Scudo tests with GWP-ASan.

[eugenis]

Summary

Run standalone scudo tests in both configurations (with and without
GWP-ASan). Add test-only support for deinitialization to GWP-ASan.

[merge_guards_bot]

Unit tests: pass. 61768 tests passed, 0 failed and 780 were skipped.

clang-tidy: fail. Please fix clang-tidy findings.

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

[eugenis]

I'm not sure this is a good idea after all.
We'd need to also bump sampling rate to 1 for reliable testing, and that does not work with scudo tests which specifically test the scudo implementation, and not a random posix-compliant allocator.

[eugenis]

Removed scudo+gwp_asan tests.
Added fork support to gwp_asan and associated tests.

[eugenis]

remove a ton of unrelated changes

[merge_guards_bot]

Unit tests: unknown.

clang-tidy: unknown.

clang-format: unknown.

Build artifacts: diff.json, console-log.txt

[eugenis]

This is meant to go on top of

https://reviews.llvm.org/D72470

with the cmake bits that disable GWP-ASan reverted.

[merge_guards_bot]

Unit tests: pass. 61637 tests passed, 0 failed and 777 were skipped.

clang-tidy: fail. Please fix clang-tidy findings.

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

[hctim]

Thanks for doing this.

compiler-rt/lib/gwp_asan/guarded_pool_allocator.h

102

I'd prefer that this was part of init() (of course adding the restriction that malloc() works to init()), rather than have two separate steps to init GWP-ASan.

It's pretty easy for GWP-ASan for Scudo (just init in the post-init callback), bit more tricky for bionic. Both jemalloc_constructor and __libc_init_malloc are run as part of the init array (the latter via __libc_preinit. Might be able to delay GWP-ASan init until __libc_init, WDYT?

105

I don't think either of these functions should be static.

Other than that, can you add this comment?

These functions are exported for use in Android's `malloc_disable()`. Disabling the allocator will spinlock any threads attempting to allocate memory until `enable()` is called.

[hctim]

Oh, also, would you mind please updating the commit message to mention that this change adds enable/disable support, and fork protections? Thanks!

[eugenis]

See https://reviews.llvm.org/D73294

compiler-rt/lib/gwp_asan/guarded_pool_allocator.h

public:
   // and metadata allocations during destruction. We can't clean up these areas
   // as this may cause a use-after-free on shutdown.
   ~GuardedPoolAllocator() = default;
 
   // Initialise the rest of the members of this class. Create the allocation
   // pool using the provided options. See options.inc for runtime configuration
   // options.
   void init(const options::Options &Opts);
+  // Initialize parts of GWP-ASan that require functional underlying malloc().
+  static void setupForFork();
+  void uninitTestOnly();
+
+  static void disable();
+  static void enable();
 
   // Return whether the allocation should be randomly chosen for sampling.
   GWP_ASAN_ALWAYS_INLINE bool shouldSample() {
     // NextSampleCounter == 0 means we "should regenerate the counter".
     //                   == 1 means we "should sample this allocation".
     if (GWP_ASAN_UNLIKELY(ThreadLocals.NextSampleCounter == 0))
       ThreadLocals.NextSampleCounter =
           (getRandomUnsigned32() % AdjustedSampleRate) + 1;
private:
   // These functions anonymously map memory or change the permissions of mapped
   // memory into this process in a platform-specific way. Pointer and size
   // arguments are expected to be page-aligned. These functions will never
   // return on error, instead electing to kill the calling process on failure.
   // Note that memory is initially mapped inaccessible. In order for RW
   // mappings, call mapMemory() followed by markReadWrite() on the returned
   // pointer.
   void *mapMemory(size_t Size) const;
+  void unmapMemory(void *Addr, size_t Size) const;
   void markReadWrite(void *Ptr, size_t Size) const;
   void markInaccessible(void *Ptr, size_t Size) const;
 
   // Get the page size from the platform-specific implementation. Only needs to
   // be called once, and the result should be cached in PageSize in this class.
   static size_t getPlatformPageSize();
 
   // Install the SIGSEGV crash handler for printing use-after-free and heap-
   // buffer-{under|over}flow exceptions. This is platform specific as even
   // though POSIX and Windows both support registering handlers through
   // signal(), we have to use platform-specific signal handlers to obtain the
   // address that caused the SIGSEGV exception.
   static void installSignalHandlers();
+  static void uninstallSignalHandlers();
 
   // Returns the index of the slot that this pointer resides in. If the pointer
   // is not owned by this pool, the result is undefined.
   size_t addrToSlot(uintptr_t Ptr) const;
 
   // Returns the address of the N-th guarded slot.
   uintptr_t slotToAddr(size_t N) const;
 

compiler-rt/lib/gwp_asan/guarded_pool_allocator.cpp

 // RHEL creates the PRIu64 format macro (for printing uint64_t's) only when this
 // macro is defined before including <inttypes.h>.
 #ifndef __STDC_FORMAT_MACROS
 #define __STDC_FORMAT_MACROS 1
 #endif
 
 #include <assert.h>
 #include <inttypes.h>
+#include <pthread.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <time.h>
 
 using AllocationMetadata = gwp_asan::GuardedPoolAllocator::AllocationMetadata;
 using Error = gwp_asan::GuardedPoolAllocator::Error;
 
void GuardedPoolAllocator::init(const options::Options &Opts) {
 
   // Ensure that signal handlers are installed as late as possible, as the class
   // is not thread-safe until init() is finished, and thus a SIGSEGV may cause a
   // race to members if received during init().
   if (Opts.InstallSignalHandlers)
     installSignalHandlers();
 }
 
+void GuardedPoolAllocator::disable() {
+  if (SingletonPtr)
+    SingletonPtr->PoolMutex.lock();
+}
+
+void GuardedPoolAllocator::enable() {
+  if (SingletonPtr)
+    SingletonPtr->PoolMutex.unlock();
+}
+
+void GuardedPoolAllocator::setupForFork() {
+  pthread_atfork(disable, enable, enable);
+}
+
+void GuardedPoolAllocator::uninitTestOnly() {
+  if (GuardedPagePool != UINTPTR_MAX) {
+    unmapMemory(reinterpret_cast<void *>(GuardedPagePool),
+                GuardedPagePoolEnd - GuardedPagePool);
+    GuardedPagePool = UINTPTR_MAX;
+    GuardedPagePoolEnd = 0;
+  }
+  if (Metadata) {
+    unmapMemory(Metadata, MaxSimultaneousAllocations * sizeof(*Metadata));
+    Metadata = nullptr;
+  }
+  if (FreeSlots) {
+    unmapMemory(FreeSlots, MaxSimultaneousAllocations * sizeof(*FreeSlots));
+    FreeSlots = nullptr;
+  }
+  uninstallSignalHandlers();
+}
+
 void *GuardedPoolAllocator::allocate(size_t Size) {
   // GuardedPagePoolEnd == 0 when GWP-ASan is disabled. If we are disabled, fall
   // back to the supporting allocator.
   if (GuardedPagePoolEnd == 0)
     return nullptr;
 
   // Protect against recursivity.
   if (ThreadLocals.RecursiveGuard)

compiler-rt/lib/gwp_asan/platform_specific/guarded_pool_allocator_posix.cpp

 //===-- guarded_pool_allocator_posix.cpp ------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "gwp_asan/guarded_pool_allocator.h"
 
 #include <stdlib.h>
+#include <string.h>
 #include <errno.h>
 #include <signal.h>
 #include <sys/mman.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 namespace gwp_asan {
 
 void *GuardedPoolAllocator::mapMemory(size_t Size) const {
   void *Ptr =
       mmap(nullptr, Size, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
 
   if (Ptr == MAP_FAILED) {
     Printf("Failed to map guarded pool allocator memory, errno: %d\n", errno);
     Printf("  mmap(nullptr, %zu, ...) failed.\n", Size);
     exit(EXIT_FAILURE);
   }
   return Ptr;
 }
 
+void GuardedPoolAllocator::unmapMemory(void *Addr, size_t Size) const {
+  int Res = munmap(Addr, Size);
+
+  if (Res != 0) {
+    Printf("Failed to unmap guarded pool allocator memory, errno: %d\n", errno);
+    Printf("  unmmap(%p, %zu, ...) failed.\n", Addr, Size);
+    exit(EXIT_FAILURE);
+  }
+}
+
 void GuardedPoolAllocator::markReadWrite(void *Ptr, size_t Size) const {
   if (mprotect(Ptr, Size, PROT_READ | PROT_WRITE) != 0) {
     Printf("Failed to set guarded pool allocator memory at as RW, errno: %d\n",
            errno);
     Printf("  mprotect(%p, %zu, RW) failed.\n", Ptr, Size);
     exit(EXIT_FAILURE);
   }
 }
void GuardedPoolAllocator::markInaccessible(void *Ptr, size_t Size) const {
   }
 }
 
 size_t GuardedPoolAllocator::getPlatformPageSize() {
   return sysconf(_SC_PAGESIZE);
 }
 
 struct sigaction PreviousHandler;
+bool SignalHandlerInstalled;
 
 static void sigSegvHandler(int sig, siginfo_t *info, void *ucontext) {
   gwp_asan::GuardedPoolAllocator::reportError(
       reinterpret_cast<uintptr_t>(info->si_addr));
 
   // Process any previous handlers.
   if (PreviousHandler.sa_flags & SA_SIGINFO) {
     PreviousHandler.sa_sigaction(sig, info, ucontext);
static void sigSegvHandler(int sig, siginfo_t *info, void *ucontext) {
   }
 }
 
 void GuardedPoolAllocator::installSignalHandlers() {
   struct sigaction Action;
   Action.sa_sigaction = sigSegvHandler;
   Action.sa_flags = SA_SIGINFO;
   sigaction(SIGSEGV, &Action, &PreviousHandler);
+  SignalHandlerInstalled = true;
+}
+
+void GuardedPoolAllocator::uninstallSignalHandlers() {
+  if (SignalHandlerInstalled) {
+    sigaction(SIGSEGV, &PreviousHandler, nullptr);
+    SignalHandlerInstalled = false;
+  }
 }
 
 uint64_t GuardedPoolAllocator::getThreadID() {
 #ifdef SYS_gettid
   return syscall(SYS_gettid);
 #else
   return kInvalidThreadID;
 #endif
 }
 
 } // namespace gwp_asan

compiler-rt/lib/gwp_asan/tests/CMakeLists.txt

set(GWP_ASAN_UNITTESTS
   optional/printf_sanitizer_common.cpp
   alignment.cpp
   backtrace.cpp
   basic.cpp
   compression.cpp
   driver.cpp
   mutex_test.cpp
   slot_reuse.cpp
-  thread_contention.cpp)
+  thread_contention.cpp
+  harness.cpp
+  enable_disable.cpp)
 
 set(GWP_ASAN_UNIT_TEST_HEADERS
   ${GWP_ASAN_HEADERS}
   harness.h)
 
 add_custom_target(GwpAsanUnitTests)
 set_target_properties(GwpAsanUnitTests PROPERTIES FOLDER "Compiler-RT Tests")
 

compiler-rt/lib/gwp_asan/tests/enable_disable.cpp

+//===-- enable_disable.cpp --------------------------------------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#include "gwp_asan/tests/harness.h"
+
+constexpr size_t Size = 100;
+
+TEST_F(DefaultGuardedPoolAllocator, Fork) {
+  void *P;
+  pid_t Pid = fork();
+  EXPECT_GE(Pid, 0);
+  if (Pid == 0) {
+    P = GPA.allocate(Size);
+    EXPECT_NE(P, nullptr);
+    memset(P, 0x42, Size);
+    GPA.deallocate(P);
+    _exit(0);
+  }
+  waitpid(Pid, nullptr, 0);
+  P = GPA.allocate(Size);
+  EXPECT_NE(P, nullptr);
+  memset(P, 0x42, Size);
+  GPA.deallocate(P);
+
+  // fork should stall if the allocator has been disabled.
+  EXPECT_DEATH(
+      {
+        GPA.disable();
+        alarm(1);
+        Pid = fork();
+        EXPECT_GE(Pid, 0);
+      },
+      "");
+}
+
+static pthread_mutex_t Mutex;
+static pthread_cond_t Conditional = PTHREAD_COND_INITIALIZER;
+
+static void *enableMalloc(void *arg) {
+  auto &GPA = *(gwp_asan::GuardedPoolAllocator *)arg;
+  // Initialize the allocator for this thread.
+  void *P = GPA.allocate(Size);
+  EXPECT_NE(P, nullptr);
+  memset(P, 0x42, Size);
+  GPA.deallocate(P);
+
+  // Signal the main thread we are ready.
+  pthread_mutex_lock(&Mutex);
+  pthread_cond_signal(&Conditional);
+  pthread_mutex_unlock(&Mutex);
+
+  // Wait for the malloc_disable & fork, then enable the allocator again.
+  sleep(1);
+  GPA.enable();
+
+  return nullptr;
+}
+
+TEST_F(DefaultGuardedPoolAllocator, DisableForkEnable) {
+  pthread_t ThreadId;
+  EXPECT_EQ(pthread_create(&ThreadId, nullptr, &enableMalloc, &GPA), 0);
+
+  // Wait for the thread to be warmed up.
+  pthread_mutex_lock(&Mutex);
+  pthread_cond_wait(&Conditional, &Mutex);
+  pthread_mutex_unlock(&Mutex);
+
+  // Disable the allocator and fork. fork should succeed after malloc_enable.
+  GPA.disable();
+  pid_t Pid = fork();
+  EXPECT_GE(Pid, 0);
+  if (Pid == 0) {
+    void *P = GPA.allocate(Size);
+    EXPECT_NE(P, nullptr);
+    memset(P, 0x42, Size);
+    GPA.deallocate(P);
+    _exit(0);
+  }
+  waitpid(Pid, nullptr, 0);
+  EXPECT_EQ(pthread_join(ThreadId, 0), 0);
+}

compiler-rt/lib/gwp_asan/tests/harness.h

 
 namespace gwp_asan {
 namespace test {
 // This printf-function getter allows other platforms (e.g. Android) to define
 // their own signal-safe Printf function. In LLVM, we use
 // `optional/printf_sanitizer_common.cpp` which supplies the __sanitizer::Printf
 // for this purpose.
 options::Printf_t getPrintfFunction();
+
+static void setupForFork() {
+  static struct Guard {
+    Guard() { gwp_asan::GuardedPoolAllocator::setupForFork(); }
+  } guard;
+}
+
+extern gwp_asan::GuardedPoolAllocator GPA;
+
 }; // namespace test
 }; // namespace gwp_asan
 
+
 class DefaultGuardedPoolAllocator : public ::testing::Test {
 public:
-  DefaultGuardedPoolAllocator() {
+  void SetUp() override {
     gwp_asan::options::Options Opts;
     Opts.setDefaults();
     MaxSimultaneousAllocations = Opts.MaxSimultaneousAllocations;
 
     Opts.Printf = gwp_asan::test::getPrintfFunction();
     GPA.init(Opts);
+    gwp_asan::test::setupForFork();
   }
 
+  void TearDown() override {
+    GPA.uninitTestOnly();
+  }
 protected:
-  gwp_asan::GuardedPoolAllocator GPA;
+  gwp_asan::GuardedPoolAllocator &GPA = gwp_asan::test::GPA;
   decltype(gwp_asan::options::Options::MaxSimultaneousAllocations)
       MaxSimultaneousAllocations;
 };
 
 class CustomGuardedPoolAllocator : public ::testing::Test {
 public:
   void
   InitNumSlots(decltype(gwp_asan::options::Options::MaxSimultaneousAllocations)
                    MaxSimultaneousAllocationsArg) {
     gwp_asan::options::Options Opts;
     Opts.setDefaults();
 
     Opts.MaxSimultaneousAllocations = MaxSimultaneousAllocationsArg;
     MaxSimultaneousAllocations = MaxSimultaneousAllocationsArg;
 
     Opts.Printf = gwp_asan::test::getPrintfFunction();
     GPA.init(Opts);
+    gwp_asan::test::setupForFork();
+  }
+
+  void TearDown() override {
+    GPA.uninitTestOnly();
   }
 
  protected:
-  gwp_asan::GuardedPoolAllocator GPA;
+  gwp_asan::GuardedPoolAllocator &GPA = gwp_asan::test::GPA;
   decltype(gwp_asan::options::Options::MaxSimultaneousAllocations)
       MaxSimultaneousAllocations;
 };
 
 class BacktraceGuardedPoolAllocator : public ::testing::Test {
 public:
-  BacktraceGuardedPoolAllocator() {
+  void SetUp() override {
     gwp_asan::options::Options Opts;
     Opts.setDefaults();
 
     Opts.Printf = gwp_asan::test::getPrintfFunction();
     Opts.Backtrace = gwp_asan::options::getBacktraceFunction();
     Opts.PrintBacktrace = gwp_asan::options::getPrintBacktraceFunction();
     GPA.init(Opts);
+    gwp_asan::test::setupForFork();
   }
 
+  void TearDown() override {
+    GPA.uninitTestOnly();
+  }
 protected:
-  gwp_asan::GuardedPoolAllocator GPA;
+  gwp_asan::GuardedPoolAllocator &GPA = gwp_asan::test::GPA;
 };
 
 #endif // GWP_ASAN_TESTS_HARNESS_H_

compiler-rt/lib/gwp_asan/tests/harness.cpp

+#include "harness.h"
+
+namespace gwp_asan {
+namespace test {
+gwp_asan::GuardedPoolAllocator GPA;
+}
+}

compiler-rt/lib/scudo/standalone/combined.h

 #endif // GWP_ASAN_HOOKS
   }
 
   void reset() { memset(this, 0, sizeof(*this)); }
 
   void unmapTestOnly() {
     TSDRegistry.unmapTestOnly();
     Primary.unmapTestOnly();
+#ifdef GWP_ASAN_HOOKS
+    GuardedAlloc.uninitTestOnly();
+#endif // GWP_ASAN_HOOKS
   }
 
   TSDRegistryT *getTSDRegistry() { return &TSDRegistry; }
 
   // The Cache must be provided zero-initialized.
   void initCache(CacheT *Cache) {
     Cache->initLinkerInitialized(&Stats, &Primary);
   }
#endif // GWP_ASAN_HOOKS
     return NewPtr;
   }
 
   // TODO(kostyak): disable() is currently best-effort. There are some small
   //                windows of time when an allocation could still succeed after
   //                this function finishes. We will revisit that later.
   NOINLINE void disable() {
     initThreadMaybe();
+#ifdef GWP_ASAN_HOOKS
+    GuardedAlloc.disable();
+#endif
     TSDRegistry.disable();
     Stats.disable();
     Quarantine.disable();
     Primary.disable();
     Secondary.disable();
   }
 
   NOINLINE void enable() {
     initThreadMaybe();
     Secondary.enable();
     Primary.enable();
     Quarantine.enable();
     Stats.enable();
     TSDRegistry.enable();
+#ifdef GWP_ASAN_HOOKS
+    GuardedAlloc.enable();
+#endif
   }
 
   // The function returns the amount of bytes required to store the statistics,
   // which might be larger than the amount of bytes provided. Note that the
   // statistics buffer is not necessarily constant between calls to this
   // function. This can be called with a null buffer or zero size for buffer
   // sizing purposes.
   uptr getStats(char *Buffer, uptr Size) {

compiler-rt/lib/scudo/standalone/tests/combined_test.cpp

template <class Config> static void testAllocator() {
   std::string Stats(Buffer.begin(), Buffer.end());
   // Basic checks on the contents of the statistics output, which also allows us
   // to verify that we got it all.
   EXPECT_NE(Stats.find("Stats: SizeClassAllocator"), std::string::npos);
   EXPECT_NE(Stats.find("Stats: MapAllocator"), std::string::npos);
   EXPECT_NE(Stats.find("Stats: Quarantine"), std::string::npos);
 }
 
+// Test that multiple instantiations of the allocator have not messed up the
+// process's signal handlers (GWP-ASan used to do this).
+void testSEGV() {
+  const scudo::uptr Size = 4 * scudo::getPageSizeCached();
+  scudo::MapPlatformData Data = {};
+  void *P = scudo::map(nullptr, Size, "testSEGV", MAP_NOACCESS, &Data);
+  EXPECT_NE(P, nullptr);
+  EXPECT_DEATH(memset(P, 0xaa, Size), "");
+  scudo::unmap(P, Size, UNMAP_ALL, &Data);
+}
+
 TEST(ScudoCombinedTest, BasicCombined) {
   UseQuarantine = false;
   testAllocator<scudo::AndroidSvelteConfig>();
 #if SCUDO_FUCHSIA
   testAllocator<scudo::FuchsiaConfig>();
 #else
   testAllocator<scudo::DefaultConfig>();
   UseQuarantine = true;
   testAllocator<scudo::AndroidConfig>();
+  testSEGV();
 #endif
 }
 
 template <typename AllocatorT> static void stressAllocator(AllocatorT *A) {
   {
     std::unique_lock<std::mutex> Lock(Mutex);
     while (!Ready)
       Cv.wait(Lock);