[hwasan,asan] Intercept vfork.

[eugenis]

Summary

AArch64 only for now.

[eugenis]

formatting

[pcc]

LGTM

compiler-rt/test/asan/TestCases/Linux/vfork.cc

4 ↗

(On Diff #187110)

Doesn't this need to be spelled REQUIRES: aarch64-target-arch, android? (Also, does it really require Android?)

[vitalybuka]

compiler-rt/lib/asan/asan_rtl.cc

602 ↗

(On Diff #187110)

redundant CHECK here and below

[eugenis]

compiler-rt/lib/asan/asan_rtl.cc

602 ↗

(On Diff #187110)

why? GetCurrentThread may return 0 is called very early or very late.
There is not much we can do in that case, but the check at least replaces UB with a nice crash.

compiler-rt/test/asan/TestCases/Linux/vfork.cc

4 ↗

(On Diff #187110)

I've dumped available features, and that's the only relevant one I found.
Perhaps this could be fixed, but in a separate commit.

[eugenis]

update gn files

[pcc]

compiler-rt/test/asan/TestCases/Linux/vfork.cc

4 ↗

(On Diff #187110)

That's fine. I noticed that compiler-rt/test/shadowcallstack/overflow-aarch64.c was already using aarch64-target-arch, maybe that's never being run? If so that would probably need to be fixed as well.

[eugenis]

compiler-rt/test/asan/TestCases/Linux/vfork.cc

4 ↗

(On Diff #187110)

I've looked, and this aarch64-android-target-arch is only present in asan and scudo, and it affects exactly 0 tests one way or the other.

I'll remove it in a separate change.

include/sanitizer/hwasan_interface.h

#endif
 
   // Set memory tag from the current SP address to the given address to zero.
   // This is meant to annotate longjmp and other non-local jumps.
   // This function needs to know the (almost) exact destination frame address;
   // clearing shadow for the entire thread stack like __asan_handle_no_return
   // does would cause false reports.
   void __hwasan_handle_longjmp(const void *sp_dst);
 
+  // Set memory tag for the part of the current thread stack below sp_dst to
+  // zero. Call this in vfork() before returning in the parent process.
+  void __hwasan_handle_vfork(const void *sp_dst);
+
   // Libc hook for thread creation. Should be called in the child thread before
   // any instrumented code.
   void __hwasan_thread_enter();
 
   // Libc hook for thread destruction. No instrumented code should run after
   // this call.
   void __hwasan_thread_exit();
 
   // Print shadow and origin for the memory range to stderr in a human-readable
   // format.
   void __hwasan_print_shadow(const volatile void *x, size_t size);
 
   // Print one-line report about the memory usage of the current process.
   void __hwasan_print_memory_usage();
 
+  /* Returns the offset of the first byte in the memory range that can not be
+   * accessed through the pointer in x, or -1 if the whole range is good. */
+  intptr_t __hwasan_test_shadow(const volatile void *x, size_t size);
+
   int __sanitizer_posix_memalign(void **memptr, size_t alignment, size_t size);
   void * __sanitizer_memalign(size_t alignment, size_t size);
   void * __sanitizer_aligned_alloc(size_t alignment, size_t size);
   void * __sanitizer___libc_memalign(size_t alignment, size_t size);
   void * __sanitizer_valloc(size_t size);
   void * __sanitizer_pvalloc(size_t size);
   void __sanitizer_free(void *ptr);
   void __sanitizer_cfree(void *ptr);

lib/asan/CMakeLists.txt

 # Build for the AddressSanitizer runtime support library.
 
 set(ASAN_SOURCES
   asan_allocator.cc
   asan_activation.cc
   asan_debugging.cc
   asan_descriptions.cc
   asan_errors.cc
   asan_fake_stack.cc
   asan_flags.cc
   asan_fuchsia.cc
   asan_globals.cc
   asan_globals_win.cc
   asan_interceptors.cc
   asan_interceptors_memintrinsics.cc
+  asan_interceptors_vfork.S
   asan_linux.cc
   asan_mac.cc
   asan_malloc_linux.cc
   asan_malloc_mac.cc
   asan_malloc_win.cc
   asan_memory_profile.cc
   asan_poisoning.cc
   asan_posix.cc

lib/asan/asan_interceptors.cc

 #endif
   ENSURE_ASAN_INITED();
   int res = REAL(__cxa_atexit)(func, arg, dso_handle);
   REAL(__cxa_atexit)(AtCxaAtexit, nullptr, nullptr);
   return res;
 }
 #endif  // ASAN_INTERCEPT___CXA_ATEXIT
 
+DEFINE_REAL(void, vfork);
+
 // ---------------------- InitializeAsanInterceptors ---------------- {{{1
 namespace __asan {
 void InitializeAsanInterceptors() {
   static bool was_called_once;
   CHECK(!was_called_once);
   was_called_once = true;
   InitializeCommonInterceptors();
   InitializeSignalInterceptors();
#endif
   ASAN_INTERCEPT_FUNC(pthread_join);
 #endif
 
   // Intercept atexit function.
 #if ASAN_INTERCEPT___CXA_ATEXIT
   ASAN_INTERCEPT_FUNC(__cxa_atexit);
 #endif
 
+  __interception::GetRealFunctionAddress("vfork", (uptr *)&REAL(vfork), 0, 0);
+
   InitializePlatformInterceptors();
 
   VReport(1, "AddressSanitizer: libc interceptors initialized\n");
 }
 
 } // namespace __asan
 
 #endif  // !SANITIZER_FUCHSIA

lib/asan/asan_interceptors_vfork.S

+#define COMMON_INTERCEPTOR_SPILL_AREA __asan_extra_spill_area
+#define COMMON_INTERCEPTOR_HANDLE_VFORK __asan_handle_vfork
+#include "sanitizer_common/sanitizer_common_interceptors_vfork_aarch64.inc.S"
+
+#if defined(__linux__)
+.section        .note.GNU-stack,"",@progbits
+#endif

lib/asan/asan_interface.inc

 INTERFACE_FUNCTION(__asan_exp_load16)
 INTERFACE_FUNCTION(__asan_exp_loadN)
 INTERFACE_FUNCTION(__asan_exp_store1)
 INTERFACE_FUNCTION(__asan_exp_store2)
 INTERFACE_FUNCTION(__asan_exp_store4)
 INTERFACE_FUNCTION(__asan_exp_store8)
 INTERFACE_FUNCTION(__asan_exp_store16)
 INTERFACE_FUNCTION(__asan_exp_storeN)
+INTERFACE_FUNCTION(__asan_extra_spill_area)
 INTERFACE_FUNCTION(__asan_get_alloc_stack)
 INTERFACE_FUNCTION(__asan_get_current_fake_stack)
 INTERFACE_FUNCTION(__asan_get_free_stack)
 INTERFACE_FUNCTION(__asan_get_report_access_size)
 INTERFACE_FUNCTION(__asan_get_report_access_type)
 INTERFACE_FUNCTION(__asan_get_report_address)
 INTERFACE_FUNCTION(__asan_get_report_bp)
 INTERFACE_FUNCTION(__asan_get_report_description)
 INTERFACE_FUNCTION(__asan_get_report_pc)
 INTERFACE_FUNCTION(__asan_get_report_sp)
 INTERFACE_FUNCTION(__asan_get_shadow_mapping)
 INTERFACE_FUNCTION(__asan_handle_no_return)
+INTERFACE_FUNCTION(__asan_handle_vfork)
 INTERFACE_FUNCTION(__asan_init)
 INTERFACE_FUNCTION(__asan_load_cxx_array_cookie)
 INTERFACE_FUNCTION(__asan_load1)
 INTERFACE_FUNCTION(__asan_load2)
 INTERFACE_FUNCTION(__asan_load4)
 INTERFACE_FUNCTION(__asan_load8)
 INTERFACE_FUNCTION(__asan_load16)
 INTERFACE_FUNCTION(__asan_loadN)

lib/asan/asan_interface_internal.h

extern "C" {
   void __asan_unpoison_intra_object_redzone(uptr p, uptr size);
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_alloca_poison(uptr addr, uptr size);
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_allocas_unpoison(uptr top, uptr bottom);
 
   SANITIZER_INTERFACE_ATTRIBUTE SANITIZER_WEAK_ATTRIBUTE
   const char* __asan_default_suppressions();
+
+  SANITIZER_INTERFACE_ATTRIBUTE void *__asan_extra_spill_area();
+  SANITIZER_INTERFACE_ATTRIBUTE void __asan_handle_vfork(void *sp);
 }  // extern "C"
 
 #endif  // ASAN_INTERFACE_INTERNAL_H

lib/asan/asan_rtl.cc

Report("WARNING: ASan is ignoring requested __asan_handle_no_return: "
            top, bottom, top - bottom, top - bottom);
     return;
   }
   PoisonShadow(bottom, top - bottom, 0);
   if (curr_thread && curr_thread->has_fake_stack())
     curr_thread->fake_stack()->HandleNoReturn();
 }
 
+void *__asan_extra_spill_area() {
+  AsanThread *t = GetCurrentThread();
+  CHECK(t);
+  return t->extra_spill_area();
+}
+
+void __asan_handle_vfork(void *sp) {
+  AsanThread *t = GetCurrentThread();
+  CHECK(t);
+  uptr PageSize = GetPageSizeCached();
+  uptr top = t->stack_top();
+  uptr bottom = ((uptr)sp - PageSize) & ~(PageSize - 1);
+  PoisonShadow(bottom, top - bottom, 0);
+}
+
 void NOINLINE __asan_set_death_callback(void (*callback)(void)) {
   SetUserDieCallback(callback);
 }
 
 // Initialize as requested from instrumented application code.
 // We use this call as a trigger to wake up ASan from deactivated state.
 void __asan_init() {
   AsanActivate();
   AsanInitInternal();
 }
 
 void __asan_version_mismatch_check() {
   // Do nothing.
 }

lib/asan/asan_thread.h

public:
   // trace). Used to prevent deadlocks on platforms where libc unwinder calls
   // malloc internally. See PR17116 for more details.
   bool isUnwinding() const { return unwinding_; }
   void setUnwinding(bool b) { unwinding_ = b; }
 
   AsanThreadLocalMallocStorage &malloc_storage() { return malloc_storage_; }
   AsanStats &stats() { return stats_; }
 
+  void *extra_spill_area() { return &extra_spill_area_; }
+
  private:
   // NOTE: There is no AsanThread constructor. It is allocated
   // via mmap() and *must* be valid in zero-initialized state.
 
   void SetThreadStackAndTls(const InitOptions *options);
 
   void ClearShadowForThreadStackAndTLS();
   FakeStack *AsyncSignalSafeLazyInitFakeStack();
private:
   uptr tls_begin_;
   uptr tls_end_;
   DTLS *dtls_;
 
   FakeStack *fake_stack_;
   AsanThreadLocalMallocStorage malloc_storage_;
   AsanStats stats_;
   bool unwinding_;
+  uptr extra_spill_area_;
 };
 
 // ScopedUnwinding is a scope for stacktracing member of a context
 class ScopedUnwinding {
  public:
   explicit ScopedUnwinding(AsanThread *t) : thread(t) {
     t->setUnwinding(true);
   }

lib/hwasan/CMakeLists.txt

 include_directories(..)
 
 # Runtime library sources and build flags.
 set(HWASAN_RTL_SOURCES
   hwasan.cc
   hwasan_allocator.cc
   hwasan_dynamic_shadow.cc
   hwasan_interceptors.cc
+  hwasan_interceptors_vfork.S
   hwasan_linux.cc
   hwasan_memintrinsics.cc
   hwasan_poisoning.cc
   hwasan_report.cc
   hwasan_thread.cc
   hwasan_thread_list.cc
   )
 

lib/hwasan/hwasan.cc

Report(
         "stack top: %p; target %p; distance: %p (%zd)\n"
         "False positive error reports may follow\n",
         (void *)sp, (void *)dst, dst - sp);
     return;
   }
   TagMemory(sp, dst - sp, 0);
 }
 
+void __hwasan_handle_vfork(const void *sp_dst) {
+  uptr sp = (uptr)sp_dst;
+  Thread *t = GetCurrentThread();
+  CHECK(t);
+  uptr top = t->stack_top();
+  uptr bottom = t->stack_bottom();
+  static const uptr kMaxExpectedCleanupSize = 64 << 20;  // 64M
+  if (top == 0 || bottom == 0 || sp < bottom || sp >= top ||
+      sp - bottom > kMaxExpectedCleanupSize) {
+    Report(
+        "WARNING: HWASan is ignoring requested __hwasan_handle_vfork: "
+        "stack top: %zx; current %zx; bottom: %zx \n"
+        "False positive error reports may follow\n",
+        top, sp, bottom);
+    return;
+  }
+  TagMemory(bottom, sp - bottom, 0);
+}
+
+void *__hwasan_extra_spill_area() {
+  Thread *t = GetCurrentThread();
+  return &t->vfork_spill();
+}
+
 void __hwasan_print_memory_usage() {
   InternalScopedString s(kMemoryUsageBufferSize);
   HwasanFormatMemoryUsage(s);
   Printf("%s\n", s.data());
 }
 
 static const u8 kFallbackTag = 0xBB;
 

lib/hwasan/hwasan_interceptors.cc

INTERCEPTOR(int, pthread_create, void *th, void *attr,
             void *(*callback)(void *), void *param) {
   ScopedTaggingDisabler disabler;
   int res = REAL(pthread_create)(UntagPtr(th), UntagPtr(attr),
                                  callback, param);
   return res;
 }
 #endif
 
+#if HWASAN_WITH_INTERCEPTORS
+DEFINE_REAL(void, vfork);
+#endif
+
 static void BeforeFork() {
   StackDepotLockAll();
 }
 
 static void AfterFork() {
   StackDepotUnlockAll();
 }
 

 
 void InitializeInterceptors() {
   static int inited = 0;
   CHECK_EQ(inited, 0);
 
   INTERCEPT_FUNCTION(fork);
 
 #if HWASAN_WITH_INTERCEPTORS
+  __interception::GetRealFunctionAddress("vfork", (uptr *)&REAL(vfork), 0, 0);
 #if !defined(__aarch64__)
   INTERCEPT_FUNCTION(pthread_create);
 #endif
   INTERCEPT_FUNCTION(realloc);
   INTERCEPT_FUNCTION(free);
 #endif
 
   inited = 1;
 }
 } // namespace __hwasan

lib/hwasan/hwasan_interceptors_vfork.S

+#define COMMON_INTERCEPTOR_SPILL_AREA __hwasan_extra_spill_area
+#define COMMON_INTERCEPTOR_HANDLE_VFORK __hwasan_handle_vfork
+#include "sanitizer_common/sanitizer_common_interceptors_vfork_aarch64.inc.S"
+
+#if defined(__linux__)
+.section        .note.GNU-stack,"",@progbits
+#endif

lib/hwasan/hwasan_interface_internal.h

 
 SANITIZER_INTERFACE_ATTRIBUTE
 void __hwasan_print_shadow(const void *x, uptr size);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void __hwasan_handle_longjmp(const void *sp_dst);
 
 SANITIZER_INTERFACE_ATTRIBUTE
+void __hwasan_handle_vfork(const void *sp_dst);
+
+SANITIZER_INTERFACE_ATTRIBUTE
 u16 __sanitizer_unaligned_load16(const uu16 *p);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 u32 __sanitizer_unaligned_load32(const uu32 *p);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 u64 __sanitizer_unaligned_load64(const uu64 *p);
 

 void * __sanitizer_malloc(uptr size);
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__hwasan_memcpy(void *dst, const void *src, uptr size);
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__hwasan_memset(void *s, int c, uptr n);
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__hwasan_memmove(void *dest, const void *src, uptr n);
+
+SANITIZER_INTERFACE_ATTRIBUTE
+void *__hwasan_extra_spill_area();
 }  // extern "C"
 
 #endif  // HWASAN_INTERFACE_INTERNAL_H

lib/hwasan/hwasan_thread.h

public:
 
   u64 unique_id() const { return unique_id_; }
   void Announce() {
     if (announced_) return;
     announced_ = true;
     Print("Thread: ");
   }
 
+  uptr &vfork_spill() { return vfork_spill_; }
+
  private:
   // NOTE: There is no Thread constructor. It is allocated
   // via mmap() and *must* be valid in zero-initialized state.
   void ClearShadowForThreadStackAndTLS();
   void Print(const char *prefix);
+  uptr vfork_spill_;
   uptr stack_top_;
   uptr stack_bottom_;
   uptr tls_begin_;
   uptr tls_end_;
 
   unsigned in_signal_handler_;
   unsigned in_symbolizer_;
   unsigned in_interceptor_scope_;

lib/sanitizer_common/CMakeLists.txt

set(SANITIZER_IMPL_HEADERS
   sanitizer_atomic_clang_x86.h
   sanitizer_atomic_msvc.h
   sanitizer_bitvector.h
   sanitizer_bvgraph.h
   sanitizer_common.h
   sanitizer_common_interceptors.inc
   sanitizer_common_interceptors_format.inc
   sanitizer_common_interceptors_ioctl.inc
+  sanitizer_common_interceptors_vfork_aarch64.inc.S
   sanitizer_common_interface.inc
   sanitizer_common_interface_posix.inc
   sanitizer_common_syscalls.inc
   sanitizer_coverage_interface.inc
   sanitizer_dbghelp.h
   sanitizer_deadlock_detector.h
   sanitizer_deadlock_detector_interface.h
   sanitizer_errno.h

lib/sanitizer_common/sanitizer_common_interceptors_vfork_aarch64.inc.S

+#if defined(__aarch64__) && defined(__linux__)
+
+#include "sanitizer_common/sanitizer_asm.h"
+
+ASM_HIDDEN(COMMON_INTERCEPTOR_SPILL_AREA)
+
+.comm _ZN14__interception10real_vforkE,8,8
+.globl vfork
+ASM_TYPE_FUNCTION(vfork)
+vfork:
+  // Save x30 in the off-stack spill area.
+  stp     xzr, x30, [sp, #-16]!
+  bl      COMMON_INTERCEPTOR_SPILL_AREA
+  ldp     xzr, x30, [sp], 16
+  str     x30, [x0]
+
+  // Call real vfork. This may return twice. User code that runs between the first and the second return
+  // may clobber the stack frame of the interceptor; that's why it does not have a frame.
+  adrp    x0, _ZN14__interception10real_vforkE
+  ldr     x0, [x0, :lo12:_ZN14__interception10real_vforkE]
+  blr     x0
+
+  stp     x0, xzr, [sp, #-16]!
+  cmp     x0, #0
+  b.eq   .L_exit
+
+  // x0 != 0 => parent process. Clear stack shadow.
+  add    x0, sp, #16
+  bl     COMMON_INTERCEPTOR_HANDLE_VFORK
+
+.L_exit:
+  // Restore x30.
+  bl     COMMON_INTERCEPTOR_SPILL_AREA
+  ldr    x30, [x0]
+  ldp    x0, xzr, [sp], 16
+
+  ret
+ASM_SIZE(vfork)
+
+.globl __interceptor_vfork
+.set __interceptor_vfork, vfork
+
+#endif

test/asan/TestCases/Linux/vfork.cc

+// https://github.com/google/sanitizers/issues/925
+// RUN: %clang_asan -O0 %s -o %t && %run %t 2>&1
+
+// REQUIRES: aarch64-android-target-arch
+
+#include <assert.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <sanitizer/asan_interface.h>
+
+__attribute__((noinline, no_sanitize("address"))) void child() {
+  char x[10000];
+  __asan_poison_memory_region(x, sizeof(x));
+  _exit(0);
+}
+
+__attribute__((noinline, no_sanitize("address"))) void parent() {
+  char x[10000];
+  assert(__asan_address_is_poisoned(x + 5000) == 0);
+}
+
+int main(int argc, char **argv) {
+  if (vfork())
+    parent();
+  else
+    child();
+
+  return 0;
+}

test/hwasan/TestCases/Linux/vfork.c

+// https://github.com/google/sanitizers/issues/925
+// RUN: %clang_hwasan -O0 %s -o %t && %run %t 2>&1
+
+// REQUIRES: aarch64-target-arch
+
+#include <assert.h>
+#include <sys/types.h>
+#include <sys/wait.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <sanitizer/hwasan_interface.h>
+
+__attribute__((noinline, no_sanitize("hwaddress"))) void child() {
+  char x[10000];
+  __hwasan_tag_memory(x, 0xAA, sizeof(x));
+  _exit(0);
+}
+
+__attribute__((noinline, no_sanitize("hwaddress"))) void parent() {
+  char x[10000];
+  __hwasan_print_shadow(&x, sizeof(x));
+  assert(__hwasan_test_shadow(x, sizeof(x)) == -1);
+}
+
+int main(int argc, char **argv) {
+  if (vfork())
+    parent();
+  else
+    child();
+
+  return 0;
+}