[scudo] Implement stricter separation of C vs C++
Summary:
Initially, Scudo had a monolithic design where both C and C++ functions were
living in the same library. This was not necessarily ideal, and with the work
on -fsanitize=scudo, it became more apparent that this needed to change.
We are splitting the new/delete interceptor in their own C++ library. This
allows more flexibility, notably with regard to std::bad_alloc when the work is
done. This also allows us to not link new & delete when using pure C.
Additionally, we add the UBSan runtimes with Scudo, in order to be able to have
a -fsanitize=scudo,undefined in Clang (see work in D39334).
The changes in this patch:
- split the cxx specific code in the scudo cmake file into a new library;
(remove the spurious foreach loop, that was not necessary)
- add the UBSan runtimes (both C and C++);
- change the test cmake file to allow for specific C & C++ tests;
- make C tests pure C, rename their extension accordingly.
Reviewers: alekseyshl
Reviewed By: alekseyshl
Subscribers: srhines, mgorny, llvm-commits
Differential Revision: https://reviews.llvm.org/D39461
llvm-svn: 317097
2017-11-01 23:28:20 +08:00
|
|
|
// RUN: %clangxx_scudo %s -lstdc++ -o %t
|
2018-02-27 01:14:44 +08:00
|
|
|
// RUN: %run %t pointers 2>&1
|
|
|
|
// RUN: %run %t contents 2>&1
|
2017-08-17 00:40:48 +08:00
|
|
|
// RUN: %run %t usablesize 2>&1
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
|
|
|
|
// Tests that our reallocation function returns the same pointer when the
|
|
|
|
// requested size can fit into the previously allocated chunk. Also tests that
|
|
|
|
// a new chunk is returned if the size is greater, and that the contents of the
|
2017-08-17 00:40:48 +08:00
|
|
|
// chunk are left unchanged. Finally, checks that realloc copies the usable
|
|
|
|
// size of the old chunk to the new one (as opposed to the requested size).
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
|
|
|
|
#include <assert.h>
|
|
|
|
#include <malloc.h>
|
|
|
|
#include <string.h>
|
|
|
|
|
2016-09-21 06:17:59 +08:00
|
|
|
#include <vector>
|
|
|
|
|
2018-02-27 01:14:44 +08:00
|
|
|
#include <sanitizer/allocator_interface.h>
|
|
|
|
|
2021-05-18 03:24:06 +08:00
|
|
|
int main(int argc, char **argv) {
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
void *p, *old_p;
|
2016-09-21 06:17:59 +08:00
|
|
|
// Those sizes will exercise both allocators (Primary & Secondary).
|
[scudo] 32-bit and hardware agnostic support
Summary:
This update introduces i386 support for the Scudo Hardened Allocator, and
offers software alternatives for functions that used to require hardware
specific instruction sets. This should make porting to new architectures
easier.
Among the changes:
- The chunk header has been changed to accomodate the size limitations
encountered on 32-bit architectures. We now fit everything in 64-bit. This
was achieved by storing the amount of unused bytes in an allocation rather
than the size itself, as one can be deduced from the other with the help
of the GetActuallyAllocatedSize function. As it turns out, this header can
be used for both 64 and 32 bit, and as such we dropped the requirement for
the 128-bit compare and exchange instruction support (cmpxchg16b).
- Add 32-bit support for the checksum and the PRNG functions: if the SSE 4.2
instruction set is supported, use the 32-bit CRC32 instruction, and in the
XorShift128, use a 32-bit based state instead of 64-bit.
- Add software support for CRC32: if SSE 4.2 is not supported, fallback on a
software implementation.
- Modify tests that were not 32-bit compliant, and expand them to cover more
allocation and alignment sizes. The random shuffle test has been deactivated
for linux-i386 & linux-i686 as the 32-bit sanitizer allocator doesn't
currently randomize chunks.
Reviewers: alekseyshl, kcc
Subscribers: filcab, llvm-commits, tberghammer, danalbert, srhines, mgorny, modocache
Differential Revision: https://reviews.llvm.org/D26358
llvm-svn: 288255
2016-12-01 01:32:20 +08:00
|
|
|
std::vector<size_t> sizes{1, 16, 1024, 32768, 1 << 16, 1 << 17, 1 << 20};
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
|
|
|
|
assert(argc == 2);
|
2017-02-04 04:49:42 +08:00
|
|
|
|
2017-08-17 00:40:48 +08:00
|
|
|
if (!strcmp(argv[1], "usablesize")) {
|
|
|
|
// This tests a sketchy behavior inherited from poorly written libraries
|
|
|
|
// that have become somewhat standard. When realloc'ing a chunk, the
|
|
|
|
// copied contents should span the usable size of the chunk, not the
|
|
|
|
// requested size.
|
|
|
|
size_t size = 496, usable_size;
|
|
|
|
p = nullptr;
|
|
|
|
// Make sure we get a chunk with a usable size actually larger than size.
|
|
|
|
do {
|
2021-05-18 03:24:06 +08:00
|
|
|
if (p)
|
|
|
|
free(p);
|
2017-08-17 00:40:48 +08:00
|
|
|
size += 16;
|
|
|
|
p = malloc(size);
|
2021-05-27 01:50:26 +08:00
|
|
|
usable_size = __sanitizer_get_allocated_size(p);
|
2017-08-17 00:40:48 +08:00
|
|
|
assert(usable_size >= size);
|
|
|
|
} while (usable_size == size);
|
|
|
|
for (int i = 0; i < usable_size; i++)
|
|
|
|
reinterpret_cast<char *>(p)[i] = 'A';
|
|
|
|
old_p = p;
|
|
|
|
// Make sure we get a different chunk so that the data is actually copied.
|
|
|
|
do {
|
|
|
|
size *= 2;
|
2016-09-21 06:17:59 +08:00
|
|
|
p = realloc(p, size);
|
2017-02-04 04:49:42 +08:00
|
|
|
assert(p);
|
2017-08-17 00:40:48 +08:00
|
|
|
} while (p == old_p);
|
|
|
|
// The contents of the new chunk must match the old one up to usable_size.
|
|
|
|
for (int i = 0; i < usable_size; i++)
|
|
|
|
assert(reinterpret_cast<char *>(p)[i] == 'A');
|
|
|
|
free(p);
|
|
|
|
} else {
|
|
|
|
for (size_t size : sizes) {
|
|
|
|
if (!strcmp(argv[1], "pointers")) {
|
|
|
|
old_p = p = realloc(nullptr, size);
|
|
|
|
assert(p);
|
2021-05-27 01:50:26 +08:00
|
|
|
size = __sanitizer_get_allocated_size(p);
|
2017-08-17 00:40:48 +08:00
|
|
|
// Our realloc implementation will return the same pointer if the size
|
|
|
|
// requested is lower than or equal to the usable size of the associated
|
|
|
|
// chunk.
|
|
|
|
p = realloc(p, size - 1);
|
|
|
|
assert(p == old_p);
|
|
|
|
p = realloc(p, size);
|
|
|
|
assert(p == old_p);
|
|
|
|
// And a new one if the size is greater.
|
|
|
|
p = realloc(p, size + 1);
|
|
|
|
assert(p != old_p);
|
|
|
|
// A size of 0 will free the chunk and return nullptr.
|
|
|
|
p = realloc(p, 0);
|
|
|
|
assert(!p);
|
|
|
|
old_p = nullptr;
|
|
|
|
}
|
|
|
|
if (!strcmp(argv[1], "contents")) {
|
|
|
|
p = realloc(nullptr, size);
|
|
|
|
assert(p);
|
|
|
|
for (int i = 0; i < size; i++)
|
|
|
|
reinterpret_cast<char *>(p)[i] = 'A';
|
|
|
|
p = realloc(p, size + 1);
|
|
|
|
// The contents of the reallocated chunk must match the original one.
|
|
|
|
for (int i = 0; i < size; i++)
|
|
|
|
assert(reinterpret_cast<char *>(p)[i] == 'A');
|
|
|
|
}
|
2016-09-21 06:17:59 +08:00
|
|
|
}
|
[sanitizer] Initial implementation of a Hardened Allocator
Summary:
This is an initial implementation of a Hardened Allocator based on Sanitizer Common's CombinedAllocator.
It aims at mitigating heap based vulnerabilities by adding several features to the base allocator, while staying relatively fast.
The following were implemented:
- additional consistency checks on the allocation function parameters and on the heap chunks;
- use of checksum protected chunk header, to detect corruption;
- randomness to the allocator base;
- delayed freelist (quarantine), to mitigate use after free and overall determinism.
Additional mitigations are in the works.
Reviewers: eugenis, aizatsky, pcc, krasin, vitalybuka, glider, dvyukov, kcc
Subscribers: kubabrecka, filcab, llvm-commits
Differential Revision: http://reviews.llvm.org/D20084
llvm-svn: 271968
2016-06-07 09:20:26 +08:00
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
// CHECK: ERROR: invalid chunk type when reallocating address
|