Split Mprotect into MmapNoAccess and MprotectNoAccess to be more portable

[timurrrr]

Summary

On Windows, we have to know if a memory to be protected is mapped or not.
On POSIX, Mprotect was semantically different from mprotect most people know.

[timurrrr]

I'll go ahead and commit it, since Alexander is out of the office already and we've previously discussed the new naming.
Fingers crossed, this doesn't break on Mac.

[timurrrr]

r234602

[glider]

LGTM with nits.

lib/asan/asan_rtl.cc

300

The argument name "a" is meaningless, can you please fix?
(I know it was meaningless before)

lib/sanitizer_common/sanitizer_posix.cc

202

Why not return an uptr here?
IIRC the result of internal_mmap() is an uptr, which is cast to void* here, returned and then cast to an uptr by the callers of MmapNoAccess().

[timurrrr]

lib/asan/asan_rtl.cc

300

Good point, done [r234604]

lib/sanitizer_common/sanitizer_posix.cc

202

We've discussed this offline and decided not to do that for consistency with other Mmaps.
If anything, we should change the types of the parameters...

[hjl.tools]

lib/sanitizer_common/sanitizer_linux.cc

132

This is incorrect on Linux/x86-64. Pointers passed to
internal_syscall should be casted to uptr first. Otherwise,
they won't be properly extended to 64-bit for x32. Need
something like

return internal_syscall(SYSCALL(mprotect), (uptr)addr, length, prot);

[timurrrr]

lib/sanitizer_common/sanitizer_linux.cc

113

I suggest we put a comment here describing that we must cast any pointer argument to uptr to be compatible with X32.

132

Thanks, done as r234748.

lib/asan/asan_rtl.cc

#if !ASAN_FIXED_MAPPING
   kHighMemEnd = GetMaxVirtualAddress();
   // Increase kHighMemEnd to make sure it's properly
   // aligned together with kHighMemBeg:
   kHighMemEnd |= SHADOW_GRANULARITY * GetPageSizeCached() - 1;
 #endif  // !ASAN_FIXED_MAPPING
   CHECK_EQ((kHighMemBeg % GetPageSizeCached()), 0);
 }
 
 static void ProtectGap(uptr a, uptr size) {
-  void *res = Mprotect(a, size);
+  void *res = MmapNoAccess(a, size);
   if (a == (uptr)res)
     return;
   Report("ERROR: Failed to protect the shadow gap. "
          "ASan cannot proceed correctly. ABORTING.\n");
   DumpProcessMap();
   Die();
 }
 

lib/dfsan/dfsan.cc

#endif
 
   // Protect the region of memory we don't use, to preserve the one-to-one
   // mapping from application to shadow memory. But if ASLR is disabled, Linux
   // will load our executable in the middle of our unused region. This mostly
   // works so long as the program doesn't use too much memory. We support this
   // case by disabling memory protection when ASLR is disabled.
   uptr init_addr = (uptr)&dfsan_init;
   if (!(init_addr >= kUnusedAddr && init_addr < kAppAddr))
-    Mprotect(kUnusedAddr, kAppAddr - kUnusedAddr);
+    MmapNoAccess(kUnusedAddr, kAppAddr - kUnusedAddr);
 
   InitializeFlags();
   InitializeInterceptors();
 
   // Register the fini callback to run when the program terminates successfully
   // or it is killed by the runtime.
   Atexit(dfsan_fini);
   SetDieCallback(dfsan_fini);
 
   __dfsan_label_info[kInitializingLabel].desc = "<init label>";
 }
 
 #if !defined(DFSAN_NOLIBC) && SANITIZER_CAN_USE_PREINIT_ARRAY
 __attribute__((section(".preinit_array"), used))
 static void (*dfsan_init_ptr)(int, char **, char **) = dfsan_init;
 #endif

lib/msan/msan_linux.cc

if (size > 0) {
     }
   }
   return true;
 }
 
 static bool ProtectMemoryRange(uptr beg, uptr size) {
   if (size > 0) {
     uptr end = beg + size - 1;
-    if (!Mprotect(beg, size)) {
+    if (!MmapNoAccess(beg, size)) {
       Printf("FATAL: Cannot protect memory range %p - %p.\n", beg, end);
       return false;
     }
   }
   return true;
 }
 
 static void CheckMemoryLayoutSanity() {

lib/sanitizer_common/sanitizer_allocator.h

  public:
   typedef typename SizeClassMap::TransferBatch Batch;
   typedef SizeClassAllocator64<kSpaceBeg, kSpaceSize, kMetadataSize,
       SizeClassMap, MapUnmapCallback> ThisT;
   typedef SizeClassAllocatorLocalCache<ThisT> AllocatorCache;
 
   void Init() {
     CHECK_EQ(kSpaceBeg,
-             reinterpret_cast<uptr>(Mprotect(kSpaceBeg, kSpaceSize)));
+             reinterpret_cast<uptr>(MmapNoAccess(kSpaceBeg, kSpaceSize)));
     MapWithCallback(kSpaceEnd, AdditionalSize());
   }
 
   void MapWithCallback(uptr beg, uptr size) {
     CHECK_EQ(beg, reinterpret_cast<uptr>(MmapFixedOrDie(beg, size)));
     MapUnmapCallback().OnMap(beg, size);
   }
 

lib/sanitizer_common/sanitizer_common.h

void GetThreadStackAndTls(bool main, uptr *stk_addr, uptr *stk_size,
                           uptr *tls_addr, uptr *tls_size);
 
 // Memory management
 void *MmapOrDie(uptr size, const char *mem_type);
 void UnmapOrDie(void *addr, uptr size);
 void *MmapFixedNoReserve(uptr fixed_addr, uptr size);
 void *MmapNoReserveOrDie(uptr size, const char *mem_type);
 void *MmapFixedOrDie(uptr fixed_addr, uptr size);
-void *Mprotect(uptr fixed_addr, uptr size);
+void *MmapNoAccess(uptr fixed_addr, uptr size);
 // Map aligned chunk of address space; size and alignment are powers of two.
 void *MmapAlignedOrDie(uptr size, uptr alignment, const char *mem_type);
+// Disallow access to a memory range.  Use MmapNoAccess to allocate an
+// unaccessible memory.
+bool MprotectNoAccess(uptr addr, uptr size);
+
 // Used to check if we can map shadow memory to a fixed location.
 bool MemoryRangeIsAvailable(uptr range_start, uptr range_end);
 void FlushUnneededShadowMemory(uptr addr, uptr size);
 void IncreaseTotalMmap(uptr size);
 void DecreaseTotalMmap(uptr size);
 uptr GetRSS();
 void NoHugePagesInRegion(uptr addr, uptr length);
 void DontDumpShadowMemory(uptr addr, uptr length);

lib/sanitizer_common/sanitizer_coverage_libcdep.cc

cc_array = reinterpret_cast<uptr **>(MmapNoReserveOrDie(
       sizeof(uptr *) * kCcArrayMaxSize, "CovInit::cc_array"));
   atomic_store(&cc_array_size, kCcArrayMaxSize, memory_order_relaxed);
   atomic_store(&cc_array_index, 0, memory_order_relaxed);
 
   // Allocate tr_event_array with a guard page at the end.
   tr_event_array = reinterpret_cast<u32 *>(MmapNoReserveOrDie(
       sizeof(tr_event_array[0]) * kTrEventArrayMaxSize + GetMmapGranularity(),
       "CovInit::tr_event_array"));
-  Mprotect(reinterpret_cast<uptr>(&tr_event_array[kTrEventArrayMaxSize]),
-           GetMmapGranularity());
+  MprotectNoAccess(
+      reinterpret_cast<uptr>(&tr_event_array[kTrEventArrayMaxSize]),
   tr_event_array_size = kTrEventArrayMaxSize;
   tr_event_pointer = tr_event_array;
 
   num_8bit_counters = 0;
 }
 
 void CoverageData::InitializeGuardArray(s32 *guards) {
   Enable();  // Make sure coverage is enabled at this point.

lib/sanitizer_common/sanitizer_linux.cc

 
 #if SANITIZER_LINUX && defined(__x86_64__)
 #include "sanitizer_syscall_linux_x86_64.inc"
 #else
 #include "sanitizer_syscall_generic.inc"
 #endif
 
 // --------------- sanitizer_libc.h
 uptr internal_mmap(void *addr, uptr length, int prot, int flags, int fd,
                    u64 offset) {
 #if SANITIZER_FREEBSD || SANITIZER_LINUX_USES_64BIT_SYSCALLS
   return internal_syscall(SYSCALL(mmap), (uptr)addr, length, prot, flags, fd,
                           offset);
 #else
   // mmap2 specifies file offset in 4096-byte units.
   CHECK(IsAligned(offset, 4096));
   return internal_syscall(SYSCALL(mmap2), addr, length, prot, flags, fd,
                           offset / 4096);
 #endif
 }
 
 uptr internal_munmap(void *addr, uptr length) {
   return internal_syscall(SYSCALL(munmap), (uptr)addr, length);
 }
 
+int internal_mprotect(void *addr, uptr length, int prot) {
+  return internal_syscall(SYSCALL(mprotect), addr, length, prot);
+}
+
 uptr internal_close(fd_t fd) {
   return internal_syscall(SYSCALL(close), fd);
 }
 
 uptr internal_open(const char *filename, int flags) {
 #if SANITIZER_USES_CANONICAL_LINUX_SYSCALLS
   return internal_syscall(SYSCALL(openat), AT_FDCWD, (uptr)filename, flags);
 #else

lib/sanitizer_common/sanitizer_mac.cc

uptr internal_mmap(void *addr, size_t length, int prot, int flags,
                    int fd, u64 offset) {
   return (uptr)mmap(addr, length, prot, flags, fd, offset);
 }
 
 uptr internal_munmap(void *addr, uptr length) {
   return munmap(addr, length);
 }
 
+int internal_mprotect(void *addr, uptr length, int prot) {
+  return mprotect(addr, length, prot);
+}
+
 uptr internal_close(fd_t fd) {
   return close(fd);
 }
 
 uptr internal_open(const char *filename, int flags) {
   return open(filename, flags);
 }
 

lib/sanitizer_common/sanitizer_posix.h

 
 uptr internal_read(fd_t fd, void *buf, uptr count);
 uptr internal_write(fd_t fd, const void *buf, uptr count);
 
 // Memory
 uptr internal_mmap(void *addr, uptr length, int prot, int flags,
                    int fd, u64 offset);
 uptr internal_munmap(void *addr, uptr length);
+int internal_mprotect(void *addr, uptr length, int prot);
 
 // OS
 uptr internal_filesize(fd_t fd);  // -1 on error.
 uptr internal_stat(const char *path, void *buf);
 uptr internal_lstat(const char *path, void *buf);
 uptr internal_fstat(fd_t fd, void *buf);
 uptr internal_dup2(int oldfd, int newfd);
 uptr internal_readlink(const char *path, char *buf, uptr bufsize);

lib/sanitizer_common/sanitizer_posix.cc

Report("ERROR: %s failed to "
            "allocate 0x%zx (%zd) bytes at address %zx (errno: %d)\n",
            SanitizerToolName, size, size, fixed_addr, reserrno);
     CHECK("unable to mmap" && 0);
   }
   IncreaseTotalMmap(size);
   return (void *)p;
 }
 
-void *Mprotect(uptr fixed_addr, uptr size) {
+void *MmapNoAccess(uptr fixed_addr, uptr size) {
   return (void *)internal_mmap((void*)fixed_addr, size,
                                PROT_NONE,
                                MAP_PRIVATE | MAP_ANON | MAP_FIXED |
                                MAP_NORESERVE, -1, 0);
 }
 
+bool MprotectNoAccess(uptr addr, uptr size) {
+  return 0 == internal_mprotect((void*)addr, size, PROT_NONE);
+}
+
 fd_t OpenFile(const char *filename, FileAccessMode mode, error_t *errno_p) {
   int flags;
   switch (mode) {
     case RdOnly: flags = O_RDONLY; break;
     case WrOnly: flags = O_WRONLY | O_CREAT; break;
     case RdWr: flags = O_RDWR | O_CREAT; break;
   }
   fd_t res = internal_open(filename, flags, 0660);

lib/sanitizer_common/sanitizer_stoptheworld_linux_libcdep.cc

  public:
   explicit ScopedStackSpaceWithGuard(uptr stack_size) {
     stack_size_ = stack_size;
     guard_size_ = GetPageSizeCached();
     // FIXME: Omitting MAP_STACK here works in current kernels but might break
     // in the future.
     guard_start_ = (uptr)MmapOrDie(stack_size_ + guard_size_,
                                    "ScopedStackWithGuard");
-    CHECK_EQ(guard_start_, (uptr)Mprotect((uptr)guard_start_, guard_size_));
+    CHECK(MprotectNoAccess((uptr)guard_start_, guard_size_));
   }
   ~ScopedStackSpaceWithGuard() {
     UnmapOrDie((void *)guard_start_, stack_size_ + guard_size_);
   }
   void *Bottom() const {
     return (void *)(guard_start_ + stack_size_ + guard_size_);
   }
 

lib/sanitizer_common/sanitizer_win.cc

void *MmapFixedOrDie(uptr fixed_addr, uptr size) {
   return MmapFixedNoReserve(fixed_addr, size);
 }
 
 void *MmapNoReserveOrDie(uptr size, const char *mem_type) {
   // FIXME: make this really NoReserve?
   return MmapOrDie(size, mem_type);
 }
 
-void *Mprotect(uptr fixed_addr, uptr size) {
+void *MmapNoAccess(uptr fixed_addr, uptr size) {
   void *res = VirtualAlloc((LPVOID)fixed_addr, size,
                            MEM_RESERVE | MEM_COMMIT, PAGE_NOACCESS);
   if (res == 0)
     Report("WARNING: %s failed to "
            "mprotect %p (%zd) bytes at %p (error code: %d)\n",
            SanitizerToolName, size, size, fixed_addr, GetLastError());
   return res;
 }
 
+bool MprotectNoAccess(uptr addr, uptr size) {
+  DWORD old_protection;
+  return VirtualProtect((LPVOID)addr, size, PAGE_NOACCESS, &old_protection);
+}
+
+
 void FlushUnneededShadowMemory(uptr addr, uptr size) {
   // This is almost useless on 32-bits.
   // FIXME: add madvise-analog when we move to 64-bits.
 }
 
 void NoHugePagesInRegion(uptr addr, uptr size) {
   // FIXME: probably similar to FlushUnneededShadowMemory.
 }

lib/sanitizer_common/tests/sanitizer_stacktrace_test.cc

 
 static uptr PC(uptr idx) {
   return (1<<20) + idx;
 }
 
 void FastUnwindTest::SetUp() {
   size_t ps = GetPageSize();
   mapping = MmapOrDie(2 * ps, "FastUnwindTest");
-  Mprotect((uptr)mapping, ps);
+  MprotectNoAccess((uptr)mapping, ps);
 
   // Unwinder may peek 1 word down from the starting FP.
   fake_stack = (uhwptr *)((uptr)mapping + ps + sizeof(uhwptr));
 
   // Fill an array of pointers with fake fp+retaddr pairs.  Frame pointers have
   // even indices.
   for (uptr i = 0; i + 1 < fake_stack_size; i += 2) {
     fake_stack[i] = (uptr)&fake_stack[i+2];  // fp

lib/tsan/rtl/tsan_platform_linux.cc

 #endif
 }
 
 #ifndef SANITIZER_GO
 static void ProtectRange(uptr beg, uptr end) {
   CHECK_LE(beg, end);
   if (beg == end)
     return;
-  if (beg != (uptr)Mprotect(beg, end - beg)) {
+  if (beg != (uptr)MmapNoAccess(beg, end - beg)) {
     Printf("FATAL: ThreadSanitizer can not protect [%zx,%zx]\n", beg, end);
     Printf("FATAL: Make sure you are not using unlimited stack\n");
     Die();
   }
 }
 
 // Mark shadow for .rodata sections with the special kShadowRodata marker.
 // Accesses to .rodata can't race, so this saves time, memory and trace space.