[compiler-rt] r327696 - Mmap interceptor new option, Write Exec runtime detector

[Vitaly Buka via llvm-commits]

Author: vitalybuka
Date: Fri Mar 16 01:22:18 2018
New Revision: 327696

URL: http://llvm.org/viewvc/llvm-project?rev=327696&view=rev
Log:
Mmap interceptor new option, Write Exec runtime detector

Summary: Following-up the refactoring of mmap interceptors, adding a new common option to detect PROT_WRITE|PROT_EXEC pages request.

Patch by David CARLIER

Reviewers: vitalybuka, vsk

Reviewed By: vitalybuka

Subscribers: krytarowski, #sanitizers

Differential Revision: https://reviews.llvm.org/D44194

Added:
    compiler-rt/trunk/test/sanitizer_common/TestCases/Posix/mmap_write_exec.cpp
Modified:
    compiler-rt/trunk/lib/sanitizer_common/sanitizer_common.h
    compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_interceptors.inc
    compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_libcdep.cc
    compiler-rt/trunk/lib/sanitizer_common/sanitizer_flags.inc

Modified: compiler-rt/trunk/lib/sanitizer_common/sanitizer_common.h
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/sanitizer_common/sanitizer_common.h?rev=327696&r1=327695&r2=327696&view=diff
==============================================================================
--- compiler-rt/trunk/lib/sanitizer_common/sanitizer_common.h (original)
+++ compiler-rt/trunk/lib/sanitizer_common/sanitizer_common.h Fri Mar 16 01:22:18 2018
@@ -378,6 +378,8 @@ void ReportErrorSummary(const char *erro
 void ReportErrorSummary(const char *error_type, const StackTrace *trace,
                         const char *alt_tool_name = nullptr);
 
+void ReportMmapWriteExec();
+
 // Math
 #if SANITIZER_WINDOWS && !defined(__clang__) && !defined(__GNUC__)
 extern "C" {

Modified: compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_interceptors.inc
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_interceptors.inc?rev=327696&r1=327695&r2=327696&view=diff
==============================================================================
--- compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_interceptors.inc (original)
+++ compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_interceptors.inc Fri Mar 16 01:22:18 2018
@@ -6887,6 +6887,8 @@ INTERCEPTOR(SIZE_T, strlcat, char *dst,
 INTERCEPTOR(void *, mmap, void *addr, SIZE_T sz, int prot, int flags, int fd,
             OFF_T off) {
   void *ctx;
+  if (common_flags()->detect_write_exec)
+    ReportMmapWriteExec();
   if (COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED)
     return (void *)internal_mmap(addr, sz, prot, flags, fd, off);
   COMMON_INTERCEPTOR_ENTER(ctx, mmap, addr, sz, prot, flags, fd, off);
@@ -6901,6 +6903,8 @@ INTERCEPTOR(void *, mmap, void *addr, SI
 INTERCEPTOR(void *, mmap64, void *addr, SIZE_T sz, int prot, int flags, int fd,
             OFF64_T off) {
   void *ctx;
+  if (common_flags()->detect_write_exec)
+    ReportMmapWriteExec();
   if (COMMON_INTERCEPTOR_NOTHING_IS_INITIALIZED)
     return (void *)internal_mmap(addr, sz, prot, flags, fd, off);
   COMMON_INTERCEPTOR_ENTER(ctx, mmap64, addr, sz, prot, flags, fd, off);

Modified: compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_libcdep.cc
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_libcdep.cc?rev=327696&r1=327695&r2=327696&view=diff
==============================================================================
--- compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_libcdep.cc (original)
+++ compiler-rt/trunk/lib/sanitizer_common/sanitizer_common_libcdep.cc Fri Mar 16 01:22:18 2018
@@ -81,6 +81,32 @@ void ReportErrorSummary(const char *erro
 #endif
 }
 
+void ReportMmapWriteExec() {
+  ScopedErrorReportLock l;
+
+  SanitizerCommonDecorator d;
+
+#if !SANITIZER_GO
+  BufferedStackTrace stack;
+  uptr top = 0;
+  uptr bottom = 0;
+  GET_CALLER_PC_BP_SP;
+  (void)sp;
+  bool fast = common_flags()->fast_unwind_on_fatal;
+  if (fast)
+    GetThreadStackTopAndBottom(false, &top, &bottom);
+  stack.Unwind(kStackTraceMax, pc, bp, nullptr, top, bottom, fast);
+#endif
+
+  Printf("%s", d.Warning());
+  Report("WARNING: %s: writable-executable page usage\n", SanitizerToolName);
+  Printf("%s", d.Default());
+#if !SANITIZER_GO
+  stack.Print();
+  ReportErrorSummary("w-and-x-usage", &stack);
+#endif
+}
+
 static void (*SoftRssLimitExceededCallback)(bool exceeded);
 void SetSoftRssLimitExceededCallback(void (*Callback)(bool exceeded)) {
   CHECK_EQ(SoftRssLimitExceededCallback, nullptr);

Modified: compiler-rt/trunk/lib/sanitizer_common/sanitizer_flags.inc
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/lib/sanitizer_common/sanitizer_flags.inc?rev=327696&r1=327695&r2=327696&view=diff
==============================================================================
--- compiler-rt/trunk/lib/sanitizer_common/sanitizer_flags.inc (original)
+++ compiler-rt/trunk/lib/sanitizer_common/sanitizer_flags.inc Fri Mar 16 01:22:18 2018
@@ -240,3 +240,6 @@ COMMON_FLAG(bool, dump_instruction_bytes
 COMMON_FLAG(bool, dump_registers, true,
           "If true, dump values of CPU registers when SEGV happens. Only "
           "available on OS X for now.")
+COMMON_FLAG(bool, detect_write_exec, false,
+          "If true, triggers warning when writable-executable pages requests "
+          "are being made")

Added: compiler-rt/trunk/test/sanitizer_common/TestCases/Posix/mmap_write_exec.cpp
URL: http://llvm.org/viewvc/llvm-project/compiler-rt/trunk/test/sanitizer_common/TestCases/Posix/mmap_write_exec.cpp?rev=327696&view=auto
==============================================================================
--- compiler-rt/trunk/test/sanitizer_common/TestCases/Posix/mmap_write_exec.cpp (added)
+++ compiler-rt/trunk/test/sanitizer_common/TestCases/Posix/mmap_write_exec.cpp Fri Mar 16 01:22:18 2018
@@ -0,0 +1,12 @@
+// RUN: %clangxx %s -o %t
+// RUN: %env_tool_opts=detect_write_exec=1 %run %t 2>&1 | FileCheck %s
+// ubsan and lsan do not install mmap interceptors
+// UNSUPPORTED: ubsan, lsan
+
+#include <sys/mman.h>
+
+int main(int argc, char **argv) {
+  char *p = (char *)mmap(0, 1024, PROT_READ | PROT_WRITE | PROT_EXEC,
+                         MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+  // CHECK: WARNING: {{.*}}Sanitizer: writable-executable page usage
+}