Scudo tests with GWP-ASan.

[eugenis]

Summary

Run standalone scudo tests in both configurations (with and without
GWP-ASan). Add test-only support for deinitialization to GWP-ASan.

[merge_guards_bot]

Unit tests: pass. 61768 tests passed, 0 failed and 780 were skipped.

clang-tidy: fail. Please fix clang-tidy findings.

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

[eugenis]

I'm not sure this is a good idea after all.
We'd need to also bump sampling rate to 1 for reliable testing, and that does not work with scudo tests which specifically test the scudo implementation, and not a random posix-compliant allocator.

[eugenis]

Removed scudo+gwp_asan tests.
Added fork support to gwp_asan and associated tests.

[eugenis]

remove a ton of unrelated changes

[merge_guards_bot]

Unit tests: unknown.

clang-tidy: unknown.

clang-format: unknown.

Build artifacts: diff.json, console-log.txt

[eugenis]

This is meant to go on top of

https://reviews.llvm.org/D72470

with the cmake bits that disable GWP-ASan reverted.

[merge_guards_bot]

Unit tests: pass. 61637 tests passed, 0 failed and 777 were skipped.

clang-tidy: fail. Please fix clang-tidy findings.

clang-format: fail. Please format your changes with clang-format by running git-clang-format HEAD^ or applying this patch.

Build artifacts: diff.json, clang-tidy.txt, clang-format.patch, CMakeCache.txt, console-log.txt, test-results.xml

[hctim]

Thanks for doing this.

compiler-rt/lib/gwp_asan/guarded_pool_allocator.h

102

I'd prefer that this was part of init() (of course adding the restriction that malloc() works to init()), rather than have two separate steps to init GWP-ASan.

It's pretty easy for GWP-ASan for Scudo (just init in the post-init callback), bit more tricky for bionic. Both jemalloc_constructor and __libc_init_malloc are run as part of the init array (the latter via __libc_preinit. Might be able to delay GWP-ASan init until __libc_init, WDYT?

105

I don't think either of these functions should be static.

Other than that, can you add this comment?

These functions are exported for use in Android's `malloc_disable()`. Disabling the allocator will spinlock any threads attempting to allocate memory until `enable()` is called.

[hctim]

Oh, also, would you mind please updating the commit message to mention that this change adds enable/disable support, and fork protections? Thanks!

[eugenis]

See https://reviews.llvm.org/D73294

compiler-rt/lib/gwp_asan/guarded_pool_allocator.h

 //===-- guarded_pool_allocator.h --------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef GWP_ASAN_GUARDED_POOL_ALLOCATOR_H_
 #define GWP_ASAN_GUARDED_POOL_ALLOCATOR_H_
 
 #include "gwp_asan/definitions.h"
 #include "gwp_asan/mutex.h"
 #include "gwp_asan/options.h"
 #include "gwp_asan/random.h"
 #include "gwp_asan/stack_trace_compressor.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
public:
   // and metadata allocations during destruction. We can't clean up these areas
   // as this may cause a use-after-free on shutdown.
   ~GuardedPoolAllocator() = default;
 
   // Initialise the rest of the members of this class. Create the allocation
   // pool using the provided options. See options.inc for runtime configuration
   // options.
   void init(const options::Options &Opts);
+  void uninitTestOnly();
 
   // Return whether the allocation should be randomly chosen for sampling.
   GWP_ASAN_ALWAYS_INLINE bool shouldSample() {
     // NextSampleCounter == 0 means we "should regenerate the counter".
     //                   == 1 means we "should sample this allocation".
     if (GWP_ASAN_UNLIKELY(ThreadLocals.NextSampleCounter == 0))
       ThreadLocals.NextSampleCounter =
           (getRandomUnsigned32() % AdjustedSampleRate) + 1;
 
     return GWP_ASAN_UNLIKELY(--ThreadLocals.NextSampleCounter == 0);
   }
 
private:
   // These functions anonymously map memory or change the permissions of mapped
   // memory into this process in a platform-specific way. Pointer and size
   // arguments are expected to be page-aligned. These functions will never
   // return on error, instead electing to kill the calling process on failure.
   // Note that memory is initially mapped inaccessible. In order for RW
   // mappings, call mapMemory() followed by markReadWrite() on the returned
   // pointer.
   void *mapMemory(size_t Size) const;
+  void unmapMemory(void *Addr, size_t Size) const;
   void markReadWrite(void *Ptr, size_t Size) const;
   void markInaccessible(void *Ptr, size_t Size) const;
 
   // Get the page size from the platform-specific implementation. Only needs to
   // be called once, and the result should be cached in PageSize in this class.
   static size_t getPlatformPageSize();
 
   // Install the SIGSEGV crash handler for printing use-after-free and heap-
   // buffer-{under|over}flow exceptions. This is platform specific as even
   // though POSIX and Windows both support registering handlers through
   // signal(), we have to use platform-specific signal handlers to obtain the
   // address that caused the SIGSEGV exception.
   static void installSignalHandlers();
+  static void uninstallSignalHandlers();
 
   // Returns the index of the slot that this pointer resides in. If the pointer
   // is not owned by this pool, the result is undefined.
   size_t addrToSlot(uintptr_t Ptr) const;
 
   // Returns the address of the N-th guarded slot.
   uintptr_t slotToAddr(size_t N) const;
 

compiler-rt/lib/gwp_asan/guarded_pool_allocator.cpp

 //===-- guarded_pool_allocator.cpp ------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "gwp_asan/guarded_pool_allocator.h"
 
 #include "gwp_asan/options.h"
 
 // RHEL creates the PRIu64 format macro (for printing uint64_t's) only when this
 // macro is defined before including <inttypes.h>.
 #ifndef __STDC_FORMAT_MACROS
 #define __STDC_FORMAT_MACROS 1
 #endif
void GuardedPoolAllocator::init(const options::Options &Opts) {
 
   // Ensure that signal handlers are installed as late as possible, as the class
   // is not thread-safe until init() is finished, and thus a SIGSEGV may cause a
   // race to members if received during init().
   if (Opts.InstallSignalHandlers)
     installSignalHandlers();
 }
 
+void GuardedPoolAllocator::uninitTestOnly() {
+  if (GuardedPagePool != UINTPTR_MAX) {
+    unmapMemory(reinterpret_cast<void *>(GuardedPagePool),
+                GuardedPagePoolEnd - GuardedPagePool);
+    GuardedPagePool = UINTPTR_MAX;
+    GuardedPagePoolEnd = 0;
+  }
+  if (Metadata) {
+    unmapMemory(Metadata, MaxSimultaneousAllocations * sizeof(*Metadata));
+    Metadata = nullptr;
+  }
+  if (FreeSlots) {
+    unmapMemory(FreeSlots, MaxSimultaneousAllocations * sizeof(*FreeSlots));
+    FreeSlots = nullptr;
+  }
+  uninstallSignalHandlers();
+}
+
 void *GuardedPoolAllocator::allocate(size_t Size) {
   // GuardedPagePoolEnd == 0 when GWP-ASan is disabled. If we are disabled, fall
   // back to the supporting allocator.
   if (GuardedPagePoolEnd == 0)
     return nullptr;
 
   // Protect against recursivity.
   if (ThreadLocals.RecursiveGuard)

compiler-rt/lib/gwp_asan/platform_specific/guarded_pool_allocator_posix.cpp

 //===-- guarded_pool_allocator_posix.cpp ------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "gwp_asan/guarded_pool_allocator.h"
 
 #include <stdlib.h>
+#include <string.h>
 #include <errno.h>
 #include <signal.h>
 #include <sys/mman.h>
 #include <sys/syscall.h>
 #include <sys/types.h>
 #include <unistd.h>
 
 namespace gwp_asan {
 
 void *GuardedPoolAllocator::mapMemory(size_t Size) const {
   void *Ptr =
       mmap(nullptr, Size, PROT_NONE, MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
 
   if (Ptr == MAP_FAILED) {
     Printf("Failed to map guarded pool allocator memory, errno: %d\n", errno);
     Printf("  mmap(nullptr, %zu, ...) failed.\n", Size);
     exit(EXIT_FAILURE);
   }
   return Ptr;
 }
 
+void GuardedPoolAllocator::unmapMemory(void *Addr, size_t Size) const {
+  int Res = munmap(Addr, Size);
+
+  if (Res != 0) {
+    Printf("Failed to unmap guarded pool allocator memory, errno: %d\n", errno);
+    Printf("  unmmap(%p, %zu, ...) failed.\n", Addr, Size);
+    exit(EXIT_FAILURE);
+  }
+}
+
 void GuardedPoolAllocator::markReadWrite(void *Ptr, size_t Size) const {
   if (mprotect(Ptr, Size, PROT_READ | PROT_WRITE) != 0) {
     Printf("Failed to set guarded pool allocator memory at as RW, errno: %d\n",
            errno);
     Printf("  mprotect(%p, %zu, RW) failed.\n", Ptr, Size);
     exit(EXIT_FAILURE);
   }
 }

 
 void GuardedPoolAllocator::installSignalHandlers() {
   struct sigaction Action;
   Action.sa_sigaction = sigSegvHandler;
   Action.sa_flags = SA_SIGINFO;
   sigaction(SIGSEGV, &Action, &PreviousHandler);
 }
 
+void GuardedPoolAllocator::uninstallSignalHandlers() {
+  if (PreviousHandler.sa_sigaction) {
+    sigaction(SIGSEGV, &PreviousHandler, nullptr);
+    memset(&PreviousHandler, 0, sizeof(PreviousHandler));
+  }
+}
+
 uint64_t GuardedPoolAllocator::getThreadID() {
 #ifdef SYS_gettid
   return syscall(SYS_gettid);
 #else
   return kInvalidThreadID;
 #endif
 }
 
 } // namespace gwp_asan

compiler-rt/lib/scudo/standalone/combined.h

 #endif // GWP_ASAN_HOOKS
   }
 
   void reset() { memset(this, 0, sizeof(*this)); }
 
   void unmapTestOnly() {
     TSDRegistry.unmapTestOnly();
     Primary.unmapTestOnly();
+#ifdef GWP_ASAN_HOOKS
+    GuardedAlloc.uninitTestOnly();
+#endif // GWP_ASAN_HOOKS
   }
 
   TSDRegistryT *getTSDRegistry() { return &TSDRegistry; }
 
   // The Cache must be provided zero-initialized.
   void initCache(CacheT *Cache) {
     Cache->initLinkerInitialized(&Stats, &Primary);
   }

compiler-rt/lib/scudo/standalone/tests/combined_test.cpp

 //===-- combined_test.cpp ---------------------------------------*- C++ -*-===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "tests/scudo_unit_test.h"
 
 #include "allocator_config.h"
 #include "combined.h"
 
 #include <condition_variable>
 #include <mutex>
 #include <thread>
 #include <vector>
template <class Config> static void testAllocator() {
   std::string Stats(Buffer.begin(), Buffer.end());
   // Basic checks on the contents of the statistics output, which also allows us
   // to verify that we got it all.
   EXPECT_NE(Stats.find("Stats: SizeClassAllocator"), std::string::npos);
   EXPECT_NE(Stats.find("Stats: MapAllocator"), std::string::npos);
   EXPECT_NE(Stats.find("Stats: Quarantine"), std::string::npos);
 }
 
+// Test that multiple instantiations of the allocator have not messed up the
+// process's signal handlers (GWP-ASan used to do this).
+void testSEGV() {
+  const scudo::uptr Size = 4 * scudo::getPageSizeCached();
+  scudo::MapPlatformData Data = {};
+  void *P = scudo::map(nullptr, Size, "testSEGV", MAP_NOACCESS, &Data);
+  EXPECT_NE(P, nullptr);
+  EXPECT_DEATH(memset(P, 0xaa, Size), "");
+  scudo::unmap(P, Size, UNMAP_ALL, &Data);
+}
+
 TEST(ScudoCombinedTest, BasicCombined) {
   UseQuarantine = false;
   testAllocator<scudo::AndroidSvelteConfig>();
 #if SCUDO_FUCHSIA
   testAllocator<scudo::FuchsiaConfig>();
 #else
   testAllocator<scudo::DefaultConfig>();
   UseQuarantine = true;
   testAllocator<scudo::AndroidConfig>();
+  testSEGV();
 #endif
 }
 
 template <typename AllocatorT> static void stressAllocator(AllocatorT *A) {
   {
     std::unique_lock<std::mutex> Lock(Mutex);
     while (!Ready)
       Cv.wait(Lock);

compiler-rt/test/scudo/standalone/CMakeLists.txt

 if(COMPILER_RT_INCLUDE_TESTS AND COMPILER_RT_HAS_SCUDO_STANDALONE)
   configure_lit_site_cfg(
     ${CMAKE_CURRENT_SOURCE_DIR}/unit/lit.site.cfg.py.in
     ${CMAKE_CURRENT_BINARY_DIR}/unit/lit.site.cfg.py)
   list(APPEND SCUDO_STANDALONE_TEST_DEPS ScudoUnitTests)
   list(APPEND SCUDO_STANDALONE_TESTSUITES ${CMAKE_CURRENT_BINARY_DIR}/unit)
+
+  configure_lit_site_cfg(
+    ${CMAKE_CURRENT_SOURCE_DIR}/unit-with-gwp-asan/lit.site.cfg.py.in
+    ${CMAKE_CURRENT_BINARY_DIR}/unit-with-gwp-asan/lit.site.cfg.py)
+  list(APPEND SCUDO_STANDALONE_TEST_DEPS ScudoUnitTests)
+  list(APPEND SCUDO_STANDALONE_TESTSUITES ${CMAKE_CURRENT_BINARY_DIR}/unit-with-gwp-asan)
 endif()
 
 add_lit_testsuite(check-scudo_standalone
   "Running Scudo Standalone tests"
   ${SCUDO_STANDALONE_TESTSUITES}
   DEPENDS ${SCUDO_STANDALONE_TEST_DEPS})
 
 set_target_properties(check-scudo_standalone
   PROPERTIES FOLDER "Compiler-RT Tests")

compiler-rt/test/scudo/standalone/unit-with-gwp-asan/lit.site.cfg.py.in

+@LIT_SITE_CFG_IN_HEADER@
+
+# Load common config for all compiler-rt unit tests.
+lit_config.load_config(config, "@COMPILER_RT_BINARY_DIR@/unittests/lit.common.unit.configured")
+
+# Setup config name.
+config.name = 'ScudoStandalone-Unit-WithGwpAsan'
+
+# Setup test source and exec root.
+# For unit tests, we define it as build directory with unit tests.
+config.test_exec_root = "@COMPILER_RT_BINARY_DIR@/lib/scudo/standalone/tests"
+config.test_source_root = config.test_exec_root
+
+# Disable GWP-ASan for scudo internal tests.
+if config.gwp_asan:
+  config.environment['SCUDO_OPTIONS'] = 'GWP_ASAN_Enabled=1'