[safestack] Remove dependency of SafeStack on sanitizer_common

[vitalybuka]

Summary

SafeStack needs just few functions from there, but sanitizer_common
introduces conflicts with other runtimes, e.g. SCUDO.

[vitalybuka]

fix header

[eugenis]

compiler-rt/lib/safestack/safestack.cc

268

Nice! Consider moving SCS_CHECK, RoundUpTo and MutextLock to safestack_util.h or some other header.

[vitalybuka]

move some stuff into safestack_util.h
extract "static->unnamed namespace" into separate patch

[vitalybuka]

rebase

[eugenis]

LGTM

[krytarowski]

compiler-rt/trunk/lib/safestack/safestack.cc

154 ↗

(On Diff #182426)

Can we please add a dedicated (u64) type for TID? Assuming that PID==TID is linuxism.

[vitalybuka]

compiler-rt/trunk/lib/safestack/safestack.cc

154 ↗

(On Diff #182426)

https://reviews.llvm.org/D56937

compiler-rt/lib/safestack/CMakeLists.txt

 add_compiler_rt_component(safestack)
 
 set(SAFESTACK_SOURCES safestack.cc)
 
 include_directories(..)
 
 set(SAFESTACK_CFLAGS ${SANITIZER_COMMON_CFLAGS})
 
 foreach(arch ${SAFESTACK_SUPPORTED_ARCH})
   add_compiler_rt_runtime(clang_rt.safestack
     STATIC
     ARCHS ${arch}
     SOURCES ${SAFESTACK_SOURCES}
             $<TARGET_OBJECTS:RTInterception.${arch}>
-            $<TARGET_OBJECTS:RTSanitizerCommon.${arch}>
-            $<TARGET_OBJECTS:RTSanitizerCommonNoLibc.${arch}>
     CFLAGS ${SAFESTACK_CFLAGS}
     PARENT_TARGET safestack)
 endforeach()

compiler-rt/lib/safestack/safestack.cc

 //===-- safestack.cc ------------------------------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // This file implements the runtime support for the safe stack protection
 // mechanism. The runtime manages allocation/deallocation of the unsafe stack
 // for the main thread, as well as all pthreads that are created/destroyed
 // during program execution.
 //
 //===----------------------------------------------------------------------===//
 
+#include "safestack_platform.h"
+
 #include <errno.h>
-#include <limits.h>
 #include <pthread.h>
-#include <stddef.h>
-#include <stdint.h>
-#include <unistd.h>
+#include <stdio.h>
 #include <stdlib.h>
+#include <sys/mman.h>
 #include <sys/resource.h>
-#include <sys/types.h>
-#if !defined(__NetBSD__)
-#include <sys/user.h>
-#endif
 
 #include "interception/interception.h"
-#include "sanitizer_common/sanitizer_common.h"
+
+using namespace safestack;
+
+namespace {
 
 // TODO: The runtime library does not currently protect the safe stack beyond
 // relying on the system-enforced ASLR. The protection of the (safe) stack can
 // be provided by three alternative features:
 //
 // 1) Protection via hardware segmentation on x86-32 and some x86-64
 // architectures: the (safe) stack segment (implicitly accessed via the %ss
 // segment register) can be separated from the data segment (implicitly

 /// Minimum stack alignment for the unsafe stack.
 const unsigned kStackAlign = 16;
 
 /// Default size of the unsafe stack. This value is only used if the stack
 /// size rlimit is set to infinity.
 const unsigned kDefaultUnsafeStackSize = 0x2800000;
 
 /// Runtime page size obtained through sysconf
-static unsigned pageSize;
+unsigned pageSize;
 
 // TODO: To make accessing the unsafe stack pointer faster, we plan to
 // eventually store it directly in the thread control block data structure on
 // platforms where this structure is pointed to by %fs or %gs. This is exactly
 // the same mechanism as currently being used by the traditional stack
 // protector pass to store the stack guard (see getStackCookieLocation()
 // function above). Doing so requires changing the tcbhead_t struct in glibc
 // on Linux and tcb struct in libc on FreeBSD.
 //
 // For now, store it in a thread-local variable.
 extern "C" {
 __attribute__((visibility(
     "default"))) __thread void *__safestack_unsafe_stack_ptr = nullptr;
 }
 
 // Per-thread unsafe stack information. It's not frequently accessed, so there
 // it can be kept out of the tcb in normal thread-local variables.
-static __thread void *unsafe_stack_start = nullptr;
-static __thread size_t unsafe_stack_size = 0;
-static __thread size_t unsafe_stack_guard = 0;
-
-using namespace __sanitizer;
-
-static inline void *unsafe_stack_alloc(size_t size, size_t guard) {
-  CHECK_GE(size + guard, size);
-  void *addr = MmapOrDie(size + guard, "unsafe_stack_alloc");
-  MprotectNoAccess((uptr)addr, (uptr)guard);
+__thread void *unsafe_stack_start = nullptr;
+__thread size_t unsafe_stack_size = 0;
+__thread size_t unsafe_stack_guard = 0;
+
+#define SFS_CHECK(a)                                                  \
+  do {                                                                \
+    if (!(a)) {                                                       \
+      fprintf(stderr, "safestack CHECK failed: %s:%d %s\n", __FILE__, \
+              __LINE__, #a);                                          \
+      abort();                                                        \
+    };                                                                \
+  } while (false)
+
+inline size_t RoundUpTo(size_t size, size_t boundary) {
+  SFS_CHECK((boundary & (boundary - 1)) == 0);
+  return (size + boundary - 1) & ~(boundary - 1);
+}
+
+inline void *unsafe_stack_alloc(size_t size, size_t guard) {
+  SFS_CHECK(size + guard >= size);
+  void *addr = mmap(nullptr, RoundUpTo(size + guard, pageSize),
+                    PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
+  SFS_CHECK(MAP_FAILED != addr);
+  mprotect(addr, guard, PROT_NONE);
   return (char *)addr + guard;
 }
 
-static inline void unsafe_stack_setup(void *start, size_t size, size_t guard) {
-  CHECK_GE((char *)start + size, (char *)start);
-  CHECK_GE((char *)start + guard, (char *)start);
+inline void unsafe_stack_setup(void *start, size_t size, size_t guard) {
+  SFS_CHECK((char *)start + size >= (char *)start);
+  SFS_CHECK((char *)start + guard >= (char *)start);
   void *stack_ptr = (char *)start + size;
-  CHECK_EQ((((size_t)stack_ptr) & (kStackAlign - 1)), 0);
+  SFS_CHECK((((size_t)stack_ptr) & (kStackAlign - 1)) == 0);
 
   __safestack_unsafe_stack_ptr = stack_ptr;
   unsafe_stack_start = start;
   unsafe_stack_size = size;
   unsafe_stack_guard = guard;
 }
 
 /// Thread data for the cleanup handler
-static pthread_key_t thread_cleanup_key;
+pthread_key_t thread_cleanup_key;
 
 /// Safe stack per-thread information passed to the thread_start function
 struct tinfo {
   void *(*start_routine)(void *);
   void *start_routine_arg;
 
   void *unsafe_stack_start;
   size_t unsafe_stack_size;
   size_t unsafe_stack_guard;
 };
 
 /// Wrap the thread function in order to deallocate the unsafe stack when the
 /// thread terminates by returning from its main function.
-static void *thread_start(void *arg) {
+void *thread_start(void *arg) {
   struct tinfo *tinfo = (struct tinfo *)arg;
 
   void *(*start_routine)(void *) = tinfo->start_routine;
   void *start_routine_arg = tinfo->start_routine_arg;
 
   // Setup the unsafe stack; this will destroy tinfo content
   unsafe_stack_setup(tinfo->unsafe_stack_start, tinfo->unsafe_stack_size,
                      tinfo->unsafe_stack_guard);
 
   // Make sure out thread-specific destructor will be called
   pthread_setspecific(thread_cleanup_key, (void *)1);
 
   return start_routine(start_routine_arg);
 }
 
 /// Linked list used to store exiting threads stack/thread information.
 struct thread_stack_ll {
   struct thread_stack_ll *next;
   void *stack_base;
   size_t size;
   pid_t pid;
-  tid_t tid;
+  pid_t tid;
 };
 
 /// Linked list of unsafe stacks for threads that are exiting. We delay
 /// unmapping them until the thread exits.
-static thread_stack_ll *thread_stacks = nullptr;
-static pthread_mutex_t thread_stacks_mutex = PTHREAD_MUTEX_INITIALIZER;
+thread_stack_ll *thread_stacks = nullptr;
+pthread_mutex_t thread_stacks_mutex = PTHREAD_MUTEX_INITIALIZER;
 
 /// Thread-specific data destructor. We want to free the unsafe stack only after
 /// this thread is terminated. libc can call functions in safestack-instrumented
 /// code (like free) after thread-specific data destructors have run.
-static void thread_cleanup_handler(void *_iter) {
-  CHECK_NE(unsafe_stack_start, nullptr);
+void thread_cleanup_handler(void *_iter) {
+  SFS_CHECK(unsafe_stack_start != nullptr);
   pthread_setspecific(thread_cleanup_key, NULL);
 
   pthread_mutex_lock(&thread_stacks_mutex);
   // Temporary list to hold the previous threads stacks so we don't hold the
   // thread_stacks_mutex for long.
   thread_stack_ll *temp_stacks = thread_stacks;
   thread_stacks = nullptr;
   pthread_mutex_unlock(&thread_stacks_mutex);
 
   pid_t pid = getpid();
-  tid_t tid = GetTid();
+  pid_t tid = GetTid();
 
   // Free stacks for dead threads
   thread_stack_ll **stackp = &temp_stacks;
   while (*stackp) {
     thread_stack_ll *stack = *stackp;
-    int error;
     if (stack->pid != pid ||
-        (internal_iserror(TgKill(stack->pid, stack->tid, 0), &error) &&
-         error == ESRCH)) {
-      UnmapOrDie(stack->stack_base, stack->size);
+        (-1 == TgKill(stack->pid, stack->tid, 0) && errno == ESRCH)) {
+      munmap(stack->stack_base, stack->size);
       *stackp = stack->next;
       free(stack);
     } else
       stackp = &stack->next;
   }
 
   thread_stack_ll *cur_stack =
       (thread_stack_ll *)malloc(sizeof(thread_stack_ll));
   cur_stack->stack_base = (char *)unsafe_stack_start - unsafe_stack_guard;
   cur_stack->size = unsafe_stack_size + unsafe_stack_guard;
   cur_stack->pid = pid;
   cur_stack->tid = tid;
 
   pthread_mutex_lock(&thread_stacks_mutex);
   // Merge thread_stacks with the current thread's stack and any remaining
   // temp_stacks
   *stackp = thread_stacks;
   cur_stack->next = temp_stacks;
   thread_stacks = cur_stack;
   pthread_mutex_unlock(&thread_stacks_mutex);
 
   unsafe_stack_start = nullptr;
 }
 
-static void EnsureInterceptorsInitialized();
+void EnsureInterceptorsInitialized();
 
 /// Intercept thread creation operation to allocate and setup the unsafe stack
 INTERCEPTOR(int, pthread_create, pthread_t *thread,
             const pthread_attr_t *attr,
             void *(*start_routine)(void*), void *arg) {
   EnsureInterceptorsInitialized();
   size_t size = 0;
   size_t guard = 0;
 
   if (attr) {
     pthread_attr_getstacksize(attr, &size);
     pthread_attr_getguardsize(attr, &guard);
   } else {
     // get pthread default stack size
     pthread_attr_t tmpattr;
     pthread_attr_init(&tmpattr);
     pthread_attr_getstacksize(&tmpattr, &size);
     pthread_attr_getguardsize(&tmpattr, &guard);
     pthread_attr_destroy(&tmpattr);
   }
 
-  CHECK_NE(size, 0);
-  CHECK_EQ((size & (kStackAlign - 1)), 0);
-  CHECK_EQ((guard & (pageSize - 1)), 0);
+  SFS_CHECK(size);
+  SFS_CHECK((size & (kStackAlign - 1)) == 0);
+  SFS_CHECK((guard & (pageSize - 1)) == 0);
 
   void *addr = unsafe_stack_alloc(size, guard);
   struct tinfo *tinfo =
       (struct tinfo *)(((char *)addr) + size - sizeof(struct tinfo));
   tinfo->start_routine = start_routine;
   tinfo->start_routine_arg = arg;
   tinfo->unsafe_stack_start = addr;
   tinfo->unsafe_stack_size = size;
   tinfo->unsafe_stack_guard = guard;
 
   return REAL(pthread_create)(thread, attr, thread_start, tinfo);
 }
 
-static BlockingMutex interceptor_init_lock(LINKER_INITIALIZED);
-static bool interceptors_inited = false;
+pthread_mutex_t interceptor_init_mutex = PTHREAD_MUTEX_INITIALIZER;
+bool interceptors_inited = false;
+
+class MutexLock {
+ public:
+  explicit MutexLock(pthread_mutex_t &mutex) : mutex_(&mutex) {
+    pthread_mutex_lock(mutex_);
+  }
+  ~MutexLock() { pthread_mutex_unlock(mutex_); }
+
+ private:
+  pthread_mutex_t *mutex_ = nullptr;
+};
 
-static void EnsureInterceptorsInitialized() {
-  BlockingMutexLock lock(&interceptor_init_lock);
-  if (interceptors_inited) return;
+void EnsureInterceptorsInitialized() {
+  MutexLock lock(interceptor_init_mutex);
+  if (interceptors_inited)
+    return;
 
   // Initialize pthread interceptors for thread allocation
   INTERCEPT_FUNCTION(pthread_create);
 
   interceptors_inited = true;
 }
 
 extern "C" __attribute__((visibility("default")))
 #if !SANITIZER_CAN_USE_PREINIT_ARRAY
 // On ELF platforms, the constructor is invoked using .preinit_array (see below)
 __attribute__((constructor(0)))
 #endif
 void __safestack_init() {
+  pageSize = sysconf(_SC_PAGESIZE);
+
   // Determine the stack size for the main thread.
   size_t size = kDefaultUnsafeStackSize;
   size_t guard = 4096;
 
   struct rlimit limit;
   if (getrlimit(RLIMIT_STACK, &limit) == 0 && limit.rlim_cur != RLIM_INFINITY)
     size = limit.rlim_cur;
 
   // Allocate unsafe stack for main thread
   void *addr = unsafe_stack_alloc(size, guard);
 
   unsafe_stack_setup(addr, size, guard);
-  pageSize = sysconf(_SC_PAGESIZE);
 
   // Setup the cleanup handler
   pthread_key_create(&thread_cleanup_key, thread_cleanup_handler);
 }
 
 #if SANITIZER_CAN_USE_PREINIT_ARRAY
 // On ELF platforms, run safestack initialization before any other constructors.
 // On other platforms we use the constructor attribute to arrange to run our
 // initialization early.
 extern "C" {
 __attribute__((section(".preinit_array"),
                used)) void (*__safestack_preinit)(void) = __safestack_init;
 }
 #endif
 
+}  // namespace
+
 extern "C"
     __attribute__((visibility("default"))) void *__get_unsafe_stack_bottom() {
   return unsafe_stack_start;
 }
 
 extern "C"
     __attribute__((visibility("default"))) void *__get_unsafe_stack_top() {
   return (char*)unsafe_stack_start + unsafe_stack_size;

compiler-rt/lib/safestack/safestack_platform.h

+//===-- safestack_platform.h ----------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// This file implements platform specific parts of SafeStack runtime.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef SAFESTACK_PLATFORM_H
+#define SAFESTACK_PLATFORM_H
+
+#include "sanitizer_common/sanitizer_platform.h"
+
+#include <sys/syscall.h>
+#include <sys/types.h>
+#include <unistd.h>
+
+namespace safestack {
+
+inline pid_t GetTid() {
+#if SANITIZER_NETBSD
+  return _lwp_self();
+#elif SANITIZER_FREEBSD
+  long Tid;
+  thr_self(&Tid);
+  return Tid;
+#elif SANITIZER_OPENBSD
+  return syscall(SYS_getthrid);
+#elif SANITIZER_SOLARIS
+  return thr_self();
+#else
+  return syscall(SYS_gettid);
+#endif
+}
+
+inline int TgKill(pid_t pid, pid_t tid, int sig) {
+#if SANITIZER_NETBSD
+  (void)pid;
+  return _lwp_kill(tid, sig);
+#elif SANITIZER_LINUX
+  return syscall(SYS_tgkill, pid, tid, sig);
+#elif SANITIZER_FREEBSD
+  return syscall(SYS_thr_kill2, pid, tid, sig);
+#elif SANITIZER_OPENBSD
+  (void)pid;
+  return syscall(SYSCALL(thrkill), tid, sig, nullptr);
+#elif SANITIZER_SOLARIS
+  (void)pid;
+  return thr_kill(tid, sig);
+#endif
+}
+
+}  // namespace safestack
+
+#endif  // SAFESTACK_PLATFORM_H