[llvm] [Support][Memory] Add memfd based fallback for strict W^X Linux systems (PR #98538)
via llvm-commits
llvm-commits at lists.llvm.org
Wed Jul 24 04:38:57 PDT 2024
https://github.com/minipli-oss updated https://github.com/llvm/llvm-project/pull/98538
>From 3a22789bd1dc4cdffccfc008aea93fc8a56245d4 Mon Sep 17 00:00:00 2001
From: Mathias Krause <minipli at grsecurity.net>
Date: Wed, 3 Jul 2024 22:01:37 +0200
Subject: [PATCH 1/4] [Support][Memory] Add memfd based fallback for strict W^X
Linux systems
PaX's MPROTECT feature as well as SELinux's deny_execmem policy prevent
a transition from a once writable memory mapping to an executable one.
This obviously breaks JIT code generation.
As both of these are Linux specific and the Linux kernel gained memfd
support almost 10 years ago in v3.17, making use of it to implement a
fallback seems like a viable option to get JIT code generation fixed
for such systems.
Implement a detour through a memfd for systems that are detected to deny
the W<->X transition of memory mappings. For PaX this can be easily
achieved by evaluating the per-process PaX flags, if access to
/proc/self/status is available. For others, and as a fallback for PaX, a
runtime test is done once.
This enables such systems to make use of JIT code generation without
completely abandoning their W^X policy.
Signed-off-by: Mathias Krause <minipli at grsecurity.net>
---
llvm/lib/Support/Unix/Memory.inc | 62 ++++++++++++++-
llvm/lib/Support/Unix/MemoryLinux.h | 105 ++++++++++++++++++++++++++
llvm/unittests/Support/MemoryTest.cpp | 6 ++
3 files changed, 170 insertions(+), 3 deletions(-)
create mode 100644 llvm/lib/Support/Unix/MemoryLinux.h
diff --git a/llvm/lib/Support/Unix/Memory.inc b/llvm/lib/Support/Unix/Memory.inc
index bac208a7d543c..f894e24ea2919 100644
--- a/llvm/lib/Support/Unix/Memory.inc
+++ b/llvm/lib/Support/Unix/Memory.inc
@@ -18,6 +18,10 @@
#include "llvm/Support/Process.h"
#include "llvm/Support/Valgrind.h"
+#ifdef __linux__
+#include "MemoryLinux.h"
+#endif
+
#ifdef HAVE_SYS_MMAN_H
#include <sys/mman.h>
#endif
@@ -177,6 +181,55 @@ std::error_code Memory::protectMappedMemory(const MemoryBlock &M,
alignAddr((const uint8_t *)M.Address + M.AllocatedSize, PageSize);
bool InvalidateCache = (Flags & MF_EXEC);
+ bool SkipMprotect = false;
+
+#if defined(__linux__)
+ // Check for cases where the EXEC protection flag changes and a possible
+ // strict W^X policy cannot be bypassed via mprotect() alone, e.g. under
+ // PaX's MPROTECT or SELinux's deny_execmem.
+ //
+ // To support such systems, we need to create a fresh mapping with the
+ // target protection flags.
+ if ((M.Flags ^ Flags) & MF_EXEC && execProtChangeNeedsNewMapping()) {
+ class FDWrapper {
+ public:
+ FDWrapper(int fd) : fd(fd) {}
+ ~FDWrapper() { ::close(fd); }
+ operator int() const { return fd; }
+ private:
+ int fd;
+ } fd(memfd_create("llvm", MFD_CLOEXEC));
+
+ if (fd < 0)
+ return errnoAsErrorCode();
+
+ const char *data = reinterpret_cast<char *>(Start);
+ uintptr_t len = End - Start;
+ uintptr_t left = len;
+
+ while (left) {
+ ssize_t cnt = ::write(fd, data, left);
+ if (cnt < 0) {
+ if (errno == EINTR)
+ continue;
+
+ return errnoAsErrorCode();
+ }
+ left -= cnt;
+ data += cnt;
+ }
+
+ void *addr = ::mmap(reinterpret_cast<void *>(Start), len, Protect,
+ MAP_PRIVATE | MAP_FIXED, fd, 0);
+ if (addr == MAP_FAILED)
+ return errnoAsErrorCode();
+
+ // We created a new mapping with the final protection bits, therefore
+ // don't need to call mprotect() with the very same flags again -- unless
+ // we have to toggle PROT_READ for ARM.
+ SkipMprotect = true;
+ }
+#endif
#if defined(__arm__) || defined(__aarch64__)
// Certain ARM implementations treat icache clear instruction as a memory
@@ -190,13 +243,16 @@ std::error_code Memory::protectMappedMemory(const MemoryBlock &M,
Memory::InvalidateInstructionCache(M.Address, M.AllocatedSize);
InvalidateCache = false;
+ SkipMprotect = false;
}
#endif
- int Result = ::mprotect((void *)Start, End - Start, Protect);
+ if (!SkipMprotect) {
+ int Result = ::mprotect((void *)Start, End - Start, Protect);
- if (Result != 0)
- return errnoAsErrorCode();
+ if (Result != 0)
+ return errnoAsErrorCode();
+ }
if (InvalidateCache)
Memory::InvalidateInstructionCache(M.Address, M.AllocatedSize);
diff --git a/llvm/lib/Support/Unix/MemoryLinux.h b/llvm/lib/Support/Unix/MemoryLinux.h
new file mode 100644
index 0000000000000..846b67dae4527
--- /dev/null
+++ b/llvm/lib/Support/Unix/MemoryLinux.h
@@ -0,0 +1,105 @@
+//===- Unix/MemoryLinux.h - Linux specific Helper Fuctions ------*- C++ -*-===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+//
+// This file defines Linux specific helper functions for memory management.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_LIB_SUPPORT_UNIX_MEMORYLINUX_H
+#define LLVM_LIB_SUPPORT_UNIX_MEMORYLINUX_H
+
+#ifndef __linux__
+#error Linux only support header!
+#endif
+
+#include "llvm/Support/Process.h"
+
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#include <sys/mman.h>
+#include <sys/syscall.h>
+
+#ifndef MFD_CLOEXEC
+#define MFD_CLOEXEC 1U
+#endif
+
+namespace llvm {
+namespace sys {
+namespace {
+
+static inline bool isPermissionError(int err) {
+ // PaX uses EPERM, SELinux uses EACCES
+ return err == EPERM || err == EACCES;
+}
+
+// FIXME: Make this either more low-level C'ish or C++'ish
+static inline bool execProtChangeNeedsNewMapping() {
+ static int status = -1;
+
+ if (status != -1)
+ return status;
+
+ // Try to get the status from /proc/self/status, looking for PaX flags.
+ FILE *f = fopen("/proc/self/status", "re");
+ if (f) {
+ char *buf = NULL;
+ size_t len;
+
+ while (getline(&buf, &len, f) != -1) {
+ if (strncmp(buf, "PaX:", 4))
+ continue;
+
+ // Look for 'm', indicating PaX MPROTECT is disabled.
+ status = !strchr(buf + 4, 'm');
+ break;
+ }
+
+ fclose(f);
+ free(buf);
+
+ if (status != -1)
+ return status;
+ }
+
+ // Create a temporary writable mapping and try to make it executable. If
+ // this fails, test 'errno' to ensure it failed because we were not allowed
+ // to create such a mapping and not because of some transient error.
+ size_t size = Process::getPageSizeEstimate();
+ void *addr = ::mmap(NULL, size, PROT_READ | PROT_WRITE,
+ MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+ if (addr == MAP_FAILED) {
+ // Must be low on memory or have too many mappings already, not much we can
+ // do here.
+ status = 0;
+ } else {
+ if (::mprotect(addr, size, PROT_READ | PROT_EXEC) < 0)
+ status = isPermissionError(errno);
+ else
+ status = 0;
+ ::munmap(addr, size);
+ }
+
+ return status;
+}
+
+static inline int memfd_create(const char *name, int flags) {
+#ifdef SYS_memfd_create
+ return syscall(SYS_memfd_create, name, flags);
+#else
+ return -1;
+#endif
+}
+
+} // anonymous namespace
+} // namespace sys
+} // namespace llvm
+
+#endif
diff --git a/llvm/unittests/Support/MemoryTest.cpp b/llvm/unittests/Support/MemoryTest.cpp
index 9daa6d0ff9e4d..dbee1b62b25d1 100644
--- a/llvm/unittests/Support/MemoryTest.cpp
+++ b/llvm/unittests/Support/MemoryTest.cpp
@@ -11,6 +11,10 @@
#include "gtest/gtest.h"
#include <cstdlib>
+#if defined(__linux__)
+#include "../lib/Support/Unix/MemoryLinux.h"
+#endif
+
#if defined(__NetBSD__)
// clang-format off
#include <sys/param.h>
@@ -40,6 +44,8 @@ bool IsMPROTECT() {
err(EXIT_FAILURE, "sysctl");
return !!(paxflags & CTL_PROC_PAXFLAGS_MPROTECT);
+#elif defined(__linux__)
+ return execProtChangeNeedsNewMapping();
#elif (defined(__APPLE__) && defined(__aarch64__)) || defined(__OpenBSD__)
return true;
#else
>From b4fd3785bca2e48829c82125788b78cbc2927767 Mon Sep 17 00:00:00 2001
From: Mathias Krause <minipli at grsecurity.net>
Date: Wed, 24 Jul 2024 09:52:32 +0200
Subject: [PATCH 2/4] Minor fixes
- set errno if SYS_memfd_create is unknown so error handling actually
works in this case
- try making use of MFD_EXEC as demanded by recent kernels
---
llvm/lib/Support/Unix/Memory.inc | 18 ++++++++++++++++--
llvm/lib/Support/Unix/MemoryLinux.h | 6 +++++-
2 files changed, 21 insertions(+), 3 deletions(-)
diff --git a/llvm/lib/Support/Unix/Memory.inc b/llvm/lib/Support/Unix/Memory.inc
index f894e24ea2919..b3d8f78797541 100644
--- a/llvm/lib/Support/Unix/Memory.inc
+++ b/llvm/lib/Support/Unix/Memory.inc
@@ -191,14 +191,28 @@ std::error_code Memory::protectMappedMemory(const MemoryBlock &M,
// To support such systems, we need to create a fresh mapping with the
// target protection flags.
if ((M.Flags ^ Flags) & MF_EXEC && execProtChangeNeedsNewMapping()) {
+ static unsigned int flags = MFD_CLOEXEC | MFD_EXEC;
class FDWrapper {
public:
FDWrapper(int fd) : fd(fd) {}
- ~FDWrapper() { ::close(fd); }
+ ~FDWrapper() { close(); }
+ FDWrapper& operator=(int nfd) { close(); fd = nfd; return *this; }
operator int() const { return fd; }
private:
+ void close() { if (fd >= 0) ::close(fd); fd = -1; }
int fd;
- } fd(memfd_create("llvm", MFD_CLOEXEC));
+ } fd(memfd_create("llvm", flags));
+
+ // The initial version of memfd_create() created executable fds by default.
+ // Since Linux v6.3 the default behaviour depends on a sysctl setting
+ // 'vm.memfd_noexec', requiring users to explicitly request the executable
+ // status by passing MFD_EXEC in the flags. This flag will be rejected by
+ // earlier kernels with EINVAL. Simply retry without the flag in this case,
+ // as mappings will be executable by default on these kernels.
+ if (fd < 0 && errno == EINVAL && (flags & MFD_EXEC)) {
+ flags &= ~MFD_EXEC;
+ fd = memfd_create("llvm", flags);
+ }
if (fd < 0)
return errnoAsErrorCode();
diff --git a/llvm/lib/Support/Unix/MemoryLinux.h b/llvm/lib/Support/Unix/MemoryLinux.h
index 846b67dae4527..9a60882f6c47a 100644
--- a/llvm/lib/Support/Unix/MemoryLinux.h
+++ b/llvm/lib/Support/Unix/MemoryLinux.h
@@ -28,7 +28,10 @@
#include <sys/syscall.h>
#ifndef MFD_CLOEXEC
-#define MFD_CLOEXEC 1U
+#define MFD_CLOEXEC 0x0001U
+#endif
+#ifndef MFD_EXEC
+#define MFD_EXEC 0x0010U
#endif
namespace llvm {
@@ -94,6 +97,7 @@ static inline int memfd_create(const char *name, int flags) {
#ifdef SYS_memfd_create
return syscall(SYS_memfd_create, name, flags);
#else
+ errno = ENOSYS;
return -1;
#endif
}
>From 8942359145b9afe011c2e63d9fa219e1b0eb4c56 Mon Sep 17 00:00:00 2001
From: Mathias Krause <minipli at grsecurity.net>
Date: Wed, 24 Jul 2024 11:37:34 +0200
Subject: [PATCH 3/4] Add explicit test for w->x transition
---
llvm/unittests/Support/MemoryTest.cpp | 26 ++++++++++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/llvm/unittests/Support/MemoryTest.cpp b/llvm/unittests/Support/MemoryTest.cpp
index dbee1b62b25d1..9bbdb8491a08d 100644
--- a/llvm/unittests/Support/MemoryTest.cpp
+++ b/llvm/unittests/Support/MemoryTest.cpp
@@ -306,6 +306,32 @@ TEST_P(MappedMemoryTest, EnabledWrite) {
EXPECT_FALSE(Memory::releaseMappedMemory(M2));
}
+TEST_P(MappedMemoryTest, MakeExec) {
+ // This test applies only to readable and writeable combinations
+ if (Flags && !((Flags & Memory::MF_READ) && (Flags & Memory::MF_WRITE)))
+ GTEST_SKIP();
+ CHECK_UNSUPPORTED();
+
+ std::error_code EC;
+ MemoryBlock M = Memory::allocateMappedMemory(sizeof(int), nullptr, Flags, EC);
+ EXPECT_EQ(std::error_code(), EC);
+
+ EXPECT_NE((void*)nullptr, M.base());
+ EXPECT_LE(sizeof(int), M.allocatedSize());
+
+ int *x = (int*)M.base();
+ *x = 0xcc;
+
+ EXPECT_EQ(0xcc, *x);
+
+ Flags ^= Memory::MF_WRITE;
+ Flags |= Memory::MF_EXEC;
+
+ EXPECT_EQ(std::error_code(), Memory::protectMappedMemory(M, Flags));
+ EXPECT_EQ(0xcc, *x);
+ EXPECT_FALSE(Memory::releaseMappedMemory(M));
+}
+
TEST_P(MappedMemoryTest, SuccessiveNear) {
CHECK_UNSUPPORTED();
std::error_code EC;
>From 741da1971245e9f8ae289e670fef1eae5ec96627 Mon Sep 17 00:00:00 2001
From: Mathias Krause <minipli at grsecurity.net>
Date: Wed, 24 Jul 2024 13:37:24 +0200
Subject: [PATCH 4/4] clang-format fixes
---
llvm/lib/Support/Unix/Memory.inc | 13 +++++++++++--
llvm/unittests/Support/MemoryTest.cpp | 4 ++--
2 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/llvm/lib/Support/Unix/Memory.inc b/llvm/lib/Support/Unix/Memory.inc
index b3d8f78797541..2f622e27f6da0 100644
--- a/llvm/lib/Support/Unix/Memory.inc
+++ b/llvm/lib/Support/Unix/Memory.inc
@@ -196,10 +196,19 @@ std::error_code Memory::protectMappedMemory(const MemoryBlock &M,
public:
FDWrapper(int fd) : fd(fd) {}
~FDWrapper() { close(); }
- FDWrapper& operator=(int nfd) { close(); fd = nfd; return *this; }
+ FDWrapper &operator=(int nfd) {
+ close();
+ fd = nfd;
+ return *this;
+ }
operator int() const { return fd; }
+
private:
- void close() { if (fd >= 0) ::close(fd); fd = -1; }
+ void close() {
+ if (fd >= 0)
+ ::close(fd);
+ fd = -1;
+ }
int fd;
} fd(memfd_create("llvm", flags));
diff --git a/llvm/unittests/Support/MemoryTest.cpp b/llvm/unittests/Support/MemoryTest.cpp
index 9bbdb8491a08d..028a5fda97ef1 100644
--- a/llvm/unittests/Support/MemoryTest.cpp
+++ b/llvm/unittests/Support/MemoryTest.cpp
@@ -316,10 +316,10 @@ TEST_P(MappedMemoryTest, MakeExec) {
MemoryBlock M = Memory::allocateMappedMemory(sizeof(int), nullptr, Flags, EC);
EXPECT_EQ(std::error_code(), EC);
- EXPECT_NE((void*)nullptr, M.base());
+ EXPECT_NE((void *)nullptr, M.base());
EXPECT_LE(sizeof(int), M.allocatedSize());
- int *x = (int*)M.base();
+ int *x = (int *)M.base();
*x = 0xcc;
EXPECT_EQ(0xcc, *x);
More information about the llvm-commits
mailing list