[compiler-rt] problem #77737 Fix a possible null dereference (PR #78985)
via llvm-commits
llvm-commits at lists.llvm.org
Mon Jan 22 06:52:59 PST 2024
llvmbot wrote:
<!--LLVM PR SUMMARY COMMENT-->
@llvm/pr-subscribers-compiler-rt-sanitizer
Author: None (harbandana)
<details>
<summary>Changes</summary>
---
Patch is 79.46 KiB, truncated to 20.00 KiB below, full version: https://github.com/llvm/llvm-project/pull/78985.diff
1 Files Affected:
- (modified) compiler-rt/lib/hwasan/hwasan_report.cpp (+1096-1100)
``````````diff
diff --git a/compiler-rt/lib/hwasan/hwasan_report.cpp b/compiler-rt/lib/hwasan/hwasan_report.cpp
index 784cfb904aa275..6765888ce7a7ac 100644
--- a/compiler-rt/lib/hwasan/hwasan_report.cpp
+++ b/compiler-rt/lib/hwasan/hwasan_report.cpp
@@ -1,1100 +1,1096 @@
-//===-- hwasan_report.cpp -------------------------------------------------===//
-//
-// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
-// See https://llvm.org/LICENSE.txt for license information.
-// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
-//
-//===----------------------------------------------------------------------===//
-//
-// This file is a part of HWAddressSanitizer.
-//
-// Error reporting.
-//===----------------------------------------------------------------------===//
-
-#include "hwasan_report.h"
-
-#include <dlfcn.h>
-
-#include "hwasan.h"
-#include "hwasan_allocator.h"
-#include "hwasan_globals.h"
-#include "hwasan_mapping.h"
-#include "hwasan_thread.h"
-#include "hwasan_thread_list.h"
-#include "sanitizer_common/sanitizer_allocator_internal.h"
-#include "sanitizer_common/sanitizer_array_ref.h"
-#include "sanitizer_common/sanitizer_common.h"
-#include "sanitizer_common/sanitizer_flags.h"
-#include "sanitizer_common/sanitizer_internal_defs.h"
-#include "sanitizer_common/sanitizer_mutex.h"
-#include "sanitizer_common/sanitizer_report_decorator.h"
-#include "sanitizer_common/sanitizer_stackdepot.h"
-#include "sanitizer_common/sanitizer_stacktrace_printer.h"
-#include "sanitizer_common/sanitizer_symbolizer.h"
-
-using namespace __sanitizer;
-
-namespace __hwasan {
-
-class ScopedReport {
- public:
- explicit ScopedReport(bool fatal) : fatal(fatal) {
- Lock lock(&error_message_lock_);
- error_message_ptr_ = fatal ? &error_message_ : nullptr;
- ++hwasan_report_count;
- }
-
- ~ScopedReport() {
- void (*report_cb)(const char *);
- {
- Lock lock(&error_message_lock_);
- report_cb = error_report_callback_;
- error_message_ptr_ = nullptr;
- }
- if (report_cb)
- report_cb(error_message_.data());
- if (fatal)
- SetAbortMessage(error_message_.data());
- if (common_flags()->print_module_map >= 2 ||
- (fatal && common_flags()->print_module_map))
- DumpProcessMap();
- if (fatal)
- Die();
- }
-
- static void MaybeAppendToErrorMessage(const char *msg) {
- Lock lock(&error_message_lock_);
- if (!error_message_ptr_)
- return;
- error_message_ptr_->Append(msg);
- }
-
- static void SetErrorReportCallback(void (*callback)(const char *)) {
- Lock lock(&error_message_lock_);
- error_report_callback_ = callback;
- }
-
- private:
- InternalScopedString error_message_;
- bool fatal;
-
- static Mutex error_message_lock_;
- static InternalScopedString *error_message_ptr_
- SANITIZER_GUARDED_BY(error_message_lock_);
- static void (*error_report_callback_)(const char *);
-};
-
-Mutex ScopedReport::error_message_lock_;
-InternalScopedString *ScopedReport::error_message_ptr_;
-void (*ScopedReport::error_report_callback_)(const char *);
-
-// If there is an active ScopedReport, append to its error message.
-void AppendToErrorMessageBuffer(const char *buffer) {
- ScopedReport::MaybeAppendToErrorMessage(buffer);
-}
-
-static StackTrace GetStackTraceFromId(u32 id) {
- CHECK(id);
- StackTrace res = StackDepotGet(id);
- CHECK(res.trace);
- return res;
-}
-
-static void MaybePrintAndroidHelpUrl() {
-#if SANITIZER_ANDROID
- Printf(
- "Learn more about HWASan reports: "
- "https://source.android.com/docs/security/test/memory-safety/"
- "hwasan-reports\n");
-#endif
-}
-
-namespace {
-// A RAII object that holds a copy of the current thread stack ring buffer.
-// The actual stack buffer may change while we are iterating over it (for
-// example, Printf may call syslog() which can itself be built with hwasan).
-class SavedStackAllocations {
- public:
- SavedStackAllocations() = default;
-
- explicit SavedStackAllocations(Thread *t) { CopyFrom(t); }
-
- void CopyFrom(Thread *t) {
- StackAllocationsRingBuffer *rb = t->stack_allocations();
- uptr size = rb->size() * sizeof(uptr);
- void *storage =
- MmapAlignedOrDieOnFatalError(size, size * 2, "saved stack allocations");
- new (&rb_) StackAllocationsRingBuffer(*rb, storage);
- thread_id_ = t->unique_id();
- }
-
- ~SavedStackAllocations() {
- if (rb_) {
- StackAllocationsRingBuffer *rb = get();
- UnmapOrDie(rb->StartOfStorage(), rb->size() * sizeof(uptr));
- }
- }
-
- const StackAllocationsRingBuffer *get() const {
- return (const StackAllocationsRingBuffer *)&rb_;
- }
-
- StackAllocationsRingBuffer *get() {
- return (StackAllocationsRingBuffer *)&rb_;
- }
-
- u32 thread_id() const { return thread_id_; }
-
- private:
- uptr rb_ = 0;
- u32 thread_id_;
-};
-
-class Decorator: public __sanitizer::SanitizerCommonDecorator {
- public:
- Decorator() : SanitizerCommonDecorator() { }
- const char *Access() { return Blue(); }
- const char *Allocation() const { return Magenta(); }
- const char *Origin() const { return Magenta(); }
- const char *Name() const { return Green(); }
- const char *Location() { return Green(); }
- const char *Thread() { return Green(); }
-};
-} // namespace
-
-static bool FindHeapAllocation(HeapAllocationsRingBuffer *rb, uptr tagged_addr,
- HeapAllocationRecord *har, uptr *ring_index,
- uptr *num_matching_addrs,
- uptr *num_matching_addrs_4b) {
- if (!rb) return false;
-
- *num_matching_addrs = 0;
- *num_matching_addrs_4b = 0;
- for (uptr i = 0, size = rb->size(); i < size; i++) {
- auto h = (*rb)[i];
- if (h.tagged_addr <= tagged_addr &&
- h.tagged_addr + h.requested_size > tagged_addr) {
- *har = h;
- *ring_index = i;
- return true;
- }
-
- // Measure the number of heap ring buffer entries that would have matched
- // if we had only one entry per address (e.g. if the ring buffer data was
- // stored at the address itself). This will help us tune the allocator
- // implementation for MTE.
- if (UntagAddr(h.tagged_addr) <= UntagAddr(tagged_addr) &&
- UntagAddr(h.tagged_addr) + h.requested_size > UntagAddr(tagged_addr)) {
- ++*num_matching_addrs;
- }
-
- // Measure the number of heap ring buffer entries that would have matched
- // if we only had 4 tag bits, which is the case for MTE.
- auto untag_4b = [](uptr p) {
- return p & ((1ULL << 60) - 1);
- };
- if (untag_4b(h.tagged_addr) <= untag_4b(tagged_addr) &&
- untag_4b(h.tagged_addr) + h.requested_size > untag_4b(tagged_addr)) {
- ++*num_matching_addrs_4b;
- }
- }
- return false;
-}
-
-static void PrintStackAllocations(const StackAllocationsRingBuffer *sa,
- tag_t addr_tag, uptr untagged_addr) {
- uptr frames = Min((uptr)flags()->stack_history_size, sa->size());
- bool found_local = false;
- InternalScopedString location;
- for (uptr i = 0; i < frames; i++) {
- const uptr *record_addr = &(*sa)[i];
- uptr record = *record_addr;
- if (!record)
- break;
- tag_t base_tag =
- reinterpret_cast<uptr>(record_addr) >> kRecordAddrBaseTagShift;
- uptr fp = (record >> kRecordFPShift) << kRecordFPLShift;
- uptr pc_mask = (1ULL << kRecordFPShift) - 1;
- uptr pc = record & pc_mask;
- FrameInfo frame;
- if (Symbolizer::GetOrInit()->SymbolizeFrame(pc, &frame)) {
- for (LocalInfo &local : frame.locals) {
- if (!local.has_frame_offset || !local.has_size || !local.has_tag_offset)
- continue;
- if (!(local.name && internal_strlen(local.name)) &&
- !(local.function_name && internal_strlen(local.name)) &&
- !(local.decl_file && internal_strlen(local.decl_file)))
- continue;
- tag_t obj_tag = base_tag ^ local.tag_offset;
- if (obj_tag != addr_tag)
- continue;
- // Guess top bits of local variable from the faulting address, because
- // we only store bits 4-19 of FP (bits 0-3 are guaranteed to be zero).
- uptr local_beg = (fp + local.frame_offset) |
- (untagged_addr & ~(uptr(kRecordFPModulus) - 1));
- uptr local_end = local_beg + local.size;
-
- if (!found_local) {
- Printf("\nPotentially referenced stack objects:\n");
- found_local = true;
- }
-
- uptr offset;
- const char *whence;
- const char *cause;
- if (local_beg <= untagged_addr && untagged_addr < local_end) {
- offset = untagged_addr - local_beg;
- whence = "inside";
- cause = "use-after-scope";
- } else if (untagged_addr >= local_end) {
- offset = untagged_addr - local_end;
- whence = "after";
- cause = "stack-buffer-overflow";
- } else {
- offset = local_beg - untagged_addr;
- whence = "before";
- cause = "stack-buffer-overflow";
- }
- Decorator d;
- Printf("%s", d.Error());
- Printf("Cause: %s\n", cause);
- Printf("%s", d.Default());
- Printf("%s", d.Location());
- StackTracePrinter::GetOrInit()->RenderSourceLocation(
- &location, local.decl_file, local.decl_line, /* column= */ 0,
- common_flags()->symbolize_vs_style,
- common_flags()->strip_path_prefix);
- Printf(
- "%p is located %zd bytes %s a %zd-byte local variable %s [%p,%p) "
- "in %s %s\n",
- untagged_addr, offset, whence, local_end - local_beg, local.name,
- local_beg, local_end, local.function_name, location.data());
- location.clear();
- Printf("%s\n", d.Default());
- }
- frame.Clear();
- }
- }
-
- if (found_local)
- return;
-
- // We didn't find any locals. Most likely we don't have symbols, so dump
- // the information that we have for offline analysis.
- InternalScopedString frame_desc;
- Printf("Previously allocated frames:\n");
- for (uptr i = 0; i < frames; i++) {
- const uptr *record_addr = &(*sa)[i];
- uptr record = *record_addr;
- if (!record)
- break;
- uptr pc_mask = (1ULL << 48) - 1;
- uptr pc = record & pc_mask;
- frame_desc.AppendF(" record_addr:0x%zx record:0x%zx",
- reinterpret_cast<uptr>(record_addr), record);
- SymbolizedStackHolder symbolized_stack(
- Symbolizer::GetOrInit()->SymbolizePC(pc));
- const SymbolizedStack *frame = symbolized_stack.get();
- if (frame) {
- StackTracePrinter::GetOrInit()->RenderFrame(
- &frame_desc, " %F %L", 0, frame->info.address, &frame->info,
- common_flags()->symbolize_vs_style,
- common_flags()->strip_path_prefix);
- }
- Printf("%s\n", frame_desc.data());
- frame_desc.clear();
- }
-}
-
-// Returns true if tag == *tag_ptr, reading tags from short granules if
-// necessary. This may return a false positive if tags 1-15 are used as a
-// regular tag rather than a short granule marker.
-static bool TagsEqual(tag_t tag, tag_t *tag_ptr) {
- if (tag == *tag_ptr)
- return true;
- if (*tag_ptr == 0 || *tag_ptr > kShadowAlignment - 1)
- return false;
- uptr mem = ShadowToMem(reinterpret_cast<uptr>(tag_ptr));
- tag_t inline_tag = *reinterpret_cast<tag_t *>(mem + kShadowAlignment - 1);
- return tag == inline_tag;
-}
-
-// HWASan globals store the size of the global in the descriptor. In cases where
-// we don't have a binary with symbols, we can't grab the size of the global
-// from the debug info - but we might be able to retrieve it from the
-// descriptor. Returns zero if the lookup failed.
-static uptr GetGlobalSizeFromDescriptor(uptr ptr) {
- // Find the ELF object that this global resides in.
- Dl_info info;
- if (dladdr(reinterpret_cast<void *>(ptr), &info) == 0)
- return 0;
- auto *ehdr = reinterpret_cast<const ElfW(Ehdr) *>(info.dli_fbase);
- auto *phdr_begin = reinterpret_cast<const ElfW(Phdr) *>(
- reinterpret_cast<const u8 *>(ehdr) + ehdr->e_phoff);
-
- // Get the load bias. This is normally the same as the dli_fbase address on
- // position-independent code, but can be different on non-PIE executables,
- // binaries using LLD's partitioning feature, or binaries compiled with a
- // linker script.
- ElfW(Addr) load_bias = 0;
- for (const auto &phdr :
- ArrayRef<const ElfW(Phdr)>(phdr_begin, phdr_begin + ehdr->e_phnum)) {
- if (phdr.p_type != PT_LOAD || phdr.p_offset != 0)
- continue;
- load_bias = reinterpret_cast<ElfW(Addr)>(ehdr) - phdr.p_vaddr;
- break;
- }
-
- // Walk all globals in this ELF object, looking for the one we're interested
- // in. Once we find it, we can stop iterating and return the size of the
- // global we're interested in.
- for (const hwasan_global &global :
- HwasanGlobalsFor(load_bias, phdr_begin, ehdr->e_phnum))
- if (global.addr() <= ptr && ptr < global.addr() + global.size())
- return global.size();
-
- return 0;
-}
-
-void ReportStats() {}
-
-constexpr uptr kDumpWidth = 16;
-constexpr uptr kShadowLines = 17;
-constexpr uptr kShadowDumpSize = kShadowLines * kDumpWidth;
-
-constexpr uptr kShortLines = 3;
-constexpr uptr kShortDumpSize = kShortLines * kDumpWidth;
-constexpr uptr kShortDumpOffset = (kShadowLines - kShortLines) / 2 * kDumpWidth;
-
-static uptr GetPrintTagStart(uptr addr) {
- addr = MemToShadow(addr);
- addr = RoundDownTo(addr, kDumpWidth);
- addr -= kDumpWidth * (kShadowLines / 2);
- return addr;
-}
-
-template <typename PrintTag>
-static void PrintTagInfoAroundAddr(uptr addr, uptr num_rows,
- InternalScopedString &s,
- PrintTag print_tag) {
- uptr center_row_beg = RoundDownTo(addr, kDumpWidth);
- uptr beg_row = center_row_beg - kDumpWidth * (num_rows / 2);
- uptr end_row = center_row_beg + kDumpWidth * ((num_rows + 1) / 2);
- for (uptr row = beg_row; row < end_row; row += kDumpWidth) {
- s.Append(row == center_row_beg ? "=>" : " ");
- s.AppendF("%p:", (void *)ShadowToMem(row));
- for (uptr i = 0; i < kDumpWidth; i++) {
- s.Append(row + i == addr ? "[" : " ");
- print_tag(s, row + i);
- s.Append(row + i == addr ? "]" : " ");
- }
- s.AppendF("\n");
- }
-}
-
-template <typename GetTag, typename GetShortTag>
-static void PrintTagsAroundAddr(uptr addr, GetTag get_tag,
- GetShortTag get_short_tag) {
- InternalScopedString s;
- addr = MemToShadow(addr);
- s.AppendF(
- "\nMemory tags around the buggy address (one tag corresponds to %zd "
- "bytes):\n",
- kShadowAlignment);
- PrintTagInfoAroundAddr(addr, kShadowLines, s,
- [&](InternalScopedString &s, uptr tag_addr) {
- tag_t tag = get_tag(tag_addr);
- s.AppendF("%02x", tag);
- });
-
- s.AppendF(
- "Tags for short granules around the buggy address (one tag corresponds "
- "to %zd bytes):\n",
- kShadowAlignment);
- PrintTagInfoAroundAddr(addr, kShortLines, s,
- [&](InternalScopedString &s, uptr tag_addr) {
- tag_t tag = get_tag(tag_addr);
- if (tag >= 1 && tag <= kShadowAlignment) {
- tag_t short_tag = get_short_tag(tag_addr);
- s.AppendF("%02x", short_tag);
- } else {
- s.AppendF("..");
- }
- });
- s.AppendF(
- "See "
- "https://clang.llvm.org/docs/"
- "HardwareAssistedAddressSanitizerDesign.html#short-granules for a "
- "description of short granule tags\n");
- Printf("%s", s.data());
-}
-
-static uptr GetTopPc(const StackTrace *stack) {
- return stack->size ? StackTrace::GetPreviousInstructionPc(stack->trace[0])
- : 0;
-}
-
-namespace {
-class BaseReport {
- public:
- BaseReport(StackTrace *stack, bool fatal, uptr tagged_addr, uptr access_size)
- : scoped_report(fatal),
- stack(stack),
- tagged_addr(tagged_addr),
- access_size(access_size),
- untagged_addr(UntagAddr(tagged_addr)),
- ptr_tag(GetTagFromPointer(tagged_addr)),
- mismatch_offset(FindMismatchOffset()),
- heap(CopyHeapChunk()),
- allocations(CopyAllocations()),
- candidate(FindBufferOverflowCandidate()),
- shadow(CopyShadow()) {}
-
- protected:
- struct OverflowCandidate {
- uptr untagged_addr = 0;
- bool after = false;
- bool is_close = false;
-
- struct {
- uptr begin = 0;
- uptr end = 0;
- u32 thread_id = 0;
- u32 stack_id = 0;
- bool is_allocated = false;
- } heap;
- };
-
- struct HeapAllocation {
- HeapAllocationRecord har = {};
- uptr ring_index = 0;
- uptr num_matching_addrs = 0;
- uptr num_matching_addrs_4b = 0;
- u32 free_thread_id = 0;
- };
-
- struct Allocations {
- ArrayRef<SavedStackAllocations> stack;
- ArrayRef<HeapAllocation> heap;
- };
-
- struct HeapChunk {
- uptr begin = 0;
- uptr size = 0;
- u32 stack_id = 0;
- bool from_small_heap = false;
- bool is_allocated = false;
- };
-
- struct Shadow {
- uptr addr = 0;
- tag_t tags[kShadowDumpSize] = {};
- tag_t short_tags[kShortDumpSize] = {};
- };
-
- sptr FindMismatchOffset() const;
- Shadow CopyShadow() const;
- tag_t GetTagCopy(uptr addr) const;
- tag_t GetShortTagCopy(uptr addr) const;
- HeapChunk CopyHeapChunk() const;
- Allocations CopyAllocations();
- OverflowCandidate FindBufferOverflowCandidate() const;
- void PrintAddressDescription() const;
- void PrintHeapOrGlobalCandidate() const;
- void PrintTags(uptr addr) const;
-
- SavedStackAllocations stack_allocations_storage[16];
- HeapAllocation heap_allocations_storage[256];
-
- const ScopedReport scoped_report;
- const StackTrace *stack = nullptr;
- const uptr tagged_addr = 0;
- const uptr access_size = 0;
- const uptr untagged_addr = 0;
- const tag_t ptr_tag = 0;
- const sptr mismatch_offset = 0;
-
- const HeapChunk heap;
- const Allocations allocations;
- const OverflowCandidate candidate;
-
- const Shadow shadow;
-};
-
-sptr BaseReport::FindMismatchOffset() const {
- if (!access_size)
- return 0;
- sptr offset =
- __hwasan_test_shadow(reinterpret_cast<void *>(tagged_addr), access_size);
- CHECK_GE(offset, 0);
- CHECK_LT(offset, static_cast<sptr>(access_size));
- tag_t *tag_ptr =
- reinterpret_cast<tag_t *>(MemToShadow(untagged_addr + offset));
- tag_t mem_tag = *tag_ptr;
-
- if (mem_tag && mem_tag < kShadowAlignment) {
- tag_t *granule_ptr = reinterpret_cast<tag_t *>((untagged_addr + offset) &
- ~(kShadowAlignment - 1));
- // If offset is 0, (untagged_addr + offset) is not aligned to granules.
- // This is the offset of the leftmost accessed byte within the bad granule.
- u8 in_granule_offset = (untagged_addr + offset) & (kShadowAlignment - 1);
- tag_t short_tag = granule_ptr[kShadowAlignment - 1];
- // The first mismatch was a short granule that matched the ptr_tag.
- if (short_tag == ptr_tag) {
- // If the access starts after the end of the short granule, then the first
- // bad byte is the first byte of the access; otherwise it is the first
- // byte past the end of the short granule
- if (mem_tag > in_granule_offset) {
- offset += mem_tag - in_granule_offset;
- }
- }
- }
- return offset;
-}
-
-BaseReport::Shadow BaseReport::CopyShadow() const {
- Shadow result;
- if (!MemIsApp(untagged_addr))
- return result;
-
- result.addr = GetPrintTagStart(untagged_addr + mismatch_offset);
- uptr tag_addr = result.addr;
- uptr short_end = kShortDumpOffset + ARRAY_SIZE(shadow.short_tags);
- for (uptr i = 0; i < ARRAY_SIZE(result.tags); ++i, ++tag_addr) {
- if (!MemIsShadow(tag_addr))
- continue;
- result.tags[i] = *reinterpret_cast<tag_t *>(tag_addr);
- if (i < kShortDumpOffset || i >= short_end)
- continue;
- uptr granule_addr = ShadowToMem(tag_addr);
- if (1 <= result.tags[i] && result.tags[i] <= kShadowAlignment &&
- IsAccessibleMemoryRange(granule_addr, kShadowAlignment)) {
- result.short_tags[i - kShortDumpOffset...
[truncated]
``````````
</details>
https://github.com/llvm/llvm-project/pull/78985
More information about the llvm-commits
mailing list