[Scudo] [GWP-ASan] Add GWP-ASan to Scudo Standalone.

[hctim]

Summary

Adds GWP-ASan to Scudo standalone. Default parameters are pulled across from the
GWP-ASan build. No backtrace support as of yet.

[pcc]

compiler-rt/lib/scudo/standalone/combined.h

520–536

I think you might need to sync to LLVM trunk. There is now a function isOwned here which I think might need to be taught about GWP-ASan.

[cryptoad]

Thanks!
What's the current plan for testing? (Currently I have only enabled the standalone on Linux x86/64 for upstream)

compiler-rt/lib/scudo/standalone/combined.h

347

Since there is no other size_t in combined, could you use a uptr?

504

Could you also please modify isOwned with a GWP check?

[hctim]

• Synced to master, added isOwned and /s/size_t/uptr.

[hctim]

In D71229#1776163, @cryptoad wrote:

What's the current plan for testing? (Currently I have only enabled the standalone on Linux x86/64 for upstream)

I'd love to be able to test the current GWP-ASan tests using scudo_standalone as well. Unfortunately it won't be as simple as -fsanitize=scudo, but will take a look at getting it running with some linker magic.

[cryptoad]

compiler-rt/lib/scudo/standalone/combined.h

526

#ifdef GWP_ASAN_HOOKS?

[hctim]

compiler-rt/lib/scudo/standalone/combined.h

526

Danke.

[hctim]

• Guard isOwned behind macro.

[hctim]

• Enforce alignment to GWP-ASan. If userspace calls posix_memalign, this alignment guarantee should be kept even if the allocation is chosen to be sampled.

[merge_guards_bot]

Build result: pass - 60660 tests passed, 0 failed and 726 were skipped.

Log files: console-log.txt, CMakeCache.txt

compiler-rt/lib/scudo/standalone/CMakeLists.txt

 add_compiler_rt_component(scudo_standalone)
+add_dependencies(scudo_standalone gwp_asan)
 
 include_directories(../..)
 
 set(SCUDO_CFLAGS)
 
 list(APPEND SCUDO_CFLAGS
   -Werror=conversion
   -Wall

 set(SCUDO_SOURCES_C_WRAPPERS
   wrappers_c.cpp
   )
 
 set(SCUDO_SOURCES_CXX_WRAPPERS
   wrappers_cpp.cpp
   )
 
+set(SCUDO_OBJECT_LIBS)
+
+if (COMPILER_RT_HAS_GWP_ASAN)
+  list(APPEND SCUDO_OBJECT_LIBS RTGwpAsan)
+  list(APPEND SCUDO_CFLAGS -DGWP_ASAN_HOOKS)
+endif()
+
 if(COMPILER_RT_HAS_SCUDO_STANDALONE)
   add_compiler_rt_object_libraries(RTScudoStandalone
     ARCHS ${SCUDO_STANDALONE_SUPPORTED_ARCH}
     SOURCES ${SCUDO_SOURCES}
     ADDITIONAL_HEADERS ${SCUDO_HEADERS}
     CFLAGS ${SCUDO_CFLAGS})
   add_compiler_rt_object_libraries(RTScudoStandaloneCWrappers
     ARCHS ${SCUDO_STANDALONE_SUPPORTED_ARCH}
     SOURCES ${SCUDO_SOURCES_C_WRAPPERS}
     ADDITIONAL_HEADERS ${SCUDO_HEADERS}
     CFLAGS ${SCUDO_CFLAGS})
   add_compiler_rt_object_libraries(RTScudoStandaloneCxxWrappers
     ARCHS ${SCUDO_STANDALONE_SUPPORTED_ARCH}
     SOURCES ${SCUDO_SOURCES_CXX_WRAPPERS}
     ADDITIONAL_HEADERS ${SCUDO_HEADERS}
     CFLAGS ${SCUDO_CFLAGS})
 
   add_compiler_rt_runtime(clang_rt.scudo_standalone
     STATIC
     ARCHS ${SCUDO_STANDALONE_SUPPORTED_ARCH}
     SOURCES ${SCUDO_SOURCES} ${SCUDO_SOURCES_C_WRAPPERS}
     ADDITIONAL_HEADERS ${SCUDO_HEADERS}
     CFLAGS ${SCUDO_CFLAGS}
+    OBJECT_LIBS ${SCUDO_OBJECT_LIBS}
     PARENT_TARGET scudo_standalone)
   add_compiler_rt_runtime(clang_rt.scudo_standalone_cxx
     STATIC
     ARCHS ${SCUDO_STANDALONE_SUPPORTED_ARCH}
     SOURCES ${SCUDO_SOURCES_CXX_WRAPPERS}
     ADDITIONAL_HEADERS ${SCUDO_HEADERS}
     CFLAGS ${SCUDO_CFLAGS}
+    OBJECT_LIBS ${SCUDO_OBJECT_LIBS}
     PARENT_TARGET scudo_standalone)
 
   add_subdirectory(benchmarks)
   if(COMPILER_RT_INCLUDE_TESTS)
     add_subdirectory(tests)
   endif()
 endif()

compiler-rt/lib/scudo/standalone/combined.h

 #include "common.h"
 #include "flags.h"
 #include "flags_parser.h"
 #include "interface.h"
 #include "local_cache.h"
 #include "quarantine.h"
 #include "report.h"
 #include "secondary.h"
+#include "string_utils.h"
 #include "tsd.h"
 
+#ifdef GWP_ASAN_HOOKS
+# include "gwp_asan/guarded_pool_allocator.h"
+// GWP-ASan is declared here in order to avoid indirect call overhead. It's also
+// instantiated outside of the Allocator class, as the allocator is only
+// zero-initialised. GWP-ASan requires constant initialisation, and the Scudo
+// allocator doesn't have a constexpr constructor (see discussion here:
+// https://reviews.llvm.org/D69265#inline-624315).
+static gwp_asan::GuardedPoolAllocator GuardedAlloc;
+#endif // GWP_ASAN_HOOKS
+
 namespace scudo {
 
 template <class Params> class Allocator {
 public:
   using PrimaryT = typename Params::Primary;
   using CacheT = typename PrimaryT::CacheT;
   typedef Allocator<Params> ThisT;
   typedef typename Params::template TSDRegistryT<ThisT> TSDRegistryT;
void initLinkerInitialized() {
 
     Stats.initLinkerInitialized();
     Primary.initLinkerInitialized(getFlags()->release_to_os_interval_ms);
     Secondary.initLinkerInitialized(&Stats);
 
     Quarantine.init(
         static_cast<uptr>(getFlags()->quarantine_size_kb << 10),
         static_cast<uptr>(getFlags()->thread_local_quarantine_size_kb << 10));
+
+#ifdef GWP_ASAN_HOOKS
+    gwp_asan::options::Options Opt;
+    Opt.Enabled = getFlags()->GWP_ASAN_Enabled;
+    // Bear in mind - Scudo has its own alignment guarantees that are strictly
+    // enforced. Scudo exposes the same allocation function for everything from
+    // malloc() to posix_memalign, so in general this flag goes unused, as Scudo
+    // will always ask GWP-ASan for an aligned amount of bytes.
+    Opt.PerfectlyRightAlign = getFlags()->GWP_ASAN_PerfectlyRightAlign;
+    Opt.MaxSimultaneousAllocations =
+        getFlags()->GWP_ASAN_MaxSimultaneousAllocations;
+    Opt.SampleRate = getFlags()->GWP_ASAN_SampleRate;
+    Opt.InstallSignalHandlers = getFlags()->GWP_ASAN_InstallSignalHandlers;
+    Opt.Printf = Printf;
+    GuardedAlloc.init(Opt);
+#endif // GWP_ASAN_HOOKS
   }
 
   void reset() { memset(this, 0, sizeof(*this)); }
 
   void unmapTestOnly() {
     TSDRegistry.unmapTestOnly();
     Primary.unmapTestOnly();
   }
Quarantine.drain(&TSD->QuarantineCache,
                      QuarantineCallback(*this, TSD->Cache));
     TSD->Cache.destroy(&Stats);
   }
 
   NOINLINE void *allocate(uptr Size, Chunk::Origin Origin,
                           uptr Alignment = MinAlignment,
                           bool ZeroContents = false) {
     initThreadMaybe();
+
+#ifdef GWP_ASAN_HOOKS
+    if (UNLIKELY(GuardedAlloc.shouldSample())) {
+      if (void *Ptr = GuardedAlloc.allocate(roundUpTo(Size, Alignment)))
+        return Ptr;
+    }
+#endif // GWP_ASAN_HOOKS
+
     ZeroContents |= static_cast<bool>(Options.ZeroContents);
 
     if (UNLIKELY(Alignment > MaxAlignment)) {
       if (Options.MayReturnNull)
         return nullptr;
       reportAlignmentTooBig(Alignment, MaxAlignment);
     }
     if (Alignment < MinAlignment)
NOINLINE void deallocate(void *Ptr, Chunk::Origin Origin, uptr DeleteSize = 0,
     // For a deallocation, we only ensure minimal initialization, meaning thread
     // local data will be left uninitialized for now (when using ELF TLS). The
     // fallback cache will be used instead. This is a workaround for a situation
     // where the only heap operation performed in a thread would be a free past
     // the TLS destructors, ending up in initialized thread specific data never
     // being destroyed properly. Any other heap operation will do a full init.
     initThreadMaybe(/*MinimalInit=*/true);
 
+#ifdef GWP_ASAN_HOOKS
+    if (UNLIKELY(GuardedAlloc.pointerIsMine(Ptr))) {
+      GuardedAlloc.deallocate(Ptr);
+      return;
+    }
+#endif // GWP_ASAN_HOOKS
+
     if (&__scudo_deallocate_hook)
       __scudo_deallocate_hook(Ptr);
 
     if (UNLIKELY(!Ptr))
       return;
     if (UNLIKELY(!isAligned(reinterpret_cast<uptr>(Ptr), MinAlignment)))
       reportMisalignedPointer(AllocatorAction::Deallocating, Ptr);
 
#endif // GWP_ASAN_HOOKS
 
   void *reallocate(void *OldPtr, uptr NewSize, uptr Alignment = MinAlignment) {
     initThreadMaybe();
 
     // The following cases are handled by the C wrappers.
     DCHECK_NE(OldPtr, nullptr);
     DCHECK_NE(NewSize, 0);
 
+#ifdef GWP_ASAN_HOOKS
+    if (UNLIKELY(GuardedAlloc.pointerIsMine(OldPtr))) {
+      uptr OldSize = GuardedAlloc.getSize(OldPtr);
+      void *NewPtr = allocate(NewSize, Chunk::Origin::Malloc, Alignment);
+      if (NewPtr)
+        memcpy(NewPtr, OldPtr, (NewSize < OldSize) ? NewSize : OldSize);
+      GuardedAlloc.deallocate(OldPtr);
+      return NewPtr;
+    }
+#endif // GWP_ASAN_HOOKS
+
     if (UNLIKELY(!isAligned(reinterpret_cast<uptr>(OldPtr), MinAlignment)))
       reportMisalignedPointer(AllocatorAction::Reallocating, OldPtr);
 
     Chunk::UnpackedHeader OldHeader;
     Chunk::loadHeader(Cookie, OldPtr, &OldHeader);
 
     if (UNLIKELY(OldHeader.State != Chunk::State::Allocated))
       reportInvalidChunkState(AllocatorAction::Reallocating, OldPtr);
#endif // GWP_ASAN_HOOKS
   // report the actual size of a chunk. This is done to counteract code actively
   // writing past the end of a chunk (like sqlite3) when the usable size allows
   // for it, which then forces realloc to copy the usable size of a chunk as
   // opposed to its actual size.
   uptr getUsableSize(const void *Ptr) {
     initThreadMaybe();
     if (UNLIKELY(!Ptr))
       return 0;
+
+#ifdef GWP_ASAN_HOOKS
+    if (UNLIKELY(GuardedAlloc.pointerIsMine(Ptr)))
+      return GuardedAlloc.getSize(Ptr);
+#endif // GWP_ASAN_HOOKS
+
     Chunk::UnpackedHeader Header;
     Chunk::loadHeader(Cookie, Ptr, &Header);
     // Getting the usable size of a chunk only makes sense if it's allocated.
     if (UNLIKELY(Header.State != Chunk::State::Allocated))
       reportInvalidChunkState(AllocatorAction::Sizing, const_cast<void *>(Ptr));
     return getSize(Ptr, &Header);
   }
 
   void getStats(StatCounters S) {
     initThreadMaybe();
     Stats.get(S);
   }
 
   // Returns true if the pointer provided was allocated by the current
   // allocator instance, which is compliant with tcmalloc's ownership concept.
   // A corrupted chunk will not be reported as owned, which is WAI.
   bool isOwned(const void *Ptr) {
     initThreadMaybe();
+#ifdef GWP_ASAN_HOOKS
+    if (GuardedAlloc.pointerIsMine(Ptr))
+      return true;
+#endif // GWP_ASAN_HOOKS
     if (!Ptr || !isAligned(reinterpret_cast<uptr>(Ptr), MinAlignment))
       return false;
     Chunk::UnpackedHeader Header;
     return Chunk::isValid(Cookie, Ptr, &Header) &&
            Header.State == Chunk::State::Allocated;
   }
 
 private:
   using SecondaryT = typename Params::Secondary;
   typedef typename PrimaryT::SizeClassMap SizeClassMap;
 
   static const uptr MinAlignmentLog = SCUDO_MIN_ALIGNMENT_LOG;
   static const uptr MaxAlignmentLog = 24U; // 16 MB seems reasonable.
   static const uptr MinAlignment = 1UL << MinAlignmentLog;
   static const uptr MaxAlignment = 1UL << MaxAlignmentLog;

compiler-rt/lib/scudo/standalone/flags.h

 #include "internal_defs.h"
 
 namespace scudo {
 
 struct Flags {
 #define SCUDO_FLAG(Type, Name, DefaultValue, Description) Type Name;
 #include "flags.inc"
 #undef SCUDO_FLAG
+
+#ifdef GWP_ASAN_HOOKS
+#define GWP_ASAN_OPTION(Type, Name, DefaultValue, Description)                 \
+  Type GWP_ASAN_##Name;
+#include "gwp_asan/options.inc"
+#undef GWP_ASAN_OPTION
+#endif // GWP_ASAN_HOOKS
+
   void setDefaults();
 };
 
 Flags *getFlags();
 void initFlags();
 class FlagParser;
 void registerFlags(FlagParser *Parser, Flags *F);
 
 } // namespace scudo
 
 #endif // SCUDO_FLAGS_H_

compiler-rt/lib/scudo/standalone/flags.cpp

Flags *getFlags() {
   static Flags F;
   return &F;
 }
 
 void Flags::setDefaults() {
 #define SCUDO_FLAG(Type, Name, DefaultValue, Description) Name = DefaultValue;
 #include "flags.inc"
 #undef SCUDO_FLAG
+
+#ifdef GWP_ASAN_HOOKS
+#define GWP_ASAN_OPTION(Type, Name, DefaultValue, Description)                 \
+  GWP_ASAN_##Name = DefaultValue;
+#include "gwp_asan/options.inc"
+#undef GWP_ASAN_OPTION
+#endif // GWP_ASAN_HOOKS
 }
 
 void registerFlags(FlagParser *Parser, Flags *F) {
 #define SCUDO_FLAG(Type, Name, DefaultValue, Description)                      \
   Parser->registerFlag(#Name, Description, FlagType::FT_##Type,                \
                        reinterpret_cast<void *>(&F->Name));
 #include "flags.inc"
 #undef SCUDO_FLAG
+
+#ifdef GWP_ASAN_HOOKS
+#define GWP_ASAN_OPTION(Type, Name, DefaultValue, Description)                 \
+  Parser->registerFlag("GWP_ASAN_"#Name, Description, FlagType::FT_##Type,     \
+                       reinterpret_cast<void *>(&F->GWP_ASAN_##Name));
+#include "gwp_asan/options.inc"
+#undef GWP_ASAN_OPTION
+#endif // GWP_ASAN_HOOKS
 }
 
 static const char *getCompileDefinitionScudoDefaultOptions() {
 #ifdef SCUDO_DEFAULT_OPTIONS
   return STRINGIFY(SCUDO_DEFAULT_OPTIONS);
 #else
   return "";
 #endif

compiler-rt/lib/scudo/standalone/flags_parser.h

 class FlagParser {
 public:
   void registerFlag(const char *Name, const char *Desc, FlagType Type,
                     void *Var);
   void parseString(const char *S);
   void printFlagDescriptions();
 
 private:
-  static const u32 MaxFlags = 12;
+  static const u32 MaxFlags = 16;
   struct Flag {
     const char *Name;
     const char *Desc;
     FlagType Type;
     void *Var;
   } Flags[MaxFlags];
 
   u32 NumberOfFlags = 0;

compiler-rt/lib/scudo/standalone/tests/CMakeLists.txt

set(SCUDO_UNITTEST_CFLAGS
   # Extra flags for the C++ tests
   # TODO(kostyak): find a way to make -fsized-deallocation work
   -Wno-mismatched-new-delete)
 
 if(ANDROID)
   list(APPEND SCUDO_UNITTEST_CFLAGS -fno-emulated-tls)
 endif()
 
+if (COMPILER_RT_HAS_GWP_ASAN)
+  list(APPEND SCUDO_UNITTEST_CFLAGS -DGWP_ASAN_HOOKS)
+endif()
+
 set(SCUDO_TEST_ARCH ${SCUDO_STANDALONE_SUPPORTED_ARCH})
 
 # gtests requires c++
 set(LINK_FLAGS ${COMPILER_RT_UNITTEST_LINK_FLAGS})
 foreach(lib ${SANITIZER_TEST_CXX_LIBRARIES})
   list(APPEND LINK_FLAGS -l${lib})
 endforeach()
 list(APPEND LINK_FLAGS -pthread)
 # Linking against libatomic is required with some compilers
 list(APPEND LINK_FLAGS -latomic)
 
 set(SCUDO_TEST_HEADERS)
 foreach (header ${SCUDO_HEADERS})
   list(APPEND SCUDO_TEST_HEADERS ${CMAKE_CURRENT_SOURCE_DIR}/../${header})
 endforeach()
 
 macro(add_scudo_unittest testname)
   cmake_parse_arguments(TEST "" "" "SOURCES;ADDITIONAL_RTOBJECTS" ${ARGN})
+  if (COMPILER_RT_HAS_GWP_ASAN)
+    list(APPEND TEST_ADDITIONAL_RTOBJECTS RTGwpAsan)
+  endif()
+
   if(COMPILER_RT_HAS_SCUDO_STANDALONE)
     foreach(arch ${SCUDO_TEST_ARCH})
       # Additional runtime objects get added along RTScudoStandalone
       set(SCUDO_TEST_RTOBJECTS $<TARGET_OBJECTS:RTScudoStandalone.${arch}>)
       foreach(rtobject ${TEST_ADDITIONAL_RTOBJECTS})
         list(APPEND SCUDO_TEST_RTOBJECTS $<TARGET_OBJECTS:${rtobject}.${arch}>)
       endforeach()
       # Add the static runtime library made of all the runtime objects

compiler-rt/lib/scudo/standalone/tests/flags_test.cpp

TEST(ScudoFlagsTest, AllocatorFlags) {
   Flags.delete_size_mismatch = false;
   Flags.quarantine_max_chunk_size = 1024;
   Parser.parseString("dealloc_type_mismatch=true:delete_size_mismatch=true:"
                      "quarantine_max_chunk_size=2048");
   EXPECT_TRUE(Flags.dealloc_type_mismatch);
   EXPECT_TRUE(Flags.delete_size_mismatch);
   EXPECT_EQ(2048, Flags.quarantine_max_chunk_size);
 }
+
+TEST(ScudoFlagsTest, GWPASanFlags) {
+#ifndef GWP_ASAN_HOOKS
+  GTEST_SKIP() << "GWP-ASan wasn't built as part of Scudo Standalone.";
+#endif // GWP_ASAN_HOOKS
+
+  scudo::FlagParser Parser;
+  scudo::Flags Flags;
+  scudo::registerFlags(&Parser, &Flags);
+  Flags.setDefaults();
+  Flags.GWP_ASAN_Enabled = false;
+  Parser.parseString("GWP_ASAN_Enabled=true:GWP_ASAN_SampleRate=1:"
+                     "GWP_ASAN_InstallSignalHandlers=false");
+  EXPECT_TRUE(Flags.GWP_ASAN_Enabled);
+  EXPECT_FALSE(Flags.GWP_ASAN_InstallSignalHandlers);
+  EXPECT_EQ(1, Flags.GWP_ASAN_SampleRate);
+}

compiler-rt/test/scudo/standalone/unit/lit.site.cfg.py.in

 @LIT_SITE_CFG_IN_HEADER@
 
 # Load common config for all compiler-rt unit tests.
 lit_config.load_config(config, "@COMPILER_RT_BINARY_DIR@/unittests/lit.common.unit.configured")
 
 # Setup config name.
 config.name = 'ScudoStandalone-Unit'
 
 # Setup test source and exec root.
 # For unit tests, we define it as build directory with unit tests.
 config.test_exec_root = "@COMPILER_RT_BINARY_DIR@/lib/scudo/standalone/tests"
 config.test_source_root = config.test_exec_root
+
+# Disable GWP-ASan for scudo internal tests.
+if config.gwp_asan:
+  config.environment['SCUDO_OPTIONS'] = 'GWP_ASAN_Enabled=0'

compiler-rt/unittests/lit.common.unit.configured.in

 @LIT_SITE_CFG_IN_HEADER@
 
 # Generic config options for all compiler-rt unit tests.
 config.target_triple = "@TARGET_TRIPLE@"
 config.llvm_src_root = "@LLVM_MAIN_SRC_DIR@"
 config.llvm_obj_root = "@LLVM_BINARY_DIR@"
 config.llvm_tools_dir = "@LLVM_TOOLS_DIR@"
 config.compiler_rt_src_root = "@COMPILER_RT_SOURCE_DIR@"
 config.compiler_rt_libdir = "@COMPILER_RT_RESOLVED_LIBRARY_OUTPUT_DIR@"
 config.llvm_build_mode = "@LLVM_BUILD_MODE@"
 config.host_arch = "@HOST_ARCH@"
 config.host_os = "@HOST_OS@"
 config.llvm_lib_dir = "@LLVM_LIBRARY_DIR@"
+config.gwp_asan = @COMPILER_RT_HAS_GWP_ASAN_PYBOOL@
 
 # LLVM tools dir and build mode can be passed in lit parameters,
 # so try to apply substitution.
 try:
   config.llvm_tools_dir = config.llvm_tools_dir % lit_config.params
   config.compiler_rt_libdir = config.compiler_rt_libdir % lit_config.params
   config.llvm_build_mode = config.llvm_build_mode % lit_config.params
 except KeyError as e:
   key, = e.args
   lit_config.fatal("unable to find %r parameter, use '--param=%s=VALUE'" % (key, key))
 
 # Setup attributes common for all compiler-rt unit tests.
 lit_config.load_config(config, "@COMPILER_RT_SOURCE_DIR@/unittests/lit.common.unit.cfg.py")