[asan] Support running without /proc

[eugenis]

Summary

This patch lets ASan run when /proc is not accessible (ex. not mounted
yet). It includes a special test-only flag that emulates this condition
in an unpriviledged process.

This only matters on Linux, where /proc is necessary to enumerate
virtual memory mappings.

[eugenis]

This is a second attempt at this.
This time, instead of checking for /proc/self/maps accessibility in advance, we tolerate a failure to read that file, and make it look like an empty mapping list. There is an optional Error() method of MemoryMappingLayout that can be used to detect this condition.

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_posix.cc

342

what if instead of this we add
common_flags()->procfs_path and set it to /proc/ by defaut?

[krytarowski]

There is a related issue on NetBSD. Right now proc map cannot exceed 10MBs (it was raised from 1MBs) (when using sysctl(3) interface, there is a complicated way to workaround it and read kernel structs directly).

Part of the tests (libFuzzer ones) were fixed with this kernel change, but there is still issue with at least: test/tsan/ignore_lib5.cc.

Can we handle with this change a similar scenario that proc map is too large to be retrieved? If so can we generalize no-/proc to no-memorymap?

[eugenis]

In D56141#1342105, @krytarowski wrote:

Can we handle with this change a similar scenario that proc map is too large to be retrieved? If so can we generalize no-/proc to no-memorymap?

Does this look like an error return from internal_sysctl in ReadProcMaps? Sure, we can mock that condition with the same flag.

compiler-rt/lib/sanitizer_common/sanitizer_posix.cc

342

Not sure about that. It would take a mock flag, and disguise it as a user flag. Unless there are actual practical cases where procfs is mounted somewhere other than /proc, all this would do is confuse people, IMHO.

[krytarowski]

In D56141#1348702, @eugenis wrote:

In D56141#1342105, @krytarowski wrote:

Can we handle with this change a similar scenario that proc map is too large to be retrieved? If so can we generalize no-/proc to no-memorymap?

Does this look like an error return from internal_sysctl in ReadProcMaps? Sure, we can mock that condition with the same flag.

Yes, we receive E2BIG. The current behavior is that on some assert() the code hangs.

[eugenis]

renamed the flag

[eugenis]

Sure. I've renamed the flag, but I'd like to leave the actual *bsd implementation of it and the Error() handling to you as I don't have the setup to test it.

[vitalybuka]

LGTM

compiler-rt/lib/sanitizer_common/sanitizer_posix.cc

342

add tests into name e.g. test_only_procfs_path
this will be more generic, maybe let some one add useful tests with about the same complexity of the flag implementation

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_bsd.cc

102

why it's CHECK here and "return false;" on linux

[eugenis]

compiler-rt/lib/sanitizer_common/sanitizer_posix.cc

342

this would conflict with @krytarowski request for emulating E2BIG on *bsd

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_bsd.cc

102

That's because ReadProcMaps for *bsd never sets data to nullptr, it aborts instead.

[vitalybuka]

LGTM

compiler-rt/lib/asan/asan_thread.cc

FakeStack *AsanThread::AsyncSignalSafeLazyInitFakeStack() {
   return nullptr;
 }
 
 void AsanThread::Init(const InitOptions *options) {
   next_stack_top_ = next_stack_bottom_ = 0;
   atomic_store(&stack_switching_, false, memory_order_release);
   CHECK_EQ(this->stack_size(), 0U);
   SetThreadStackAndTls(options);
+  if (stack_top_ != stack_bottom_) {
     CHECK_GT(this->stack_size(), 0U);
     CHECK(AddrIsInMem(stack_bottom_));
     CHECK(AddrIsInMem(stack_top_ - 1));
+  }
   ClearShadowForThreadStackAndTLS();
   fake_stack_ = nullptr;
   if (__asan_option_detect_stack_use_after_return)
     AsyncSignalSafeLazyInitFakeStack();
   int local = 0;
   VReport(1, "T%d: stack [%p,%p) size 0x%zx; local=%p\n", tid(),
           (void *)stack_bottom_, (void *)stack_top_, stack_top_ - stack_bottom_,
           &local);
void AsanThread::SetThreadStackAndTls(const InitOptions *options) {
   uptr tls_size = 0;
   uptr stack_size = 0;
   GetThreadStackAndTls(tid() == 0, &stack_bottom_, &stack_size, &tls_begin_,
                        &tls_size);
   stack_top_ = stack_bottom_ + stack_size;
   tls_end_ = tls_begin_ + tls_size;
   dtls_ = DTLS_Get();
 
+  if (stack_top_ != stack_bottom_) {
     int local;
     CHECK(AddrIsInStack((uptr)&local));
   }
+}
 
 #endif  // !SANITIZER_FUCHSIA && !SANITIZER_RTEMS
 
 void AsanThread::ClearShadowForThreadStackAndTLS() {
+  if (stack_top_ != stack_bottom_)
     PoisonShadow(stack_bottom_, stack_top_ - stack_bottom_, 0);
   if (tls_begin_ != tls_end_) {
     uptr tls_begin_aligned = RoundDownTo(tls_begin_, SHADOW_GRANULARITY);
     uptr tls_end_aligned = RoundUpTo(tls_end_, SHADOW_GRANULARITY);
     FastPoisonShadowPartialRightRedzone(tls_begin_aligned,
                                         tls_end_ - tls_begin_aligned,
                                         tls_end_aligned - tls_end_, 0);
   }
 }
 
 bool AsanThread::GetStackFrameAccessByAddr(uptr addr,
                                            StackFrameAccess *access) {
+  if (stack_top_ == stack_bottom_)
+    return false;
+
   uptr bottom = 0;
   if (AddrIsInStack(addr)) {
     bottom = stack_bottom();
   } else if (has_fake_stack()) {
     bottom = fake_stack()->AddrIsInFakeStack(addr);
     CHECK(bottom);
     access->offset = addr - bottom;
     access->frame_pc = ((uptr*)bottom)[2];

compiler-rt/lib/hwasan/hwasan_thread.cc

void Thread::Init(uptr stack_buffer_start, uptr stack_buffer_size) {
   stack_allocations_ = new (ThreadLong)
       StackAllocationsRingBuffer((void *)stack_buffer_start, stack_buffer_size);
   // Check that it worked.
   CHECK_EQ(GetCurrentThread(), this);
 
   // ScopedTaggingDisable needs GetCurrentThread to be set up.
   ScopedTaggingDisabler disabler;
 
-  // If this process is "init" (pid 1), /proc may not be mounted yet.
-  if (IsMainThread() && !FileExists("/proc/self/maps")) {
-    stack_top_ = stack_bottom_ = 0;
-    tls_begin_ = tls_end_ = 0;
-  } else {
-    uptr tls_size;
-    uptr stack_size;
-    GetThreadStackAndTls(IsMainThread(), &stack_bottom_, &stack_size,
-                         &tls_begin_, &tls_size);
-    stack_top_ = stack_bottom_ + stack_size;
-    tls_end_ = tls_begin_ + tls_size;
+  GetThreadStackAndTls(IsMainThread(), &stack_bottom_, &stack_size, &tls_begin_,
+                       &tls_size);
 
+  if (stack_bottom_) {
     int local;
     CHECK(AddrIsInStack((uptr)&local));
     CHECK(MemIsApp(stack_bottom_));
     CHECK(MemIsApp(stack_top_ - 1));
-
-    if (stack_bottom_) {
-      CHECK(MemIsApp(stack_bottom_));
-      CHECK(MemIsApp(stack_top_ - 1));
-    }
   }
 
   if (flags()->verbose_threads) {
     if (IsMainThread()) {
       Printf("sizeof(Thread): %zd sizeof(HeapRB): %zd sizeof(StackRB): %zd\n",
              sizeof(Thread), heap_allocations_->SizeInBytes(),
              stack_allocations_->size() * sizeof(uptr));
     }

compiler-rt/lib/sanitizer_common/sanitizer_flags.inc

 COMMON_FLAG(bool, dump_instruction_bytes, false,
           "If true, dump 16 bytes starting at the instruction that caused SEGV")
 COMMON_FLAG(bool, dump_registers, true,
           "If true, dump values of CPU registers when SEGV happens. Only "
           "available on OS X for now.")
 COMMON_FLAG(bool, detect_write_exec, false,
           "If true, triggers warning when writable-executable pages requests "
           "are being made")
+COMMON_FLAG(bool, test_only_emulate_no_memorymap, false,
+            "TEST ONLY fail to read memory mappings to emulate sanitized "
+            "\"init\"")

compiler-rt/lib/sanitizer_common/sanitizer_linux.cc

uptr internal_execve(const char *filename, char *const argv[],
                      char *const envp[]) {
   return internal_syscall(SYSCALL(execve), (uptr)filename, (uptr)argv,
                           (uptr)envp);
 }
 #endif  // !SANITIZER_SOLARIS && !SANITIZER_NETBSD
 
 // ----------------- sanitizer_common.h
 bool FileExists(const char *filename) {
+  if (ShouldMockFailureToOpen(filename))
+    return false;
   struct stat st;
 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
   if (internal_syscall(SYSCALL(newfstatat), AT_FDCWD, filename, &st, 0))
 #else
   if (internal_stat(filename, &st))
 #endif
     return false;
   // Sanity check: filename is a regular file.

 // Take care of unusable kernel area in top gigabyte.
 static uptr GetKernelAreaSize() {
 #if SANITIZER_LINUX && !SANITIZER_X32
   const uptr gbyte = 1UL << 30;
 
   // Firstly check if there are writable segments
   // mapped to top gigabyte (e.g. stack).
   MemoryMappingLayout proc_maps(/*cache_enabled*/true);
+  if (proc_maps.Error())
+    return 0;
   MemoryMappedSegment segment;
   while (proc_maps.Next(&segment)) {
     if ((segment.end >= 3 * gbyte) && segment.IsWritable()) return 0;
   }
 
 #if !SANITIZER_ANDROID
   // Even if nothing is mapped, top Gb may still be accessible
   // if we are running on 64-bit kernel.

compiler-rt/lib/sanitizer_common/sanitizer_linux_libcdep.cc

void GetThreadStackTopAndBottom(bool at_initialization, uptr *stack_top,
   CHECK(stack_bottom);
   if (at_initialization) {
     // This is the main thread. Libpthread may not be initialized yet.
     struct rlimit rl;
     CHECK_EQ(getrlimit(RLIMIT_STACK, &rl), 0);
 
     // Find the mapping that contains a stack variable.
     MemoryMappingLayout proc_maps(/*cache_enabled*/true);
+    if (proc_maps.Error()) {
+      *stack_top = *stack_bottom = 0;
+      return;
+    }
     MemoryMappedSegment segment;
     uptr prev_end = 0;
     while (proc_maps.Next(&segment)) {
       if ((uptr)&rl < segment.end) break;
       prev_end = segment.end;
     }
     CHECK((uptr)&rl >= segment.start && (uptr)&rl < segment.end);
 

compiler-rt/lib/sanitizer_common/sanitizer_mac.cc

 }
 
 uptr internal_waitpid(int pid, int *status, int options) {
   return waitpid(pid, status, options);
 }
 
 // ----------------- sanitizer_common.h
 bool FileExists(const char *filename) {
+  if (ShouldMockFailureToOpen(filename))
+    return false;
   struct stat st;
   if (stat(filename, &st))
     return false;
   // Sanity check: filename is a regular file.
   return S_ISREG(st.st_mode);
 }
 
 tid_t GetTid() {

compiler-rt/lib/sanitizer_common/sanitizer_posix.h

 uptr internal_execve(const char *filename, char *const argv[],
                      char *const envp[]);
 
 bool IsStateDetached(int state);
 
 // Move the fd out of {0, 1, 2} range.
 fd_t ReserveStandardFds(fd_t fd);
 
+bool ShouldMockFailureToOpen(const char *path);
+
 }  // namespace __sanitizer
 
 #endif  // SANITIZER_POSIX_H

compiler-rt/lib/sanitizer_common/sanitizer_posix.cc

 //===----------------------------------------------------------------------===//
 
 #include "sanitizer_platform.h"
 
 #if SANITIZER_POSIX
 
 #include "sanitizer_common.h"
 #include "sanitizer_file.h"
+#include "sanitizer_flags.h"
 #include "sanitizer_libc.h"
 #include "sanitizer_posix.h"
 #include "sanitizer_procmaps.h"
 
 #include <errno.h>
 #include <fcntl.h>
 #include <signal.h>
 #include <sys/mman.h>
bool MprotectReadOnly(uptr addr, uptr size) {
   return 0 == internal_mprotect((void *)addr, size, PROT_READ);
 }
 
 #if !SANITIZER_MAC
 void MprotectMallocZones(void *addr, int prot) {}
 #endif
 
 fd_t OpenFile(const char *filename, FileAccessMode mode, error_t *errno_p) {
+  if (ShouldMockFailureToOpen(filename))
+    return kInvalidFd;
   int flags;
   switch (mode) {
     case RdOnly: flags = O_RDONLY; break;
     case WrOnly: flags = O_WRONLY | O_CREAT | O_TRUNC; break;
     case RdWr: flags = O_RDWR | O_CREAT; break;
   }
   fd_t res = internal_open(filename, flags, 0660);
   if (internal_iserror(res, errno_p))

 }
 
 // FIXME: this is thread-unsafe, but should not cause problems most of the time.
 // When the shadow is mapped only a single thread usually exists (plus maybe
 // several worker threads on Mac, which aren't expected to map big chunks of
 // memory).
 bool MemoryRangeIsAvailable(uptr range_start, uptr range_end) {
   MemoryMappingLayout proc_maps(/*cache_enabled*/true);
+  if (proc_maps.Error())
+    return true; // and hope for the best
   MemoryMappedSegment segment;
   while (proc_maps.Next(&segment)) {
     if (segment.start == segment.end) continue;  // Empty range.
     CHECK_NE(0, segment.end);
     if (!IntervalsAreSeparate(segment.start, segment.end - 1, range_start,
                               range_end))
       return false;
   }
while (fd <= 2) {
     fd = internal_dup(fd);
   }
   for (int i = 0; i <= 2; ++i)
     if (used[i])
       internal_close(i);
   return fd;
 }
 
+bool ShouldMockFailureToOpen(const char *path) {
+  return common_flags()->test_only_emulate_no_memorymap &&
+         internal_strncmp(path, "/proc/", 6) == 0;
+}
+
 } // namespace __sanitizer
 
 #endif // SANITIZER_POSIX

compiler-rt/lib/sanitizer_common/sanitizer_procmaps.h

private:
   MemoryMappedSegmentData *data_;
 };
 
 class MemoryMappingLayout {
  public:
   explicit MemoryMappingLayout(bool cache_enabled);
   ~MemoryMappingLayout();
   bool Next(MemoryMappedSegment *segment);
+  bool Error() const;
   void Reset();
   // In some cases, e.g. when running under a sandbox on Linux, ASan is unable
   // to obtain the memory mappings. It should fall back to pre-cached data
   // instead of aborting.
   static void CacheMemoryMappings();
 
   // Adds all mapped objects into a vector.
   void DumpListOfModules(InternalMmapVectorNoCtor<LoadedModule> *modules);

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_bsd.cc

#else
   proc_maps->data = Mem;
 #endif
 
   proc_maps->mmaped_size = MmapedSize;
   proc_maps->len = Size;
 }
 
 bool MemoryMappingLayout::Next(MemoryMappedSegment *segment) {
+  CHECK(!Error()); // can not fail
   char *last = data_.proc_self_maps.data + data_.proc_self_maps.len;
   if (data_.current >= last)
     return false;
   const struct kinfo_vmentry *VmEntry =
       (const struct kinfo_vmentry *)data_.current;
 
   segment->start = (uptr)VmEntry->kve_start;
   segment->end = (uptr)VmEntry->kve_end;

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_common.cc

MemoryMappingLayout::MemoryMappingLayout(bool cache_enabled) {
   if (cache_enabled)
     CacheMemoryMappings();
 
   // Read maps after the cache update to capture the maps/unmaps happening in
   // the process of updating.
   ReadProcMaps(&data_.proc_self_maps);
   if (cache_enabled && data_.proc_self_maps.mmaped_size == 0)
     LoadFromCache();
-  CHECK_GT(data_.proc_self_maps.mmaped_size, 0);
-  CHECK_GT(data_.proc_self_maps.len, 0);
 
   Reset();
 }
 
+bool MemoryMappingLayout::Error() const {
+  return data_.current == nullptr;
+}
+
 MemoryMappingLayout::~MemoryMappingLayout() {
   // Only unmap the buffer if it is different from the cached one. Otherwise
   // it will be unmapped when the cache is refreshed.
   if (data_.proc_self_maps.data != cached_proc_self_maps.data)
     UnmapOrDie(data_.proc_self_maps.data, data_.proc_self_maps.mmaped_size);
 }
 
 void MemoryMappingLayout::Reset() {

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_linux.cc

void ReadProcMaps(ProcSelfMapsBuff *proc_maps) {
   }
 }
 
 static bool IsOneOf(char c, char c1, char c2) {
   return c == c1 || c == c2;
 }
 
 bool MemoryMappingLayout::Next(MemoryMappedSegment *segment) {
+  if (Error()) return false; // simulate empty maps
   char *last = data_.proc_self_maps.data + data_.proc_self_maps.len;
   if (data_.current >= last) return false;
   char *next_line =
       (char *)internal_memchr(data_.current, '\n', last - data_.current);
   if (next_line == 0)
     next_line = last;
   // Example: 08048000-08056000 r-xp 00000000 03:0c 64593   /foo/bar
   segment->start = ParseHex(&data_.current);

compiler-rt/lib/sanitizer_common/sanitizer_procmaps_solaris.cc

 // Before Solaris 11.4, <procfs.h> doesn't work in a largefile environment.
 #undef _FILE_OFFSET_BITS
 #include <procfs.h>
 #include <limits.h>
 
 namespace __sanitizer {
 
 void ReadProcMaps(ProcSelfMapsBuff *proc_maps) {
-  ReadFileToBuffer("/proc/self/xmap", &proc_maps->data, &proc_maps->mmaped_size,
-                   &proc_maps->len);
+  if (!ReadFileToBuffer("/proc/self/xmap", &proc_maps->data,
+                        &proc_maps->mmaped_size, &proc_maps->len)) {
+    proc_maps->data = nullptr;
+    proc_maps->mmaped_size = 0;
+    proc_maps->len = 0;
+  }
 }
 
 bool MemoryMappingLayout::Next(MemoryMappedSegment *segment) {
+  if (Error()) return false; // simulate empty maps
   char *last = data_.proc_self_maps.data + data_.proc_self_maps.len;
   if (data_.current >= last) return false;
 
   prxmap_t *xmapentry = (prxmap_t*)data_.current;
 
   segment->start = (uptr)xmapentry->pr_vaddr;
   segment->end = (uptr)(xmapentry->pr_vaddr + xmapentry->pr_size);
   segment->offset = (uptr)xmapentry->pr_offset;

compiler-rt/test/asan/TestCases/Posix/no-fd.cc

 // RUN: %clangxx_asan -O0 %s -o %t
 // RUN: %run %t 2>&1 | FileCheck %s
 // RUN: %env_asan_opts=debug=1,verbosity=2 %run %t 2>&1 | FileCheck %s
 
 // Test ASan initialization
 
 #include <assert.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
 
+extern "C" const char *__asan_default_options() {
+  return "test_only_emulate_no_memorymap=1";
+}
+
 void parent(int argc, char **argv) {
   fprintf(stderr, "hello\n");
   // CHECK: hello
   close(0);
   close(1);
   dup2(2, 3);
   close(2);
   char *const newargv[] = {argv[0], (char *)"x", nullptr};