *) == 8 ? 8 : 0;
 
   assert(argc == 2);
 
   if (!strcmp(argv[1], "malloc")) {
     // Simulate a header corruption of an allocated chunk (1-bit)
     void *p = malloc(1U << 4);
     assert(p);
     ((char *)p)[-(offset + 1)] ^= 1;
     free(p);
   }
   if (!strcmp(argv[1], "quarantine")) {
     void *p = malloc(1U << 4);
     assert(p);
     free(p);
     // Simulate a header corruption of a quarantined chunk
     ((char *)p)[-(offset + 2)] ^= 1;
     // Trigger the quarantine recycle
     for (int i = 0; i < 0x100; i++) {
       p = malloc(1U << 8);
       free(p);
     }
   }
   return 0;
 }
 
 // CHECK: ERROR: corrupted chunk header at address
 

test/scudo/preinit.c

 // RUN: %clang_scudo %s -o %t
 // RUN: %run %t 2>&1
 
 // Verifies that calling malloc in a preinit_array function succeeds, and that
 // the resulting pointer can be freed at program termination.
 
 // On some Android versions, calling mmap() from a preinit function segfaults.
 // It looks like __mmap2.S ends up calling a NULL function pointer.
 // UNSUPPORTED: android
 
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
 
-static void *global_p = nullptr;
+static void *global_p = NULL;
 
 void __init(void) {
   global_p = malloc(1);
   if (!global_p)
     exit(1);
 }
 
 void __fini(void) {

test/scudo/preload.cpp

 // Test that the preloaded runtime works without linking the static library.
 
-// RUN: %clang %s -o %t
+// RUN: %clang %s -lstdc++ -o %t
 // RUN: env LD_PRELOAD=%shared_libscudo not %run %t 2>&1 | FileCheck %s
 
 // This way of setting LD_PRELOAD does not work with Android test runner.
 // REQUIRES: !android
 
 #include <assert.h>
-#include <stdlib.h>
 
 int main(int argc, char *argv[]) {
-  void *p = malloc(sizeof(int));
+  int *p = new int;
   assert(p);
-  free(p);
-  free(p);
+  *p = 0;
+  delete p;
+  delete p;
   return 0;
 }
 
 // CHECK: ERROR: invalid chunk state

test/scudo/quarantine.c

if (!strcmp(argv[1], "smallquarantine")) {
     old_p = p;
     free(p);
     p = malloc(size);
     assert(p);
     assert(old_p != p);
     free(p);
 
     // Eventually the chunk should become available again.
-    bool found = false;
+    char found = 0;
     for (int i = 0; i < 0x200 && !found; i++) {
       p = malloc(size);
       assert(p);
       found = (p == old_p);
       free(p);
     }
     assert(found);
   }

test/scudo/random_shuffle.cpp

-// RUN: %clang_scudo %s -o %t
+// RUN: %clangxx_scudo %s -o %t
 // RUN: rm -rf %T/random_shuffle_tmp_dir
 // RUN: mkdir %T/random_shuffle_tmp_dir
 // RUN: %run %t 100 > %T/random_shuffle_tmp_dir/out1
 // RUN: %run %t 100 > %T/random_shuffle_tmp_dir/out2
 // RUN: %run %t 10000 > %T/random_shuffle_tmp_dir/out1
 // RUN: %run %t 10000 > %T/random_shuffle_tmp_dir/out2
 // RUN: not diff %T/random_shuffle_tmp_dir/out?
 // RUN: rm -rf %T/random_shuffle_tmp_dir

test/scudo/realloc.cpp

-// RUN: %clang_scudo %s -lstdc++ -o %t
+// RUN: %clangxx_scudo %s -lstdc++ -o %t
 // RUN: %run %t pointers 2>&1
 // RUN: %run %t contents 2>&1
 // RUN: %run %t usablesize 2>&1
 
 // Tests that our reallocation function returns the same pointer when the
 // requested size can fit into the previously allocated chunk. Also tests that
 // a new chunk is returned if the size is greater, and that the contents of the
 // chunk are left unchanged. Finally, checks that realloc copies the usable

test/scudo/secondary.c

int main(int argc, char **argv)
   memset(&a, 0, sizeof(a));
   a.sa_sigaction = handler;
   a.sa_flags = SA_SIGINFO;
 
   char *p = (char *)malloc(size);
   assert(p);
   memset(p, 'A', size); // This should not trigger anything.
   // Set up the SIGSEGV handler now, as the rest should trigger an AV.
-  sigaction(SIGSEGV, &a, nullptr);
+  sigaction(SIGSEGV, &a, NULL);
   if (!strcmp(argv[1], "after")) {
     for (int i = 0; i < page_size; i++)
       p[size + i] = 'A';
   }
   if (!strcmp(argv[1], "before")) {
     for (int i = 1; i < page_size; i++)
       p[-i] = 'A';
   }
   free(p);
 
   return 1; // A successful test means we shouldn't reach this.
 }
 
 // CHECK: SCUDO SIGSEGV

test/scudo/sized-delete.cpp

-// RUN: %clang_scudo -fsized-deallocation %s -o %t
+// RUN: %clangxx_scudo -fsized-deallocation %s -o %t
 // RUN: %env_scudo_opts=DeleteSizeMismatch=1     %run %t gooddel    2>&1
 // RUN: %env_scudo_opts=DeleteSizeMismatch=1 not %run %t baddel     2>&1 | FileCheck %s
 // RUN: %env_scudo_opts=DeleteSizeMismatch=0     %run %t baddel     2>&1
 // RUN: %env_scudo_opts=DeleteSizeMismatch=1     %run %t gooddelarr 2>&1
 // RUN: %env_scudo_opts=DeleteSizeMismatch=1 not %run %t baddelarr  2>&1 | FileCheck %s
 // RUN: %env_scudo_opts=DeleteSizeMismatch=0     %run %t baddelarr  2>&1
 
 // Ensures that the sized delete operator errors out when the appropriate

test/scudo/sizes.cpp

-// RUN: %clang_scudo %s -lstdc++ -o %t
+// RUN: %clangxx_scudo %s -lstdc++ -o %t
 // RUN: %env_scudo_opts=allocator_may_return_null=0 not %run %t malloc 2>&1 | FileCheck %s
 // RUN: %env_scudo_opts=allocator_may_return_null=1     %run %t malloc 2>&1
 // RUN: %env_scudo_opts=allocator_may_return_null=0 not %run %t calloc 2>&1 | FileCheck %s
 // RUN: %env_scudo_opts=allocator_may_return_null=1     %run %t calloc 2>&1
 // RUN: %env_scudo_opts=allocator_may_return_null=0 not %run %t new 2>&1 | FileCheck %s
 // RUN: %env_scudo_opts=allocator_may_return_null=1 not %run %t new 2>&1 | FileCheck %s
 // RUN: %env_scudo_opts=allocator_may_return_null=0 not %run %t new-nothrow 2>&1 | FileCheck %s
 // RUN: %env_scudo_opts=allocator_may_return_null=1     %run %t new-nothrow 2>&1

test/scudo/threads.c

 
 int num_threads;
 int total_num_alloc;
 const int kMaxNumThreads = 500;
 pthread_t tid[kMaxNumThreads];
 
 pthread_cond_t cond = PTHREAD_COND_INITIALIZER;
 pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;
-bool go = false;
+char go = 0;
 
 void *thread_fun(void *arg) {
   pthread_mutex_lock(&mutex);
   while (!go) pthread_cond_wait(&cond, &mutex);
   pthread_mutex_unlock(&mutex);
   for (int i = 0; i < total_num_alloc / num_threads; i++) {
     void *p = malloc(10);
     __asm__ __volatile__("" : : "r"(p) : "memory");
printf("%d threads, %d allocations in each\n", num_threads,
          total_num_alloc / num_threads);
   fprintf(stderr, "Heap size before: %zd\n", __sanitizer_get_heap_size());
   fprintf(stderr, "Allocated bytes before: %zd\n",
           __sanitizer_get_current_allocated_bytes());
 
   for (int i = 0; i < num_threads; i++)
     pthread_create(&tid[i], 0, thread_fun, 0);
   pthread_mutex_lock(&mutex);
-  go = true;
+  go = 1;
   pthread_cond_broadcast(&cond);
   pthread_mutex_unlock(&mutex);
   for (int i = 0; i < num_threads; i++)
     pthread_join(tid[i], 0);
 
   fprintf(stderr, "Heap size after: %zd\n", __sanitizer_get_heap_size());
   fprintf(stderr, "Allocated bytes after: %zd\n",
           __sanitizer_get_current_allocated_bytes());
 
   return 0;
 }

test/scudo/tsd_destruction.c

 // RUN: %clang_scudo %s -o %t
 // RUN: %run %t 2>&1
 
 #include <locale.h>
 #include <pthread.h>
 #include <stdint.h>
 #include <stdlib.h>
 #include <string.h>
 
 // Some of glibc's own thread local data is destroyed after a user's thread
 // local destructors are called, via __libc_thread_freeres. This might involve
 // calling free, as is the case for strerror_thread_freeres.
 // If there is no prior heap operation in the thread, this free would end up 
 // initializing some thread specific data that would never be destroyed
 // properly, while still being deallocated when the TLS goes away. As a result,
 // a program could SEGV, usually in
 // __sanitizer::AllocatorGlobalStats::Unregister, where one of the doubly
 // linked list links would refer to a now unmapped memory area.
 
 // This test reproduces those circumstances. Success means executing without
 // a segmentation fault.
 
 const int kNumThreads = 16;
 pthread_t tid[kNumThreads];
 
 void *thread_func(void *arg) {
   uintptr_t i = (uintptr_t)arg;
   if ((i & 1) == 0) free(malloc(16));
   // Calling strerror_l allows for strerror_thread_freeres to be called.
   strerror_l(0, LC_GLOBAL_LOCALE);
   return 0;
 }
 
 int main(int argc, char** argv) {
   for (uintptr_t j = 0; j < 8; j++) {
     for (uintptr_t i = 0; i < kNumThreads; i++)
       pthread_create(&tid[i], 0, thread_func, (void *)i);
     for (uintptr_t i = 0; i < kNumThreads; i++)
       pthread_join(tid[i], 0);
   }
   return 0;
 }
 

test/scudo/valloc.c

 #include <unistd.h>
 
 size_t round_up_to(size_t size, size_t alignment) {
   return (size + alignment - 1) & ~(alignment - 1);
 }
 
 int main(int argc, char **argv)
 {
-  void *p = nullptr;
+  void *p = NULL;
   size_t size, page_size;
 
   assert(argc == 2);
 
   page_size = sysconf(_SC_PAGESIZE);
   // Check that the page size is a power of two.
   assert((page_size & (page_size - 1)) == 0);