This is an archive of the discontinued LLVM Phabricator instance.

[hwasan] implement free_checks_tail_magic=1
ClosedPublic

Authored by kcc on Nov 16 2018, 3:38 PM.

Details

Summary

With free_checks_tail_magic=1 (default) HWASAN
writes magic bytes to the tail of every heap allocation
(last bytes of the last granule, if the last granule is not fully used)
and checks these bytes on free().

This feature will detect buffer overwires within the last granule
at the time of free().

This is an alternative to malloc_align_right=[1289] that should have
fewer compatibility issues. It is also weaker since it doesn't
detect read overflows and reports bugs at free() instead of at access.

Event Timeline

kcc created this revision.Nov 16 2018, 3:38 PM
Herald added subscribers: Restricted Project, delcypher, kubamracek. · View Herald TranscriptNov 16 2018, 3:38 PM

Users will hate these reports.
LGTM with comments

lib/hwasan/hwasan_allocator.cc
220

There is a check like this in TaggedSize.
Maybe check that tail_size is <= shadow granule instead.

lib/hwasan/hwasan_report.cc
350

This will break output into multiple lines in syslog. Needs buffering, same as shadow map printing.

kcc updated this revision to Diff 174476.Nov 16 2018, 4:14 PM

addressed comments.

kcc added a comment.Nov 16 2018, 4:15 PM

Yep. We ourselves will hate these reports. Still, better than nothing.

lib/hwasan/hwasan_allocator.cc
220

done

lib/hwasan/hwasan_report.cc
350

done

This revision was not accepted when it landed; it landed in state Needs Review.Nov 16 2018, 4:27 PM
This revision was automatically updated to reflect the committed changes.
eugenis added inline comments.Nov 16 2018, 4:31 PM
lib/hwasan/hwasan_allocator.cc
46

I don't think ALIGNED(16) is necessary.

222

less-or-equals
When size is 0, tagged_size is 16.

eugenis added inline comments.Nov 16 2018, 4:32 PM
lib/hwasan/hwasan_allocator.cc
222

oh right, tail is 0 in that case