[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
//===-- scudo_utils.cpp -----------------------------------------*- C++ -*-===//
|
|
|
|
//
|
2019-01-19 16:50:56 +08:00
|
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
///
|
|
|
|
/// Platform specific utility functions.
|
|
|
|
///
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
|
|
|
#include "scudo_utils.h"
|
|
|
|
|
2016-12-09 03:05:46 +08:00
|
|
|
#if defined(__x86_64__) || defined(__i386__)
|
|
|
|
# include <cpuid.h>
|
2017-11-23 02:30:44 +08:00
|
|
|
#elif defined(__arm__) || defined(__aarch64__)
|
|
|
|
# include "sanitizer_common/sanitizer_getauxval.h"
|
2018-04-23 22:53:13 +08:00
|
|
|
# if SANITIZER_FUCHSIA
|
|
|
|
# include <zircon/syscalls.h>
|
|
|
|
# include <zircon/features.h>
|
|
|
|
# elif SANITIZER_POSIX
|
2017-10-17 01:06:13 +08:00
|
|
|
# include "sanitizer_common/sanitizer_posix.h"
|
2017-09-07 01:51:32 +08:00
|
|
|
# include <fcntl.h>
|
|
|
|
# endif
|
[scudo] Refactor of CRC32 and ARM runtime CRC32 detection
Summary:
ARM & AArch64 runtime detection for hardware support of CRC32 has been added
via check of the AT_HWVAL auxiliary vector.
Following Michal's suggestions in D28417, the CRC32 code has been further
changed and looks better now. When compiled with full relro (which is strongly
suggested to benefit from additional hardening), the weak symbol for
computeHardwareCRC32 is read-only and the assembly generated is fairly clean
and straight forward. As suggested, an additional optimization is to skip
the runtime check if SSE 4.2 has been enabled globally, as opposed to only
for scudo_crc32.cpp.
scudo_crc32.h has no purpose anymore and was removed.
Reviewers: alekseyshl, kcc, rengolin, mgorny, phosek
Reviewed By: rengolin, mgorny
Subscribers: aemerson, rengolin, llvm-commits
Differential Revision: https://reviews.llvm.org/D28574
llvm-svn: 292409
2017-01-19 01:11:17 +08:00
|
|
|
#endif
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
|
2017-11-23 02:30:44 +08:00
|
|
|
#include <stdarg.h>
|
|
|
|
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
// TODO(kostyak): remove __sanitizer *Printf uses in favor for our own less
|
|
|
|
// complicated string formatting code. The following is a
|
|
|
|
// temporary workaround to be able to use __sanitizer::VSNPrintf.
|
|
|
|
namespace __sanitizer {
|
|
|
|
|
|
|
|
extern int VSNPrintf(char *buff, int buff_length, const char *format,
|
|
|
|
va_list args);
|
|
|
|
|
[scudo] 32-bit and hardware agnostic support
Summary:
This update introduces i386 support for the Scudo Hardened Allocator, and
offers software alternatives for functions that used to require hardware
specific instruction sets. This should make porting to new architectures
easier.
Among the changes:
- The chunk header has been changed to accomodate the size limitations
encountered on 32-bit architectures. We now fit everything in 64-bit. This
was achieved by storing the amount of unused bytes in an allocation rather
than the size itself, as one can be deduced from the other with the help
of the GetActuallyAllocatedSize function. As it turns out, this header can
be used for both 64 and 32 bit, and as such we dropped the requirement for
the 128-bit compare and exchange instruction support (cmpxchg16b).
- Add 32-bit support for the checksum and the PRNG functions: if the SSE 4.2
instruction set is supported, use the 32-bit CRC32 instruction, and in the
XorShift128, use a 32-bit based state instead of 64-bit.
- Add software support for CRC32: if SSE 4.2 is not supported, fallback on a
software implementation.
- Modify tests that were not 32-bit compliant, and expand them to cover more
allocation and alignment sizes. The random shuffle test has been deactivated
for linux-i386 & linux-i686 as the 32-bit sanitizer allocator doesn't
currently randomize chunks.
Reviewers: alekseyshl, kcc
Subscribers: filcab, llvm-commits, tberghammer, danalbert, srhines, mgorny, modocache
Differential Revision: https://reviews.llvm.org/D26358
llvm-svn: 288255
2016-12-01 01:32:20 +08:00
|
|
|
} // namespace __sanitizer
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
|
|
|
|
namespace __scudo {
|
|
|
|
|
2021-08-13 01:59:12 +08:00
|
|
|
void dieWithMessage(const char *Format, ...) {
|
2018-03-08 00:22:16 +08:00
|
|
|
static const char ScudoError[] = "Scudo ERROR: ";
|
|
|
|
static constexpr uptr PrefixSize = sizeof(ScudoError) - 1;
|
2016-10-01 03:57:21 +08:00
|
|
|
// Our messages are tiny, 256 characters is more than enough.
|
|
|
|
char Message[256];
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
va_list Args;
|
|
|
|
va_start(Args, Format);
|
2018-03-08 00:22:16 +08:00
|
|
|
internal_memcpy(Message, ScudoError, PrefixSize);
|
|
|
|
VSNPrintf(Message + PrefixSize, sizeof(Message) - PrefixSize, Format, Args);
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
va_end(Args);
|
2018-07-07 00:50:12 +08:00
|
|
|
LogMessageOnPrintf(Message);
|
|
|
|
if (common_flags()->abort_on_error)
|
|
|
|
SetAbortMessage(Message);
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
RawWrite(Message);
|
|
|
|
Die();
|
|
|
|
}
|
|
|
|
|
[scudo] 32-bit and hardware agnostic support
Summary:
This update introduces i386 support for the Scudo Hardened Allocator, and
offers software alternatives for functions that used to require hardware
specific instruction sets. This should make porting to new architectures
easier.
Among the changes:
- The chunk header has been changed to accomodate the size limitations
encountered on 32-bit architectures. We now fit everything in 64-bit. This
was achieved by storing the amount of unused bytes in an allocation rather
than the size itself, as one can be deduced from the other with the help
of the GetActuallyAllocatedSize function. As it turns out, this header can
be used for both 64 and 32 bit, and as such we dropped the requirement for
the 128-bit compare and exchange instruction support (cmpxchg16b).
- Add 32-bit support for the checksum and the PRNG functions: if the SSE 4.2
instruction set is supported, use the 32-bit CRC32 instruction, and in the
XorShift128, use a 32-bit based state instead of 64-bit.
- Add software support for CRC32: if SSE 4.2 is not supported, fallback on a
software implementation.
- Modify tests that were not 32-bit compliant, and expand them to cover more
allocation and alignment sizes. The random shuffle test has been deactivated
for linux-i386 & linux-i686 as the 32-bit sanitizer allocator doesn't
currently randomize chunks.
Reviewers: alekseyshl, kcc
Subscribers: filcab, llvm-commits, tberghammer, danalbert, srhines, mgorny, modocache
Differential Revision: https://reviews.llvm.org/D26358
llvm-svn: 288255
2016-12-01 01:32:20 +08:00
|
|
|
#if defined(__x86_64__) || defined(__i386__)
|
|
|
|
// i386 and x86_64 specific code to detect CRC32 hardware support via CPUID.
|
|
|
|
// CRC32 requires the SSE 4.2 instruction set.
|
2017-09-07 01:51:32 +08:00
|
|
|
# ifndef bit_SSE4_2
|
|
|
|
# define bit_SSE4_2 bit_SSE42 // clang and gcc have different defines.
|
|
|
|
# endif
|
2020-05-12 00:16:54 +08:00
|
|
|
|
|
|
|
#ifndef signature_HYGON_ebx // They are not defined in gcc.
|
|
|
|
// HYGON: "HygonGenuine".
|
|
|
|
#define signature_HYGON_ebx 0x6f677948
|
|
|
|
#define signature_HYGON_edx 0x6e65476e
|
|
|
|
#define signature_HYGON_ecx 0x656e6975
|
|
|
|
#endif
|
|
|
|
|
2017-11-23 02:30:44 +08:00
|
|
|
bool hasHardwareCRC32() {
|
|
|
|
u32 Eax, Ebx, Ecx, Edx;
|
|
|
|
__get_cpuid(0, &Eax, &Ebx, &Ecx, &Edx);
|
|
|
|
const bool IsIntel = (Ebx == signature_INTEL_ebx) &&
|
|
|
|
(Edx == signature_INTEL_edx) &&
|
|
|
|
(Ecx == signature_INTEL_ecx);
|
|
|
|
const bool IsAMD = (Ebx == signature_AMD_ebx) &&
|
|
|
|
(Edx == signature_AMD_edx) &&
|
|
|
|
(Ecx == signature_AMD_ecx);
|
2020-05-12 00:16:54 +08:00
|
|
|
const bool IsHygon = (Ebx == signature_HYGON_ebx) &&
|
|
|
|
(Edx == signature_HYGON_edx) &&
|
|
|
|
(Ecx == signature_HYGON_ecx);
|
|
|
|
if (!IsIntel && !IsAMD && !IsHygon)
|
2017-11-23 02:30:44 +08:00
|
|
|
return false;
|
|
|
|
__get_cpuid(1, &Eax, &Ebx, &Ecx, &Edx);
|
|
|
|
return !!(Ecx & bit_SSE4_2);
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
}
|
[scudo] Refactor of CRC32 and ARM runtime CRC32 detection
Summary:
ARM & AArch64 runtime detection for hardware support of CRC32 has been added
via check of the AT_HWVAL auxiliary vector.
Following Michal's suggestions in D28417, the CRC32 code has been further
changed and looks better now. When compiled with full relro (which is strongly
suggested to benefit from additional hardening), the weak symbol for
computeHardwareCRC32 is read-only and the assembly generated is fairly clean
and straight forward. As suggested, an additional optimization is to skip
the runtime check if SSE 4.2 has been enabled globally, as opposed to only
for scudo_crc32.cpp.
scudo_crc32.h has no purpose anymore and was removed.
Reviewers: alekseyshl, kcc, rengolin, mgorny, phosek
Reviewed By: rengolin, mgorny
Subscribers: aemerson, rengolin, llvm-commits
Differential Revision: https://reviews.llvm.org/D28574
llvm-svn: 292409
2017-01-19 01:11:17 +08:00
|
|
|
#elif defined(__arm__) || defined(__aarch64__)
|
2017-11-23 02:30:44 +08:00
|
|
|
// For ARM and AArch64, hardware CRC32 support is indicated in the AT_HWCAP
|
2017-09-07 01:51:32 +08:00
|
|
|
// auxiliary vector.
|
2017-11-23 02:30:44 +08:00
|
|
|
# ifndef AT_HWCAP
|
|
|
|
# define AT_HWCAP 16
|
|
|
|
# endif
|
2017-09-07 01:51:32 +08:00
|
|
|
# ifndef HWCAP_CRC32
|
|
|
|
# define HWCAP_CRC32 (1 << 7) // HWCAP_CRC32 is missing on older platforms.
|
|
|
|
# endif
|
2017-11-23 02:30:44 +08:00
|
|
|
# if SANITIZER_POSIX
|
|
|
|
bool hasHardwareCRC32ARMPosix() {
|
|
|
|
uptr F = internal_open("/proc/self/auxv", O_RDONLY);
|
|
|
|
if (internal_iserror(F))
|
|
|
|
return false;
|
|
|
|
struct { uptr Tag; uptr Value; } Entry = { 0, 0 };
|
|
|
|
for (;;) {
|
|
|
|
uptr N = internal_read(F, &Entry, sizeof(Entry));
|
|
|
|
if (internal_iserror(N) || N != sizeof(Entry) ||
|
|
|
|
(Entry.Tag == 0 && Entry.Value == 0) || Entry.Tag == AT_HWCAP)
|
[scudo] Refactor of CRC32 and ARM runtime CRC32 detection
Summary:
ARM & AArch64 runtime detection for hardware support of CRC32 has been added
via check of the AT_HWVAL auxiliary vector.
Following Michal's suggestions in D28417, the CRC32 code has been further
changed and looks better now. When compiled with full relro (which is strongly
suggested to benefit from additional hardening), the weak symbol for
computeHardwareCRC32 is read-only and the assembly generated is fairly clean
and straight forward. As suggested, an additional optimization is to skip
the runtime check if SSE 4.2 has been enabled globally, as opposed to only
for scudo_crc32.cpp.
scudo_crc32.h has no purpose anymore and was removed.
Reviewers: alekseyshl, kcc, rengolin, mgorny, phosek
Reviewed By: rengolin, mgorny
Subscribers: aemerson, rengolin, llvm-commits
Differential Revision: https://reviews.llvm.org/D28574
llvm-svn: 292409
2017-01-19 01:11:17 +08:00
|
|
|
break;
|
|
|
|
}
|
2017-11-23 02:30:44 +08:00
|
|
|
internal_close(F);
|
|
|
|
return (Entry.Tag == AT_HWCAP && (Entry.Value & HWCAP_CRC32) != 0);
|
[scudo] Refactor of CRC32 and ARM runtime CRC32 detection
Summary:
ARM & AArch64 runtime detection for hardware support of CRC32 has been added
via check of the AT_HWVAL auxiliary vector.
Following Michal's suggestions in D28417, the CRC32 code has been further
changed and looks better now. When compiled with full relro (which is strongly
suggested to benefit from additional hardening), the weak symbol for
computeHardwareCRC32 is read-only and the assembly generated is fairly clean
and straight forward. As suggested, an additional optimization is to skip
the runtime check if SSE 4.2 has been enabled globally, as opposed to only
for scudo_crc32.cpp.
scudo_crc32.h has no purpose anymore and was removed.
Reviewers: alekseyshl, kcc, rengolin, mgorny, phosek
Reviewed By: rengolin, mgorny
Subscribers: aemerson, rengolin, llvm-commits
Differential Revision: https://reviews.llvm.org/D28574
llvm-svn: 292409
2017-01-19 01:11:17 +08:00
|
|
|
}
|
2017-11-23 02:30:44 +08:00
|
|
|
# else
|
|
|
|
bool hasHardwareCRC32ARMPosix() { return false; }
|
|
|
|
# endif // SANITIZER_POSIX
|
|
|
|
|
2017-11-28 05:34:43 +08:00
|
|
|
// Bionic doesn't initialize its globals early enough. This causes issues when
|
|
|
|
// trying to access them from a preinit_array (b/25751302) or from another
|
|
|
|
// constructor called before the libc one (b/68046352). __progname is
|
|
|
|
// initialized after the other globals, so we can check its value to know if
|
|
|
|
// calling getauxval is safe.
|
|
|
|
extern "C" SANITIZER_WEAK_ATTRIBUTE char *__progname;
|
2020-09-17 22:04:50 +08:00
|
|
|
inline bool areBionicGlobalsInitialized() {
|
2017-11-28 05:34:43 +08:00
|
|
|
return !SANITIZER_ANDROID || (&__progname && __progname);
|
|
|
|
}
|
|
|
|
|
2017-11-23 02:30:44 +08:00
|
|
|
bool hasHardwareCRC32() {
|
2018-04-23 22:53:13 +08:00
|
|
|
#if SANITIZER_FUCHSIA
|
|
|
|
u32 HWCap;
|
|
|
|
zx_status_t Status = zx_system_get_features(ZX_FEATURE_KIND_CPU, &HWCap);
|
|
|
|
if (Status != ZX_OK || (HWCap & ZX_ARM64_FEATURE_ISA_CRC32) == 0)
|
|
|
|
return false;
|
|
|
|
return true;
|
|
|
|
#else
|
2017-11-28 05:34:43 +08:00
|
|
|
if (&getauxval && areBionicGlobalsInitialized())
|
2017-11-23 02:30:44 +08:00
|
|
|
return !!(getauxval(AT_HWCAP) & HWCAP_CRC32);
|
|
|
|
return hasHardwareCRC32ARMPosix();
|
2018-04-23 22:53:13 +08:00
|
|
|
#endif // SANITIZER_FUCHSIA
|
[scudo] 32-bit and hardware agnostic support
Summary:
This update introduces i386 support for the Scudo Hardened Allocator, and
offers software alternatives for functions that used to require hardware
specific instruction sets. This should make porting to new architectures
easier.
Among the changes:
- The chunk header has been changed to accomodate the size limitations
encountered on 32-bit architectures. We now fit everything in 64-bit. This
was achieved by storing the amount of unused bytes in an allocation rather
than the size itself, as one can be deduced from the other with the help
of the GetActuallyAllocatedSize function. As it turns out, this header can
be used for both 64 and 32 bit, and as such we dropped the requirement for
the 128-bit compare and exchange instruction support (cmpxchg16b).
- Add 32-bit support for the checksum and the PRNG functions: if the SSE 4.2
instruction set is supported, use the 32-bit CRC32 instruction, and in the
XorShift128, use a 32-bit based state instead of 64-bit.
- Add software support for CRC32: if SSE 4.2 is not supported, fallback on a
software implementation.
- Modify tests that were not 32-bit compliant, and expand them to cover more
allocation and alignment sizes. The random shuffle test has been deactivated
for linux-i386 & linux-i686 as the 32-bit sanitizer allocator doesn't
currently randomize chunks.
Reviewers: alekseyshl, kcc
Subscribers: filcab, llvm-commits, tberghammer, danalbert, srhines, mgorny, modocache
Differential Revision: https://reviews.llvm.org/D26358
llvm-svn: 288255
2016-12-01 01:32:20 +08:00
|
|
|
}
|
2017-11-23 02:30:44 +08:00
|
|
|
#else
|
|
|
|
bool hasHardwareCRC32() { return false; }
|
[scudo] 32-bit and hardware agnostic support
Summary:
This update introduces i386 support for the Scudo Hardened Allocator, and
offers software alternatives for functions that used to require hardware
specific instruction sets. This should make porting to new architectures
easier.
Among the changes:
- The chunk header has been changed to accomodate the size limitations
encountered on 32-bit architectures. We now fit everything in 64-bit. This
was achieved by storing the amount of unused bytes in an allocation rather
than the size itself, as one can be deduced from the other with the help
of the GetActuallyAllocatedSize function. As it turns out, this header can
be used for both 64 and 32 bit, and as such we dropped the requirement for
the 128-bit compare and exchange instruction support (cmpxchg16b).
- Add 32-bit support for the checksum and the PRNG functions: if the SSE 4.2
instruction set is supported, use the 32-bit CRC32 instruction, and in the
XorShift128, use a 32-bit based state instead of 64-bit.
- Add software support for CRC32: if SSE 4.2 is not supported, fallback on a
software implementation.
- Modify tests that were not 32-bit compliant, and expand them to cover more
allocation and alignment sizes. The random shuffle test has been deactivated
for linux-i386 & linux-i686 as the 32-bit sanitizer allocator doesn't
currently randomize chunks.
Reviewers: alekseyshl, kcc
Subscribers: filcab, llvm-commits, tberghammer, danalbert, srhines, mgorny, modocache
Differential Revision: https://reviews.llvm.org/D26358
llvm-svn: 288255
2016-12-01 01:32:20 +08:00
|
|
|
#endif // defined(__x86_64__) || defined(__i386__)
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
|
[scudo] 32-bit and hardware agnostic support
Summary:
This update introduces i386 support for the Scudo Hardened Allocator, and
offers software alternatives for functions that used to require hardware
specific instruction sets. This should make porting to new architectures
easier.
Among the changes:
- The chunk header has been changed to accomodate the size limitations
encountered on 32-bit architectures. We now fit everything in 64-bit. This
was achieved by storing the amount of unused bytes in an allocation rather
than the size itself, as one can be deduced from the other with the help
of the GetActuallyAllocatedSize function. As it turns out, this header can
be used for both 64 and 32 bit, and as such we dropped the requirement for
the 128-bit compare and exchange instruction support (cmpxchg16b).
- Add 32-bit support for the checksum and the PRNG functions: if the SSE 4.2
instruction set is supported, use the 32-bit CRC32 instruction, and in the
XorShift128, use a 32-bit based state instead of 64-bit.
- Add software support for CRC32: if SSE 4.2 is not supported, fallback on a
software implementation.
- Modify tests that were not 32-bit compliant, and expand them to cover more
allocation and alignment sizes. The random shuffle test has been deactivated
for linux-i386 & linux-i686 as the 32-bit sanitizer allocator doesn't
currently randomize chunks.
Reviewers: alekseyshl, kcc
Subscribers: filcab, llvm-commits, tberghammer, danalbert, srhines, mgorny, modocache
Differential Revision: https://reviews.llvm.org/D26358
llvm-svn: 288255
2016-12-01 01:32:20 +08:00
|
|
|
} // namespace __scudo
|