[scudo][standalone] Add chunk ownership function

[cryptoad]

Summary

In order to be compliant with tcmalloc's extension ownership
determination function, we have to expose a function that will
say if a chunk was allocated by us.

As to whether or not this has security consequences: someone
able to call this function repeatedly could use it to determine
secrets (cookie) or craft a valid header. So this should not be
exposed directly to untrusted user input.

Add related tests.

Additionally clang-format caught a few things to change.

[hctim]

So the model presented asserts that if the chunk header is truncated, the pointer is not owned by us. Is this WAI? I can forsee that a chunk header was truncated, and then the pointer to the associated allocation is checked for ownership, which the ownership will fail as the chunk header check didn't succeed.

compiler-rt/lib/scudo/standalone/combined.h

483

Why blank assert log here?

[cryptoad]

In D70908#1765712, @hctim wrote:

So the model presented asserts that if the chunk header is truncated, the pointer is not owned by us. Is this WAI? I can forsee that a chunk header was truncated, and then the pointer to the associated allocation is checked for ownership, which the ownership will fail as the chunk header check didn't succeed.

I think that not claiming ownership of a corrupted chunk is something we can live with.
The ownership concept for tcmalloc has strong requirements, which I think are fulfilled by this implementation.

[cryptoad]

Adding a log for the new static_assert.

[hctim]

In D70908#1765917, @cryptoad wrote:

I think that not claiming ownership of a corrupted chunk is something we can live with.
The ownership concept for tcmalloc has strong requirements, which I think are fulfilled by this implementation.

Ack - would you mind mentioning this decision in the function description comment?

Otherwise LGTM.

[cryptoad]

Adding a comment saying that a corrupted chunk won't be reported
as owned (well technically it might be "owned"), but that it's WAI.

compiler-rt/lib/scudo/standalone/chunk.h

constexpr uptr getHeaderSize() {
   return roundUpTo(sizeof(PackedHeader), 1U << SCUDO_MIN_ALIGNMENT_LOG);
 }
 
 inline AtomicPackedHeader *getAtomicHeader(void *Ptr) {
   return reinterpret_cast<AtomicPackedHeader *>(reinterpret_cast<uptr>(Ptr) -
                                                 getHeaderSize());
 }
 
-inline
-const AtomicPackedHeader *getConstAtomicHeader(const void *Ptr) {
+inline const AtomicPackedHeader *getConstAtomicHeader(const void *Ptr) {
   return reinterpret_cast<const AtomicPackedHeader *>(
       reinterpret_cast<uptr>(Ptr) - getHeaderSize());
 }
 
 // We do not need a cryptographically strong hash for the checksum, but a CRC
 // type function that can alert us in the event a header is invalid or
 // corrupted. Ideally slightly better than a simple xor of all fields.
 static inline u16 computeHeaderChecksum(u32 Cookie, const void *Ptr,

 inline void storeHeader(u32 Cookie, void *Ptr,
                         UnpackedHeader *NewUnpackedHeader) {
   NewUnpackedHeader->Checksum =
       computeHeaderChecksum(Cookie, Ptr, NewUnpackedHeader);
   PackedHeader NewPackedHeader = bit_cast<PackedHeader>(*NewUnpackedHeader);
   atomic_store_relaxed(getAtomicHeader(Ptr), NewPackedHeader);
 }
 
-inline
-void loadHeader(u32 Cookie, const void *Ptr,
+inline void loadHeader(u32 Cookie, const void *Ptr,
                        UnpackedHeader *NewUnpackedHeader) {
   PackedHeader NewPackedHeader = atomic_load_relaxed(getConstAtomicHeader(Ptr));
   *NewUnpackedHeader = bit_cast<UnpackedHeader>(NewPackedHeader);
   if (UNLIKELY(NewUnpackedHeader->Checksum !=
                computeHeaderChecksum(Cookie, Ptr, NewUnpackedHeader)))
     reportHeaderCorruption(const_cast<void *>(Ptr));
 }
 
 inline void compareExchangeHeader(u32 Cookie, void *Ptr,
                                   UnpackedHeader *NewUnpackedHeader,
                                   UnpackedHeader *OldUnpackedHeader) {
   NewUnpackedHeader->Checksum =
       computeHeaderChecksum(Cookie, Ptr, NewUnpackedHeader);
   PackedHeader NewPackedHeader = bit_cast<PackedHeader>(*NewUnpackedHeader);
   PackedHeader OldPackedHeader = bit_cast<PackedHeader>(*OldUnpackedHeader);
   if (UNLIKELY(!atomic_compare_exchange_strong(
           getAtomicHeader(Ptr), &OldPackedHeader, NewPackedHeader,
           memory_order_relaxed)))
     reportHeaderRace(Ptr);
 }
 
-inline
-bool isValid(u32 Cookie, const void *Ptr, UnpackedHeader *NewUnpackedHeader) {
+inline bool isValid(u32 Cookie, const void *Ptr,
+                    UnpackedHeader *NewUnpackedHeader) {
   PackedHeader NewPackedHeader = atomic_load_relaxed(getConstAtomicHeader(Ptr));
   *NewUnpackedHeader = bit_cast<UnpackedHeader>(NewPackedHeader);
   return NewUnpackedHeader->Checksum ==
          computeHeaderChecksum(Cookie, Ptr, NewUnpackedHeader);
 }
 
 } // namespace Chunk
 
 } // namespace scudo
 
 #endif // SCUDO_CHUNK_H_

compiler-rt/lib/scudo/standalone/combined.h

uptr getUsableSize(const void *Ptr) {
     return getSize(Ptr, &Header);
   }
 
   void getStats(StatCounters S) {
     initThreadMaybe();
     Stats.get(S);
   }
 
+  // Returns true if the pointer provided was allocated by the current
+  // allocator instance, which is compliant with tcmalloc's ownership concept.
+  // A corrupted chunk will not be reported as owned, which is WAI.
+  bool isOwned(const void *Ptr) {
+    initThreadMaybe();
+    if (!Ptr || !isAligned(reinterpret_cast<uptr>(Ptr), MinAlignment))
+      return false;
+    Chunk::UnpackedHeader Header;
+    return Chunk::isValid(Cookie, Ptr, &Header) &&
+           Header.State == Chunk::State::Allocated;
+  }
+
 private:
   using SecondaryT = typename Params::Secondary;
   typedef typename PrimaryT::SizeClassMap SizeClassMap;
 
   static const uptr MinAlignmentLog = SCUDO_MIN_ALIGNMENT_LOG;
   static const uptr MaxAlignmentLog = 24U; // 16 MB seems reasonable.
   static const uptr MinAlignment = 1UL << MinAlignmentLog;
   static const uptr MaxAlignment = 1UL << MaxAlignmentLog;
   static const uptr MaxAllowedMallocSize =
       FIRST_32_SECOND_64(1UL << 31, 1ULL << 40);
 
+  static_assert(MinAlignment >= sizeof(Chunk::PackedHeader),
+                "Minimal alignment must at least cover a chunk header.");
+
   // Constants used by the chunk iteration mechanism.
   static const u32 BlockMarker = 0x44554353U;
   static const uptr InvalidChunk = ~static_cast<uptr>(0);
 
   GlobalStats Stats;
   TSDRegistryT TSDRegistry;
   PrimaryT Primary;
   SecondaryT Secondary;

compiler-rt/lib/scudo/standalone/tests/combined_test.cpp

template <class Config> static void testAllocator() {
   auto Deleter = [](AllocatorT *A) {
     A->unmapTestOnly();
     delete A;
   };
   std::unique_ptr<AllocatorT, decltype(Deleter)> Allocator(new AllocatorT,
                                                            Deleter);
   Allocator->reset();
 
+  EXPECT_FALSE(Allocator->isOwned(&Mutex));
+  EXPECT_FALSE(Allocator->isOwned(&Allocator));
+  scudo::u64 StackVariable = 0x42424242U;
+  EXPECT_FALSE(Allocator->isOwned(&StackVariable));
+  EXPECT_EQ(StackVariable, 0x42424242U);
+
   constexpr scudo::uptr MinAlignLog = FIRST_32_SECOND_64(3U, 4U);
 
   // This allocates and deallocates a bunch of chunks, with a wide range of
   // sizes and alignments, with a focus on sizes that could trigger weird
   // behaviors (plus or minus a small delta of a power of two for example).
   for (scudo::uptr SizeLog = 0U; SizeLog <= 20U; SizeLog++) {
     for (scudo::uptr AlignLog = MinAlignLog; AlignLog <= 16U; AlignLog++) {
       const scudo::uptr Align = 1U << AlignLog;
       for (scudo::sptr Delta = -32; Delta <= 32; Delta++) {
         if (static_cast<scudo::sptr>(1U << SizeLog) + Delta <= 0)
           continue;
         const scudo::uptr Size = (1U << SizeLog) + Delta;
         void *P = Allocator->allocate(Size, Origin, Align);
         EXPECT_NE(P, nullptr);
+        EXPECT_TRUE(Allocator->isOwned(P));
         EXPECT_TRUE(scudo::isAligned(reinterpret_cast<scudo::uptr>(P), Align));
         EXPECT_LE(Size, Allocator->getUsableSize(P));
         memset(P, 0xaa, Size);
         Allocator->deallocate(P, Origin, Size);
       }
     }
   }
   Allocator->releaseToOS();