[asan] Support running without /proc.

[eugenis]

Summary

This patch lets ASan run when /proc is not accessible (ex. not mounted
yet). It includes a special test-only flag that emulates this condition
in an unpriviledged process.

[pcc]

compiler-rt/lib/sanitizer_common/sanitizer_posix.h

106 ↗

(On Diff #178827)

The purpose of this function is a little ambiguous from the name, it sounds like it might actually try to open the file. Maybe a better name would be ShouldMockFailureToOpen?

[vitalybuka]

compiler-rt/lib/asan/asan_thread.cc

302 ↗

(On Diff #178827)

I dont see why const_cast is needed here

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_common.cc

147 ↗

(On Diff #178827)

what is the purpose of cache_enabled?
It's always true
also to return false, it needs to always get to IsProcMapsAvailable()

[eugenis]

.

[eugenis]

compiler-rt/lib/asan/asan_thread.cc

302 ↗

(On Diff #178827)

Yeah. Removed in a separate commit.

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_common.cc

147 ↗

(On Diff #178827)

The same as in MemoryMappingLayout constructor - some users are ok with old, cached mappings, some are not. The cache is used to support sandboxing - a situation where /proc/self/maps has been accessible before, but not right now. In that case IsAvailable(true) will say yes if there is cached data.

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_common.cc

147 ↗

(On Diff #178827)

So who are those users who set false?
E.g. for MemoryMappingLayout constructor I see both false and true callers.

[vitalybuka]

LGTM

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_common.cc

147 ↗

(On Diff #178827)

So I'd remove parameter and make it always as true.

[krytarowski]

I would note that this commit is Linux only. NetBSD already sanitizers init(8) without issues. It's also running without /proc mounted.

[eugenis]

In D55874#1340200, @krytarowski wrote:

I would note that this commit is Linux only. NetBSD already sanitizers init(8) without issues. It's also running without /proc mounted.

Yes, because *BSD have a sane interface for enumerating virtual memory mappings.
I'll mention this in commit description.

[eugenis]

updated description

[eugenis]

Removed an unused parameter.

lib/asan/asan_linux.cc

void AsanCheckIncompatibleRT() {
   if (ASAN_DYNAMIC) {
     if (__asan_rt_version == ASAN_RT_VERSION_UNDEFINED) {
       __asan_rt_version = ASAN_RT_VERSION_DYNAMIC;
     } else if (__asan_rt_version != ASAN_RT_VERSION_DYNAMIC) {
       ReportIncompatibleRT();
     }
   } else {
     if (__asan_rt_version == ASAN_RT_VERSION_UNDEFINED) {
+      if (!MemoryMappingLayout::IsAvailable())
+        return;
       // Ensure that dynamic runtime is not present. We should detect it
       // as early as possible, otherwise ASan interceptors could bind to
       // the functions in dynamic ASan runtime instead of the functions in
       // system libraries, causing crashes later in ASan initialization.
       MemoryMappingLayout proc_maps(/*cache_enabled*/true);
       char filename[PATH_MAX];
       MemoryMappedSegment segment(filename, sizeof(filename));
       while (proc_maps.Next(&segment)) {

lib/asan/asan_thread.cc

 //===----------------------------------------------------------------------===//
 #include "asan_allocator.h"
 #include "asan_interceptors.h"
 #include "asan_poisoning.h"
 #include "asan_stack.h"
 #include "asan_thread.h"
 #include "asan_mapping.h"
 #include "sanitizer_common/sanitizer_common.h"
+#include "sanitizer_common/sanitizer_file.h"
 #include "sanitizer_common/sanitizer_placement_new.h"
 #include "sanitizer_common/sanitizer_stackdepot.h"
 #include "sanitizer_common/sanitizer_tls_get_addr.h"
 #include "lsan/lsan_common.h"
 
 namespace __asan {
 
 // AsanThreadContext implementation.
FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() {
   return nullptr;
 }
 
 void AsanThread::Init(const InitOptions *options) {
   next_stack_top_ = next_stack_bottom_ = 0;
   atomic_store(&stack_switching_, false, memory_order_release);
   CHECK_EQ(this->stack_size(), 0U);
   SetThreadStackAndTls(options);
+  if (stack_top_ != stack_bottom_) {
     CHECK_GT(this->stack_size(), 0U);
     CHECK(AddrIsInMem(stack_bottom_));
     CHECK(AddrIsInMem(stack_top_ - 1));
+  }
   ClearShadowForThreadStackAndTLS();
   fake_stack_ = nullptr;
   if (__asan_option_detect_stack_use_after_return)
     AsyncSignalSafeLazyInitFakeStack();
   int local = 0;
   VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(),
           (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_,
           &local);
AsanThread *CreateMainThread() {
   return main_thread;
 }
 
 // This implementation doesn't use the argument, which is just passed down
 // from the caller of Init (which see, above).  It's only there to support
 // OS-specific implementations that need more information passed through.
 void AsanThread::SetThreadStackAndTls(const InitOptions *options) {
   DCHECK_EQ(options, nullptr);
+  // If this process is "init" (pid 1), /proc may not be mounted yet.
+  if (!start_routine_ && !MemoryMappingLayout::IsAvailable()) {
+    stack_top_ = stack_bottom_ = 0;
+    tls_begin_ = tls_end_ = 0;
+  } else {
     uptr tls_size = 0;
     uptr stack_size = 0;
     GetThreadStackAndTls(tid() == 0, &stack_bottom_, &stack_size, &tls_begin_,
                          &tls_size);
     stack_top_ = stack_bottom_ + stack_size;
     tls_end_ = tls_begin_ + tls_size;
     dtls_ = DTLS_Get();
 
     int local;
     CHECK(AddrIsInStack((uptr)&local));
   }
+}
 
 #endif  // !SANITIZER_FUCHSIA && !SANITIZER_RTEMS
 
 void AsanThread::ClearShadowForThreadStackAndTLS() {
+  if (stack_top_ != stack_bottom_)
     PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0);
   if (tls_begin_ != tls_end_) {
     uptr tls_begin_aligned = RoundDownTo(tls_begin_, SHADOW_GRANULARITY);
     uptr tls_end_aligned = RoundUpTo(tls_end_, SHADOW_GRANULARITY);
     FastPoisonShadowPartialRightRedzone(tls_begin_aligned,
                                         tls_end_ - tls_begin_aligned,
                                         tls_end_aligned - tls_end_, 0);
   }
 }
 
 bool AsanThread::GetStackFrameAccessByAddr(uptr addr,
                                            StackFrameAccess *access) {
+  if (stack_top_ == stack_bottom_)
+    return false;
+
   uptr bottom = 0;
   if (AddrIsInStack(addr)) {
     bottom = stack_bottom();
   } else if (has_fake_stack()) {
     bottom = fake_stack()->AddrIsInFakeStack(addr);
     CHECK(bottom);
     access->offset = addr - bottom;
     access->frame_pc = ((uptr*)bottom)[2];

lib/hwasan/hwasan_thread.cc

stack_allocations_ = new (ThreadLong)
       StackAllocationsRingBuffer((void *)stack_buffer_start, stack_buffer_size);
   // Check that it worked.
   CHECK_EQ(GetCurrentThread(), this);
 
   // ScopedTaggingDisable needs GetCurrentThread to be set up.
   ScopedTaggingDisabler disabler;
 
   // If this process is "init" (pid 1), /proc may not be mounted yet.
-  if (IsMainThread() && !FileExists("/proc/self/maps")) {
+  if (IsMainThread() && !MemoryMappingLayout::IsAvailable()) {
     stack_top_ = stack_bottom_ = 0;
     tls_begin_ = tls_end_ = 0;
   } else {
     uptr tls_size;
     uptr stack_size;
     GetThreadStackAndTls(IsMainThread(), &stack_bottom_, &stack_size,
                          &tls_begin_, &tls_size);
     stack_top_ = stack_bottom_ + stack_size;

lib/sanitizer_common/sanitizer_flags.inc

 COMMON_FLAG(bool, dump_instruction_bytes, false,
           "If true, dump 16 bytes starting at the instruction that caused SEGV")
 COMMON_FLAG(bool, dump_registers, true,
           "If true, dump values of CPU registers when SEGV happens. Only "
           "available on OS X for now.")
 COMMON_FLAG(bool, detect_write_exec, false,
           "If true, triggers warning when writable-executable pages requests "
           "are being made")
+COMMON_FLAG(bool, test_only_emulate_no_procfs, false,
+            "TEST ONLY fail to open any files under /proc to emulate sanitized "
+            "\"init\"")

lib/sanitizer_common/sanitizer_linux.h

 };
 
 struct MemoryMappingLayoutData {
   ProcSelfMapsBuff proc_self_maps;
   const char *current;
 };
 
 void ReadProcMaps(ProcSelfMapsBuff *proc_maps);
+bool IsProcMapsAvailable();
 
 // Syscall wrappers.
 uptr internal_getdents(fd_t fd, struct linux_dirent *dirp, unsigned int count);
 uptr internal_sigaltstack(const void* ss, void* oss);
 uptr internal_sigprocmask(int how, __sanitizer_sigset_t *set,
     __sanitizer_sigset_t *oldset);
 uptr internal_clock_gettime(__sanitizer_clockid_t clk_id, void *tp);
 

lib/sanitizer_common/sanitizer_linux.cc

uptr internal_execve(const char *filename, char *const argv[],
                      char *const envp[]) {
   return internal_syscall(SYSCALL(execve), (uptr)filename, (uptr)argv,
                           (uptr)envp);
 }
 #endif  // !SANITIZER_SOLARIS && !SANITIZER_NETBSD
 
 // ----------------- sanitizer_common.h
 bool FileExists(const char *filename) {
+  if (ShouldMockFailureToOpen(filename))
+    return false;
   struct stat st;
 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
   if (internal_syscall(SYSCALL(newfstatat), AT_FDCWD, filename, &st, 0))
 #else
   if (internal_stat(filename, &st))
 #endif
     return false;
   // Sanity check: filename is a regular file.
if (!internal_iserror(descriptor_))
     internal_close(descriptor_);
 }
 #endif
 
 #if SANITIZER_WORDSIZE == 32
 // Take care of unusable kernel area in top gigabyte.
 static uptr GetKernelAreaSize() {
 #if SANITIZER_LINUX && !SANITIZER_X32
+  if (!MemoryMappingLayout::IsAvailable())
+    return 0;
   const uptr gbyte = 1UL << 30;
 
   // Firstly check if there are writable segments
   // mapped to top gigabyte (e.g. stack).
   MemoryMappingLayout proc_maps(/*cache_enabled*/true);
   MemoryMappedSegment segment;
   while (proc_maps.Next(&segment)) {
     if ((segment.end >= 3 * gbyte) && segment.IsWritable()) return 0;

lib/sanitizer_common/sanitizer_mac.cc

 }
 
 uptr internal_waitpid(int pid, int *status, int options) {
   return waitpid(pid, status, options);
 }
 
 // ----------------- sanitizer_common.h
 bool FileExists(const char *filename) {
+  if (ShouldMockFailureToOpen(filename))
+    return false;
   struct stat st;
   if (stat(filename, &st))
     return false;
   // Sanity check: filename is a regular file.
   return S_ISREG(st.st_mode);
 }
 
 tid_t GetTid() {

lib/sanitizer_common/sanitizer_posix.h

 uptr internal_execve(const char *filename, char *const argv[],
                      char *const envp[]);
 
 bool IsStateDetached(int state);
 
 // Move the fd out of {0, 1, 2} range.
 fd_t ReserveStandardFds(fd_t fd);
 
+bool ShouldMockFailureToOpen(const char *path);
+
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_POSIX_H

lib/sanitizer_common/sanitizer_posix.cc

 //===----------------------------------------------------------------------===//
 
 #include "sanitizer_platform.h"
 
 #if SANITIZER_POSIX
 
 #include "sanitizer_common.h"
 #include "sanitizer_file.h"
+#include "sanitizer_flags.h"
 #include "sanitizer_libc.h"
 #include "sanitizer_posix.h"
 #include "sanitizer_procmaps.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <signal.h>
 #include <sys/mman.h>
bool MprotectReadOnly(uptr addr, uptr size) {
   return 0 == internal_mprotect((void *)addr, size, PROT_READ);
 }
 
 #if !SANITIZER_MAC
 void MprotectMallocZones(void *addr, int prot) {}
 #endif
 
 fd_t OpenFile(const char *filename, FileAccessMode mode, error_t *errno_p) {
+  if (ShouldMockFailureToOpen(filename))
+    return kInvalidFd;
   int flags;
   switch (mode) {
     case RdOnly: flags = O_RDONLY; break;
     case WrOnly: flags = O_WRONLY | O_CREAT | O_TRUNC; break;
     case RdWr: flags = O_RDWR | O_CREAT; break;
   }
   fd_t res = internal_open(filename, flags, 0660);
   if (internal_iserror(res, errno_p))
static inline bool IntervalsAreSeparate(uptr start1, uptr end1,
   return (end1 < start2) || (end2 < start1);
 }
 
 // FIXME: this is thread-unsafe, but should not cause problems most of the time.
 // When the shadow is mapped only a single thread usually exists (plus maybe
 // several worker threads on Mac, which aren't expected to map big chunks of
 // memory).
 bool MemoryRangeIsAvailable(uptr range_start, uptr range_end) {
+  if (!MemoryMappingLayout::IsAvailable())
+    return true; // hope for the best
   MemoryMappingLayout proc_maps(/*cache_enabled*/true);
   MemoryMappedSegment segment;
   while (proc_maps.Next(&segment)) {
     if (segment.start == segment.end) continue;  // Empty range.
     CHECK_NE(0, segment.end);
     if (!IntervalsAreSeparate(segment.start, segment.end - 1, range_start,
                               range_end))
       return false;
while (fd <= 2) {
     fd = internal_dup(fd);
   }
   for (int i = 0; i <= 2; ++i)
     if (used[i])
       internal_close(i);
   return fd;
 }
 
+bool ShouldMockFailureToOpen(const char *path) {
+  return common_flags()->test_only_emulate_no_procfs &&
+         internal_strncmp(path, "/proc/", 6) == 0;
+}
+
 } // namespace __sanitizer
 
 #endif // SANITIZER_POSIX

lib/sanitizer_common/sanitizer_procmaps.h

public:
   explicit MemoryMappingLayout(bool cache_enabled);
   ~MemoryMappingLayout();
   bool Next(MemoryMappedSegment *segment);
   void Reset();
   // In some cases, e.g. when running under a sandbox on Linux, ASan is unable
   // to obtain the memory mappings. It should fall back to pre-cached data
   // instead of aborting.
   static void CacheMemoryMappings();
+  static bool IsAvailable();
 
   // Adds all mapped objects into a vector.
   void DumpListOfModules(InternalMmapVectorNoCtor<LoadedModule> *modules);
 
  private:
   void LoadFromCache();
 
   MemoryMappingLayoutData data_;

lib/sanitizer_common/sanitizer_procmaps_bsd.cc

 #include <osreldate.h>
 #if __FreeBSD_version <= 902001 // v9.2
 #define kinfo_vmentry xkinfo_vmentry
 #endif
 #endif
 
 namespace __sanitizer {
 
+bool IsProcMapsAvailable() {
+  return true;
+}
+
 void ReadProcMaps(ProcSelfMapsBuff *proc_maps) {
   const int Mib[] = {
 #if SANITIZER_FREEBSD
     CTL_KERN,
     KERN_PROC,
     KERN_PROC_VMMAP,
     getpid()
 #elif SANITIZER_OPENBSD

lib/sanitizer_common/sanitizer_procmaps_common.cc

for (uptr i = 0; Next(&segment); i++) {
     uptr base_address = (i ? segment.start : 0) - segment.offset;
     LoadedModule cur_module;
     cur_module.set(cur_name, base_address);
     segment.AddAddressRanges(&cur_module);
     modules->push_back(cur_module);
   }
 }
 
+bool MemoryMappingLayout::IsAvailable() {
+  if (cached_proc_self_maps.data)
+    return true;
+  return IsProcMapsAvailable();
+}
+
 void GetMemoryProfile(fill_profile_f cb, uptr *stats, uptr stats_size) {
   char *smaps = nullptr;
   uptr smaps_cap = 0;
   uptr smaps_len = 0;
   if (!ReadFileToBuffer("/proc/self/smaps", &smaps, &smaps_cap, &smaps_len))
     return;
   uptr start = 0;
   bool file = false;

lib/sanitizer_common/sanitizer_procmaps_linux.cc

 //===-- sanitizer_procmaps_linux.cc ---------------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // Information about the process mappings (Linux-specific parts).
 //===----------------------------------------------------------------------===//
 
 #include "sanitizer_platform.h"
 #if SANITIZER_LINUX
 #include "sanitizer_common.h"
+#include "sanitizer_file.h"
 #include "sanitizer_procmaps.h"
 
 namespace __sanitizer {
 
+bool IsProcMapsAvailable() {
+  return FileExists("/proc/self/maps");
+}
+
 void ReadProcMaps(ProcSelfMapsBuff *proc_maps) {
   if (!ReadFileToBuffer("/proc/self/maps", &proc_maps->data,
                         &proc_maps->mmaped_size, &proc_maps->len)) {
     proc_maps->data = nullptr;
     proc_maps->mmaped_size = 0;
     proc_maps->len = 0;
   }
 }

lib/sanitizer_common/sanitizer_procmaps_solaris.cc

 
 // Before Solaris 11.4, <procfs.h> doesn't work in a largefile environment.
 #undef _FILE_OFFSET_BITS
 #include <procfs.h>
 #include <limits.h>
 
 namespace __sanitizer {
 
+bool IsProcMapsAvailable() {
+  return FileExists("/proc/self/xmap");
+}
+
 void ReadProcMaps(ProcSelfMapsBuff *proc_maps) {
   ReadFileToBuffer("/proc/self/xmap", &proc_maps->data, &proc_maps->mmaped_size,
                    &proc_maps->len);
 }
 
 bool MemoryMappingLayout::Next(MemoryMappedSegment *segment) {
   char *last = data_.proc_self_maps.data + data_.proc_self_maps.len;
   if (data_.current >= last) return false;

test/asan/TestCases/Posix/no-fd.cc

 // RUN: %clangxx_asan -O0 %s -o %t
 // RUN: %run %t 2>&1 | FileCheck %s
 // RUN: %env_asan_opts=debug=1,verbosity=2 %run %t 2>&1 | FileCheck %s
 
 // Test ASan initialization
 
 #include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
 
+extern "C" const char *__asan_default_options() {
+  return "test_only_emulate_no_procfs=1";
+}
+
 void parent(int argc, char **argv) {
   fprintf(stderr, "hello\n");
   // CHECK: hello
   close(0);
   close(1);
   dup2(2, 3);
   close(2);
   char *const newargv[] = {argv[0], (char *)"x", nullptr};