This is an archive of the discontinued LLVM Phabricator instance.

[GWP-ASan] Integration with Scudo [5].
ClosedPublic

Authored by hctim on Jun 5 2019, 1:13 PM.

Details

Summary

See D60593 for further information.

This patch adds GWP-ASan support to the Scudo hardened allocator. It also
implements end-to-end integration tests using Scudo as the backing allocator.
The tests include crash handling for buffer over/underflow as well as
use-after-free detection.

Event Timeline

hctim created this revision.Jun 5 2019, 1:13 PM
Herald added projects: Restricted Project, Restricted Project. · View Herald TranscriptJun 5 2019, 1:14 PM
Herald added subscribers: llvm-commits, Restricted Project, mgorny, kubamracek. · View Herald Transcript

I think it's good from the integration perspective.
The only potential concern I have is the specific use of the TLS variables in GWP-ASan which might not work everywhere here (eg: if a platform is using emutls as TLS as it uses malloc() internally).
Have you tested that locally with an Android emulator?

compiler-rt/test/scudo/lit.cfg
54

nit: do you need the extra variable?

hctim added a comment.Jun 6 2019, 1:03 PM

The only potential concern I have is the specific use of the TLS variables in GWP-ASan which might not work everywhere here (eg: if a platform is using emutls as TLS as it uses malloc() internally).

GWP-ASan is not supported on platforms without initial exec TLS, and won't build there -- in which case, it won't be included in Scudo :)

Have you tested that locally with an Android emulator?

Not as of right now, but Q will support ELF TLS instead of emutls (https://developer.android.com/preview/features#elf-tls). Will take a look at this soon.

hctim updated this revision to Diff 203429.Jun 6 2019, 1:04 PM
hctim marked an inline comment as done.
  • Removed extra var in scudo lit cfg.
cryptoad accepted this revision.Jun 6 2019, 2:05 PM
This revision is now accepted and ready to land.Jun 6 2019, 2:05 PM
vlad.tsyrklevich accepted this revision.Jun 7 2019, 2:09 PM
vlad.tsyrklevich added inline comments.
compiler-rt/lib/scudo/scudo_allocator.cpp
493

Just checking, does reallocate() have the same semantics as realloc() where NewSize == 0 means free? And does allocate(0) always return nullptr in that case?

compiler-rt/test/gwp_asan/invalid_free_left.cpp
4

This uses not while the others above use %expect_crash, you probably want %expect_crash here too and in the other places you use not?

hctim updated this revision to Diff 203840.Jun 10 2019, 9:14 AM
hctim marked 3 inline comments as done.
  • Added new realloc test, deleted dummy test.
compiler-rt/lib/scudo/scudo_allocator.cpp
493

Yep - have also added a unit test for this. Note that C++11 changed this behaviour, and made it implementation defined.

compiler-rt/test/gwp_asan/invalid_free_left.cpp
4

So at the moment, invalid free/double free are detected internally, and terminate through exit(EXIT_FAILURE). The tests with %expect_crash are the ones which terminate through a segv signal ($? == 127).

This is mirroring the behaviour of scudo, where they exit(EXIT_FAILURE) on checksum failure or other error conditions. What might be better though, is when we detect a failure condition internally, we raise a signal. This would allow platforms like Android to still have their special death handlers run.

@morehouse - WDYT? I would say that I'd prefer to raise a signal internally-detected error. I'm not sure that raising SEGV is appropriate here, and it would also increase the complexity of the logic (we'd have to reinstate the previous SEGV handler first). Maybe SIGTRAP or SIGABRT?

morehouse added inline comments.Jun 10 2019, 10:25 AM
compiler-rt/test/gwp_asan/invalid_free_left.cpp
4

FWIW, we trigger a SEGV in Google3 by touching the freed page. Not sure if it's the best approach, but it simplified the error handling a bit. Allows everything to go through SEGV handler and then forward to the previous handers, rather than having to implement multiple flows for different errors. Also gives the address of the double-free to previous handlers for them to inspect.

hctim updated this revision to Diff 205118.Jun 17 2019, 10:40 AM

Merge master in preparation for submit.

This revision was automatically updated to reflect the committed changes.
compiler-rt/test/gwp_asan/double_deletea.cpp