dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ladybird/Userland/DevTools/UserspaceEmulator/MallocTracer.cpp

431 lines
16 KiB
C++
Raw Normal View History

UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
/*
* Copyright (c) 2020, Andreas Kling <kling@serenityos.org>
Everywhere: Use tobyase@serenityos.org for my copyright headers
2021-08-09 16:28:56 -03:00
* Copyright (c) 2021, Tobias Christiansen <tobyase@serenityos.org>
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
*
Everything: Move to SPDX license identifiers in all files. SPDX License Identifiers are a more compact / standardized way of representing file license information. See: https://spdx.dev/resources/use/#identifiers This was done with the `ambr` search and replace tool. ambr --no-parent-ignore --key-from-file --rep-from-file key.txt rep.txt *
2021-04-22 05:24:48 -03:00
* SPDX-License-Identifier: BSD-2-Clause
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
*/
#include "MallocTracer.h"
#include "Emulator.h"
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
#include "MmapRegion.h"
Everywhere: Hook up remaining debug macros to Debug.h.
2021-01-24 11:28:26 -03:00
#include <AK/Debug.h>
Everywhere: Add missing <AK/TemporaryChange.h> includes Don't rely on HashTable.h pulling this in.
2020-10-15 15:46:52 -03:00
#include <AK/TemporaryChange.h>
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
#include <mallocdefs.h>
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
#include <string.h>
Everywhere: Remove klog(), dbg() and purge all LogStream usage :^) Good-bye LogStream. Long live AK::Format!
2021-03-12 13:29:37 -03:00
#include <unistd.h>
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
namespace UserspaceEmulator {
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
MallocTracer::MallocTracer(Emulator& emulator)
: m_emulator(emulator)
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
{
}
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
template<typename Callback>
inline void MallocTracer::for_each_mallocation(Callback callback) const
UserspaceEmulator: Forget ChunkedBlocks after they are munmap()'ed This is not ideal since we lose free() backtraces, but it will require some thinking to get this right.
2020-11-14 19:07:07 -03:00
{
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.mmu().for_each_region([&](auto& region) {
UserspaceEmulator: Remove hand-rolled is_foo() helpers in favor of RTTI
2021-01-01 15:37:36 -03:00
if (is<MmapRegion>(region) && static_cast<const MmapRegion&>(region).is_malloc_block()) {
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
auto* malloc_data = static_cast<MmapRegion&>(region).malloc_metadata();
for (auto& mallocation : malloc_data->mallocations) {
if (mallocation.used && callback(mallocation) == IterationDecision::Break)
return IterationDecision::Break;
}
}
return IterationDecision::Continue;
});
UserspaceEmulator: Forget ChunkedBlocks after they are munmap()'ed This is not ideal since we lose free() backtraces, but it will require some thinking to get this right.
2020-11-14 19:07:07 -03:00
}
LibC+UE: Keep more unused chunked blocks around Previously each malloc size class would keep around a limited number of unused blocks which were marked with MADV_SET_VOLATILE which could then be reinitialized when additional blocks were needed. This changes malloc() so that it also keeps around a number of blocks without marking them with MADV_SET_VOLATILE. I termed these "hot" blocks whereas blocks which were marked as MADV_SET_VOLATILE are called "cold" blocks because they're more expensive to reinitialize. In the worst case this could increase memory usage per process by 1MB when a program requests a bunch of memory and frees all of it. Also, in order to make more efficient use of these unused blocks they're now shared between size classes.
2021-05-23 07:52:19 -03:00
void MallocTracer::update_metadata(MmapRegion& mmap_region, size_t chunk_size)
{
mmap_region.set_malloc_metadata({},
adopt_own(*new MallocRegionMetadata {
.region = mmap_region,
.address = mmap_region.base(),
.chunk_size = chunk_size,
.mallocations = {},
}));
auto& malloc_data = *mmap_region.malloc_metadata();
bool is_chunked_block = malloc_data.chunk_size <= size_classes[num_size_classes - 1];
if (is_chunked_block)
malloc_data.mallocations.resize((ChunkedBlock::block_size - sizeof(ChunkedBlock)) / malloc_data.chunk_size);
else
malloc_data.mallocations.resize(1);
// Mark the containing mmap region as a malloc block!
mmap_region.set_malloc(true);
}
UserspaceEmulator+LibC: Use sys$emuctl() to pass malloc info to UE Get rid of the awkward secret handshake sequence between malloc and UE and simply use sys$emuctl() to notify UE of malloc, free and realloc.
2021-03-09 04:56:35 -03:00
void MallocTracer::target_did_malloc(Badge<Emulator>, FlatPtr address, size_t size)
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
{
UserspaceEmulator: Support dynamically loaded programs When loading dynamic objects, the emulator loads the interpreter, generates an auxiliary vector and starts executing the loader. Additionally, this commits also makes the MallocTracer and backtrace symbolication work for dynamically loaded programs.
2020-11-23 15:00:35 -03:00
if (m_emulator.is_in_loader_code())
return;
UserspaceEmulator: Use ring 3 segment selectors We were using ring 0 selectors everywhere (the bottom 3 bits of a selector determines the ring.) This doesn't really make any practical difference since UE doesn't run code in other rings anyway, but let's have correct-looking segment selectors. :^)
2020-12-25 11:39:26 -03:00
auto* region = m_emulator.mmu().find_region({ 0x23, address });
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 16:42:32 -03:00
VERIFY(region);
Userland: Replace VERIFY(is<T>) with verify_cast<T> Instead of doing a VERIFY(is<T>(x)) and *then* casting it to T, we can just do the cast right away with verify_cast<T>. :^)
2021-06-24 16:13:09 -03:00
auto& mmap_region = verify_cast<MmapRegion>(*region);
UserspaceEmulator: Mark mmap regions as malloc blocks when mallocing We don't have to be clever at all to figure out which MmapRegions are malloc blocks, we can just mark the containing region as such when the emulated process performs a malloc! :^)
2020-08-01 04:13:45 -03:00
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
auto* shadow_bits = mmap_region.shadow_data() + address - mmap_region.base();
memset(shadow_bits, 0, size);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
if (auto* existing_mallocation = find_mallocation(address)) {
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 16:42:32 -03:00
VERIFY(existing_mallocation->freed);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
existing_mallocation->size = size;
existing_mallocation->freed = false;
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
existing_mallocation->malloc_backtrace = m_emulator.raw_backtrace();
UserspaceEmulator: Reset malloc backtrace on mallocation reuse If a previously-freed malloc chunk is reused, forget any old backtraces and save a new malloc backtrace.
2020-07-16 15:55:41 -03:00
existing_mallocation->free_backtrace.clear();
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
UserspaceEmulator: Defer marking MmapRegion as malloc block We don't want to audit accesses into the region *while* we're setting up malloc tracking for it. Fetching the chunk size from the header was tripping up the auditing code.
2021-03-09 07:40:14 -03:00
if (!mmap_region.is_malloc_block()) {
UserspaceEmulator: Tidy up the MallocRegionMetadata construction a bit Use designated initializers to make it very obvious what's being set, and also give the metadata a backpointer to the region for convenience.
2021-03-09 08:00:22 -03:00
auto chunk_size = mmap_region.read32(offsetof(CommonHeader, m_size)).value();
LibC+UE: Keep more unused chunked blocks around Previously each malloc size class would keep around a limited number of unused blocks which were marked with MADV_SET_VOLATILE which could then be reinitialized when additional blocks were needed. This changes malloc() so that it also keeps around a number of blocks without marking them with MADV_SET_VOLATILE. I termed these "hot" blocks whereas blocks which were marked as MADV_SET_VOLATILE are called "cold" blocks because they're more expensive to reinitialize. In the worst case this could increase memory usage per process by 1MB when a program requests a bunch of memory and frees all of it. Also, in order to make more efficient use of these unused blocks they're now shared between size classes.
2021-05-23 07:52:19 -03:00
update_metadata(mmap_region, chunk_size);
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
}
UserspaceEmulator: Don't assume entire malloc block is chunked Accesses in the header (or trailing padding) of a malloc block should not be associated with any mallocation since only the chunk-sized slots actually get returned by malloc. Basically, allow address-to-chunk lookup to fail, and handle such failures gracefully at call sites. Fixes #5706.
2021-03-09 09:27:05 -03:00
auto* mallocation = mmap_region.malloc_metadata()->mallocation_for_address(address);
VERIFY(mallocation);
*mallocation = { address, size, true, false, m_emulator.raw_backtrace(), Vector<FlatPtr>() };
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
LibC+UE: Keep more unused chunked blocks around Previously each malloc size class would keep around a limited number of unused blocks which were marked with MADV_SET_VOLATILE which could then be reinitialized when additional blocks were needed. This changes malloc() so that it also keeps around a number of blocks without marking them with MADV_SET_VOLATILE. I termed these "hot" blocks whereas blocks which were marked as MADV_SET_VOLATILE are called "cold" blocks because they're more expensive to reinitialize. In the worst case this could increase memory usage per process by 1MB when a program requests a bunch of memory and frees all of it. Also, in order to make more efficient use of these unused blocks they're now shared between size classes.
2021-05-23 07:52:19 -03:00
void MallocTracer::target_did_change_chunk_size(Badge<Emulator>, FlatPtr block, size_t chunk_size)
{
if (m_emulator.is_in_loader_code())
return;
auto* region = m_emulator.mmu().find_region({ 0x23, block });
VERIFY(region);
Userland: Replace VERIFY(is<T>) with verify_cast<T> Instead of doing a VERIFY(is<T>(x)) and *then* casting it to T, we can just do the cast right away with verify_cast<T>. :^)
2021-06-24 16:13:09 -03:00
auto& mmap_region = verify_cast<MmapRegion>(*region);
LibC+UE: Keep more unused chunked blocks around Previously each malloc size class would keep around a limited number of unused blocks which were marked with MADV_SET_VOLATILE which could then be reinitialized when additional blocks were needed. This changes malloc() so that it also keeps around a number of blocks without marking them with MADV_SET_VOLATILE. I termed these "hot" blocks whereas blocks which were marked as MADV_SET_VOLATILE are called "cold" blocks because they're more expensive to reinitialize. In the worst case this could increase memory usage per process by 1MB when a program requests a bunch of memory and frees all of it. Also, in order to make more efficient use of these unused blocks they're now shared between size classes.
2021-05-23 07:52:19 -03:00
update_metadata(mmap_region, chunk_size);
}
UserspaceEmulator: Don't assume entire malloc block is chunked Accesses in the header (or trailing padding) of a malloc block should not be associated with any mallocation since only the chunk-sized slots actually get returned by malloc. Basically, allow address-to-chunk lookup to fail, and handle such failures gracefully at call sites. Fixes #5706.
2021-03-09 09:27:05 -03:00
ALWAYS_INLINE Mallocation* MallocRegionMetadata::mallocation_for_address(FlatPtr address) const
UserspaceEmulator: Add some helpers to tidy up TrackedChunkedBlock
2020-11-14 14:36:17 -03:00
{
UserspaceEmulator: Don't assume entire malloc block is chunked Accesses in the header (or trailing padding) of a malloc block should not be associated with any mallocation since only the chunk-sized slots actually get returned by malloc. Basically, allow address-to-chunk lookup to fail, and handle such failures gracefully at call sites. Fixes #5706.
2021-03-09 09:27:05 -03:00
auto index = chunk_index_for_address(address);
if (!index.has_value())
return nullptr;
return &const_cast<Mallocation&>(this->mallocations[index.value()]);
UserspaceEmulator: Add some helpers to tidy up TrackedChunkedBlock
2020-11-14 14:36:17 -03:00
}
UserspaceEmulator: Don't assume entire malloc block is chunked Accesses in the header (or trailing padding) of a malloc block should not be associated with any mallocation since only the chunk-sized slots actually get returned by malloc. Basically, allow address-to-chunk lookup to fail, and handle such failures gracefully at call sites. Fixes #5706.
2021-03-09 09:27:05 -03:00
ALWAYS_INLINE Optional<size_t> MallocRegionMetadata::chunk_index_for_address(FlatPtr address) const
UserspaceEmulator: Add some helpers to tidy up TrackedChunkedBlock
2020-11-14 14:36:17 -03:00
{
Revert "LibC: Simplify malloc size classes" This reverts commit f91bcb8895cd6b76b2977ad0632fef521ba2f1d1.
2021-05-18 03:32:05 -03:00
bool is_chunked_block = chunk_size <= size_classes[num_size_classes - 1];
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
if (!is_chunked_block) {
// This is a BigAllocationBlock
return 0;
}
UserspaceEmulator: Don't assume entire malloc block is chunked Accesses in the header (or trailing padding) of a malloc block should not be associated with any mallocation since only the chunk-sized slots actually get returned by malloc. Basically, allow address-to-chunk lookup to fail, and handle such failures gracefully at call sites. Fixes #5706.
2021-03-09 09:27:05 -03:00
auto offset_into_block = address - this->address;
if (offset_into_block < sizeof(ChunkedBlock))
return 0;
auto chunk_offset = offset_into_block - sizeof(ChunkedBlock);
auto chunk_index = chunk_offset / this->chunk_size;
if (chunk_index >= mallocations.size())
return {};
return chunk_index;
UserspaceEmulator: Add some helpers to tidy up TrackedChunkedBlock
2020-11-14 14:36:17 -03:00
}
UserspaceEmulator+LibC: Use sys$emuctl() to pass malloc info to UE Get rid of the awkward secret handshake sequence between malloc and UE and simply use sys$emuctl() to notify UE of malloc, free and realloc.
2021-03-09 04:56:35 -03:00
void MallocTracer::target_did_free(Badge<Emulator>, FlatPtr address)
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
{
UserspaceEmulator: Don't complain about free(nullptr)
2020-07-15 18:53:58 -03:00
if (!address)
return;
UserspaceEmulator: Support dynamically loaded programs When loading dynamic objects, the emulator loads the interpreter, generates an auxiliary vector and starts executing the loader. Additionally, this commits also makes the MallocTracer and backtrace symbolication work for dynamically loaded programs.
2020-11-23 15:00:35 -03:00
if (m_emulator.is_in_loader_code())
return;
UserspaceEmulator: Don't complain about free(nullptr)
2020-07-15 18:53:58 -03:00
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
if (auto* mallocation = find_mallocation(address)) {
if (mallocation->freed) {
reportln("\n=={}== \033[31;1mDouble free()\033[0m, {:p}", getpid(), address);
reportln("=={}== Address {} has already been passed to free()", getpid(), address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
} else {
mallocation->freed = true;
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
mallocation->free_backtrace = m_emulator.raw_backtrace();
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return;
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator: Replace printf usages with format. This replaces almost all usages. Some have to remain because 'outf' always appends a newline. (It inherits this behaviour from LogStream.)
2020-09-30 10:30:42 -03:00
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mInvalid free()\033[0m, {:p}", getpid(), address);
reportln("=={}== Address {} has never been returned by malloc()", getpid(), address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator+LibC: Use sys$emuctl() to pass malloc info to UE Get rid of the awkward secret handshake sequence between malloc and UE and simply use sys$emuctl() to notify UE of malloc, free and realloc.
2021-03-09 04:56:35 -03:00
void MallocTracer::target_did_realloc(Badge<Emulator>, FlatPtr address, size_t size)
UserspaceEmulator+LibC: Have UE notice realloc() and update accounting When a mallocation is shrunk/grown without moving, UE needs to update its precise metadata about the mallocation, since it tracks *exactly* how many bytes were allocated, not just the malloc chunk size.
2020-11-08 06:10:41 -03:00
{
UserspaceEmulator: Support dynamically loaded programs When loading dynamic objects, the emulator loads the interpreter, generates an auxiliary vector and starts executing the loader. Additionally, this commits also makes the MallocTracer and backtrace symbolication work for dynamically loaded programs.
2020-11-23 15:00:35 -03:00
if (m_emulator.is_in_loader_code())
return;
UserspaceEmulator: Use ring 3 segment selectors We were using ring 0 selectors everywhere (the bottom 3 bits of a selector determines the ring.) This doesn't really make any practical difference since UE doesn't run code in other rings anyway, but let's have correct-looking segment selectors. :^)
2020-12-25 11:39:26 -03:00
auto* region = m_emulator.mmu().find_region({ 0x23, address });
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 16:42:32 -03:00
VERIFY(region);
Userland: Replace VERIFY(is<T>) with verify_cast<T> Instead of doing a VERIFY(is<T>(x)) and *then* casting it to T, we can just do the cast right away with verify_cast<T>. :^)
2021-06-24 16:13:09 -03:00
auto& mmap_region = verify_cast<MmapRegion>(*region);
UserspaceEmulator+LibC: Have UE notice realloc() and update accounting When a mallocation is shrunk/grown without moving, UE needs to update its precise metadata about the mallocation, since it tracks *exactly* how many bytes were allocated, not just the malloc chunk size.
2020-11-08 06:10:41 -03:00
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 16:42:32 -03:00
VERIFY(mmap_region.is_malloc_block());
UserspaceEmulator+LibC: Have UE notice realloc() and update accounting When a mallocation is shrunk/grown without moving, UE needs to update its precise metadata about the mallocation, since it tracks *exactly* how many bytes were allocated, not just the malloc chunk size.
2020-11-08 06:10:41 -03:00
auto* existing_mallocation = find_mallocation(address);
Everywhere: Rename ASSERT => VERIFY (...and ASSERT_NOT_REACHED => VERIFY_NOT_REACHED) Since all of these checks are done in release builds as well, let's rename them to VERIFY to prevent confusion, as everyone is used to assertions being compiled out in release. We can introduce a new ASSERT macro that is specifically for debug checks, but I'm doing this wholesale conversion first since we've accumulated thousands of these already, and it's not immediately obvious which ones are suitable for ASSERT.
2021-02-23 16:42:32 -03:00
VERIFY(existing_mallocation);
VERIFY(!existing_mallocation->freed);
UserspaceEmulator+LibC: Have UE notice realloc() and update accounting When a mallocation is shrunk/grown without moving, UE needs to update its precise metadata about the mallocation, since it tracks *exactly* how many bytes were allocated, not just the malloc chunk size.
2020-11-08 06:10:41 -03:00
size_t old_size = existing_mallocation->size;
auto* shadow_bits = mmap_region.shadow_data() + address - mmap_region.base();
if (size > old_size) {
memset(shadow_bits + old_size, 1, size - old_size);
} else {
memset(shadow_bits + size, 1, old_size - size);
}
existing_mallocation->size = size;
// FIXME: Should we track malloc/realloc backtrace separately perhaps?
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
existing_mallocation->malloc_backtrace = m_emulator.raw_backtrace();
UserspaceEmulator+LibC: Have UE notice realloc() and update accounting When a mallocation is shrunk/grown without moving, UE needs to update its precise metadata about the mallocation, since it tracks *exactly* how many bytes were allocated, not just the malloc chunk size.
2020-11-08 06:10:41 -03:00
}
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
Mallocation* MallocTracer::find_mallocation(FlatPtr address)
{
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
auto* region = m_emulator.mmu().find_region({ 0x23, address });
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
if (!region)
return nullptr;
return find_mallocation(*region, address);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
Mallocation* MallocTracer::find_mallocation_before(FlatPtr address)
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
{
Mallocation* found_mallocation = nullptr;
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
for_each_mallocation([&](auto& mallocation) {
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (mallocation.address >= address)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (!found_mallocation || (mallocation.address > found_mallocation->address))
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
found_mallocation = const_cast<Mallocation*>(&mallocation);
return IterationDecision::Continue;
});
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
return found_mallocation;
}
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
Mallocation* MallocTracer::find_mallocation_after(FlatPtr address)
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
{
Mallocation* found_mallocation = nullptr;
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
for_each_mallocation([&](auto& mallocation) {
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
if (mallocation.address <= address)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
if (!found_mallocation || (mallocation.address < found_mallocation->address))
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
found_mallocation = const_cast<Mallocation*>(&mallocation);
return IterationDecision::Continue;
});
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
return found_mallocation;
}
Everywhere: Run clang-format
2022-04-01 14:58:27 -03:00
void MallocTracer::audit_read(Region const& region, FlatPtr address, size_t size)
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
{
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (!m_auditing_enabled)
return;
UserspaceEmulator+LibC: Use sys$emuctl() to disable auditing in malloc It was fragile to use the address of the body of the memory management functions to disable memory auditing within them. Functions called from these did not get exempted from the audits, so in some cases UserspaceEmulator reported bogus heap buffer overflows. Memory auditing did not work at all on Clang because when querying the addresses, their offset was taken relative to the base of `.text` which is not the first segment in the `R/RX/RW(RELRO)/RW(non-RELRO)` layout produced by LLD. Similarly to when setting metadata about the allocations, we now use the `emuctl` system call to selectively suppress auditing when we reach these functions. This ensures that functions called from `malloc` are affected too, and no issues occur because of the inconsistency between Clang and GCC memory layouts.
2021-08-14 11:15:32 -03:00
if (m_emulator.is_memory_auditing_suppressed()) {
return;
}
if (m_emulator.is_in_libsystem()) {
UserspaceEmulator: Support dynamically loaded programs When loading dynamic objects, the emulator loads the interpreter, generates an auxiliary vector and starts executing the loader. Additionally, this commits also makes the MallocTracer and backtrace symbolication work for dynamically loaded programs.
2020-11-23 15:00:35 -03:00
return;
}
if (m_emulator.is_in_loader_code()) {
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator: Support dynamically loaded programs When loading dynamic objects, the emulator loads the interpreter, generates an auxiliary vector and starts executing the loader. Additionally, this commits also makes the MallocTracer and backtrace symbolication work for dynamically loaded programs.
2020-11-23 15:00:35 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
auto* mallocation = find_mallocation(region, address);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (!mallocation) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mHeap buffer overflow\033[0m, invalid {}-byte read at address {:p}", getpid(), size, address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
auto* mallocation_before = find_mallocation_before(address);
auto* mallocation_after = find_mallocation_after(address);
size_t distance_to_mallocation_before = mallocation_before ? (address - mallocation_before->address - mallocation_before->size) : 0;
size_t distance_to_mallocation_after = mallocation_after ? (mallocation_after->address - address) : 0;
if (mallocation_before && (!mallocation_after || distance_to_mallocation_before < distance_to_mallocation_after)) {
reportln("=={}== Address is {} byte(s) after block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_before, mallocation_before->size, mallocation_before->address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation_before->malloc_backtrace);
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
return;
}
if (mallocation_after && (!mallocation_before || distance_to_mallocation_after < distance_to_mallocation_before)) {
reportln("=={}== Address is {} byte(s) before block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_after, mallocation_after->size, mallocation_after->address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation_after->malloc_backtrace);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
size_t offset_into_mallocation = address - mallocation->address;
if (mallocation->freed) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mUse-after-free\033[0m, invalid {}-byte read at address {:p}", getpid(), size, address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Address is {} byte(s) into block of size {}, allocated at:", getpid(), offset_into_mallocation, mallocation->size);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation->malloc_backtrace);
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Later freed at:", getpid());
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation->free_backtrace);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
}
Everywhere: Run clang-format
2022-04-01 14:58:27 -03:00
void MallocTracer::audit_write(Region const& region, FlatPtr address, size_t size)
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
{
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (!m_auditing_enabled)
return;
UserspaceEmulator+LibC: Use sys$emuctl() to disable auditing in malloc It was fragile to use the address of the body of the memory management functions to disable memory auditing within them. Functions called from these did not get exempted from the audits, so in some cases UserspaceEmulator reported bogus heap buffer overflows. Memory auditing did not work at all on Clang because when querying the addresses, their offset was taken relative to the base of `.text` which is not the first segment in the `R/RX/RW(RELRO)/RW(non-RELRO)` layout produced by LLD. Similarly to when setting metadata about the allocations, we now use the `emuctl` system call to selectively suppress auditing when we reach these functions. This ensures that functions called from `malloc` are affected too, and no issues occur because of the inconsistency between Clang and GCC memory layouts.
2021-08-14 11:15:32 -03:00
if (m_emulator.is_memory_auditing_suppressed()) {
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator+LibC: Use sys$emuctl() to disable auditing in malloc It was fragile to use the address of the body of the memory management functions to disable memory auditing within them. Functions called from these did not get exempted from the audits, so in some cases UserspaceEmulator reported bogus heap buffer overflows. Memory auditing did not work at all on Clang because when querying the addresses, their offset was taken relative to the base of `.text` which is not the first segment in the `R/RX/RW(RELRO)/RW(non-RELRO)` layout produced by LLD. Similarly to when setting metadata about the allocations, we now use the `emuctl` system call to selectively suppress auditing when we reach these functions. This ensures that functions called from `malloc` are affected too, and no issues occur because of the inconsistency between Clang and GCC memory layouts.
2021-08-14 11:15:32 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
UserspaceEmulator: Support dynamically loaded programs When loading dynamic objects, the emulator loads the interpreter, generates an auxiliary vector and starts executing the loader. Additionally, this commits also makes the MallocTracer and backtrace symbolication work for dynamically loaded programs.
2020-11-23 15:00:35 -03:00
if (m_emulator.is_in_loader_code()) {
return;
}
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
auto* mallocation = find_mallocation(region, address);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (!mallocation) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mHeap buffer overflow\033[0m, invalid {}-byte write at address {:p}", getpid(), size, address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
auto* mallocation_before = find_mallocation_before(address);
auto* mallocation_after = find_mallocation_after(address);
size_t distance_to_mallocation_before = mallocation_before ? (address - mallocation_before->address - mallocation_before->size) : 0;
size_t distance_to_mallocation_after = mallocation_after ? (mallocation_after->address - address) : 0;
if (mallocation_before && (!mallocation_after || distance_to_mallocation_before < distance_to_mallocation_after)) {
reportln("=={}== Address is {} byte(s) after block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_before, mallocation_before->size, mallocation_before->address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation_before->malloc_backtrace);
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
return;
}
if (mallocation_after && (!mallocation_before || distance_to_mallocation_after < distance_to_mallocation_before)) {
reportln("=={}== Address is {} byte(s) before block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_after, mallocation_after->size, mallocation_after->address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation_after->malloc_backtrace);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
size_t offset_into_mallocation = address - mallocation->address;
if (mallocation->freed) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mUse-after-free\033[0m, invalid {}-byte write at address {:p}", getpid(), size, address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Address is {} byte(s) into block of size {}, allocated at:", getpid(), offset_into_mallocation, mallocation->size);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation->malloc_backtrace);
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Later freed at:", getpid());
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation->free_backtrace);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
}
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
void MallocTracer::populate_memory_graph()
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
{
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
// Create Node for each live Mallocation
for_each_mallocation([&](auto& mallocation) {
if (mallocation.freed)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
m_memory_graph.set(mallocation.address, {});
return IterationDecision::Continue;
});
// Find pointers from each memory region to another
for_each_mallocation([&](auto& mallocation) {
if (mallocation.freed)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
size_t pointers_in_mallocation = mallocation.size / sizeof(u32);
auto& edges_from_mallocation = m_memory_graph.find(mallocation.address)->value;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
for (size_t i = 0; i < pointers_in_mallocation; ++i) {
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
auto value = m_emulator.mmu().read32({ 0x23, mallocation.address + i * sizeof(u32) });
auto other_address = value.value();
if (!value.is_uninitialized() && m_memory_graph.contains(value.value())) {
Everywhere: Turn #if *_DEBUG into dbgln_if/if constexpr
2021-05-01 16:10:08 -03:00
if constexpr (REACHABLE_DEBUG)
reportln("region/mallocation {:p} is reachable from other mallocation {:p}", other_address, mallocation.address);
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
edges_from_mallocation.edges_from_node.append(other_address);
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
}
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
});
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
// Find mallocations that are pointed to by other regions
Vector<FlatPtr> reachable_mallocations = {};
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.mmu().for_each_region([&](auto& region) {
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
// Skip the stack
if (region.is_stack())
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Don't scan text segment for malloc leaks There will be no (true positive) malloc addresses in the text segment.
2020-07-16 14:27:03 -03:00
if (region.is_text())
return IterationDecision::Continue;
UserspaceEmulator: Support dynamically loaded programs When loading dynamic objects, the emulator loads the interpreter, generates an auxiliary vector and starts executing the loader. Additionally, this commits also makes the MallocTracer and backtrace symbolication work for dynamically loaded programs.
2020-11-23 15:00:35 -03:00
if (!region.is_readable())
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
// Skip malloc blocks
UserspaceEmulator: Remove hand-rolled is_foo() helpers in favor of RTTI
2021-01-01 15:37:36 -03:00
if (is<MmapRegion>(region) && static_cast<const MmapRegion&>(region).is_malloc_block())
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
size_t pointers_in_region = region.size() / sizeof(u32);
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
for (size_t i = 0; i < pointers_in_region; ++i) {
auto value = region.read32(i * sizeof(u32));
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
auto other_address = value.value();
if (!value.is_uninitialized() && m_memory_graph.contains(value.value())) {
Everywhere: Turn #if *_DEBUG into dbgln_if/if constexpr
2021-05-01 16:10:08 -03:00
if constexpr (REACHABLE_DEBUG)
reportln("region/mallocation {:p} is reachable from region {:p}-{:p}", other_address, region.base(), region.end() - 1);
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
m_memory_graph.find(other_address)->value.is_reachable = true;
reachable_mallocations.append(other_address);
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
}
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
return IterationDecision::Continue;
});
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
// Propagate reachability
// There are probably better ways to do that
Vector<FlatPtr> visited = {};
for (size_t i = 0; i < reachable_mallocations.size(); ++i) {
auto reachable = reachable_mallocations.at(i);
if (visited.contains_slow(reachable))
continue;
visited.append(reachable);
auto& mallocation_node = m_memory_graph.find(reachable)->value;
if (!mallocation_node.is_reachable)
mallocation_node.is_reachable = true;
for (auto& edge : mallocation_node.edges_from_node) {
reachable_mallocations.append(edge);
}
}
}
void MallocTracer::dump_memory_graph()
{
for (auto& key : m_memory_graph.keys()) {
auto value = m_memory_graph.find(key)->value;
dbgln("Block {:p} [{}reachable] ({} edges)", key, !value.is_reachable ? "not " : "", value.edges_from_node.size());
for (auto& edge : value.edges_from_node) {
dbgln(" -> {:p}", edge);
}
}
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
void MallocTracer::dump_leak_report()
{
TemporaryChange change(m_auditing_enabled, false);
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
size_t bytes_leaked = 0;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
size_t leaks_found = 0;
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
populate_memory_graph();
Everywhere: Turn #if *_DEBUG into dbgln_if/if constexpr
2021-05-01 16:10:08 -03:00
if constexpr (REACHABLE_DEBUG)
dump_memory_graph();
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
for_each_mallocation([&](auto& mallocation) {
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (mallocation.freed)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Improve detection of memory leaks Previous a mallocation was marked as 'reachable' when any other mallocation or memory region had a pointer to that mallocation. However there could be the situation that two mallocations have pointers to each other while still being unreachable from anywhere else. They would be marked as 'reachable' regardless. This patch replaces the old way of detemining whether a mallocation is reachable by analyzing the dependencies of the different mallocations using a graph-approach. Now mallocations are only reachable if pointed to by other reachable mallocations or other memory regions. A nice bonus is that this gets rid of a nested for_each_mallocation, so the complexity of leak finding becomes linear instead of quadratic.
2021-04-09 19:29:20 -03:00
auto& value = m_memory_graph.find(mallocation.address)->value;
if (value.is_reachable)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
++leaks_found;
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
bytes_leaked += mallocation.size;
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mLeak\033[0m, {}-byte allocation at address {:p}", getpid(), mallocation.size, mallocation.address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation.malloc_backtrace);
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
});
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
if (!leaks_found)
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[32;1mNo leaks found!\033[0m", getpid());
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
else
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1m{} leak(s) found: {} byte(s) leaked\033[0m", getpid(), leaks_found, bytes_leaked);
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
Reference in a new issue Copy permalink