dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ladybird/DevTools/UserspaceEmulator/MallocTracer.cpp

362 lines
15 KiB
C++
Raw Normal View History

UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
/*
* Copyright (c) 2020, Andreas Kling <kling@serenityos.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "MallocTracer.h"
#include "Emulator.h"
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
#include "MmapRegion.h"
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
#include <AK/LogStream.h>
Everywhere: Add missing <AK/TemporaryChange.h> includes Don't rely on HashTable.h pulling this in.
2020-10-15 15:46:52 -03:00
#include <AK/TemporaryChange.h>
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
#include <mallocdefs.h>
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
#include <string.h>
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
//#define REACHABLE_DEBUG
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
namespace UserspaceEmulator {
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
MallocTracer::MallocTracer(Emulator& emulator)
: m_emulator(emulator)
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
{
}
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
template<typename Callback>
inline void MallocTracer::for_each_mallocation(Callback callback) const
UserspaceEmulator: Forget ChunkedBlocks after they are munmap()'ed This is not ideal since we lose free() backtraces, but it will require some thinking to get this right.
2020-11-14 19:07:07 -03:00
{
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.mmu().for_each_region([&](auto& region) {
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
if (region.is_mmap() && static_cast<const MmapRegion&>(region).is_malloc_block()) {
auto* malloc_data = static_cast<MmapRegion&>(region).malloc_metadata();
for (auto& mallocation : malloc_data->mallocations) {
if (mallocation.used && callback(mallocation) == IterationDecision::Break)
return IterationDecision::Break;
}
}
return IterationDecision::Continue;
});
UserspaceEmulator: Forget ChunkedBlocks after they are munmap()'ed This is not ideal since we lose free() backtraces, but it will require some thinking to get this right.
2020-11-14 19:07:07 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
void MallocTracer::target_did_malloc(Badge<SoftCPU>, FlatPtr address, size_t size)
{
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
auto* region = m_emulator.mmu().find_region({ 0x20, address });
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
ASSERT(region);
ASSERT(region->is_mmap());
auto& mmap_region = static_cast<MmapRegion&>(*region);
UserspaceEmulator: Mark mmap regions as malloc blocks when mallocing We don't have to be clever at all to figure out which MmapRegions are malloc blocks, we can just mark the containing region as such when the emulated process performs a malloc! :^)
2020-08-01 04:13:45 -03:00
// Mark the containing mmap region as a malloc block!
mmap_region.set_malloc(true);
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
auto* shadow_bits = mmap_region.shadow_data() + address - mmap_region.base();
memset(shadow_bits, 0, size);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
if (auto* existing_mallocation = find_mallocation(address)) {
ASSERT(existing_mallocation->freed);
existing_mallocation->size = size;
existing_mallocation->freed = false;
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
existing_mallocation->malloc_backtrace = m_emulator.raw_backtrace();
UserspaceEmulator: Reset malloc backtrace on mallocation reuse If a previously-freed malloc chunk is reused, forget any old backtraces and save a new malloc backtrace.
2020-07-16 15:55:41 -03:00
existing_mallocation->free_backtrace.clear();
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
MallocRegionMetadata* malloc_data = static_cast<MmapRegion&>(*region).malloc_metadata();
if (!malloc_data) {
auto new_malloc_data = make<MallocRegionMetadata>();
malloc_data = new_malloc_data.ptr();
static_cast<MmapRegion&>(*region).set_malloc_metadata({}, move(new_malloc_data));
malloc_data->address = region->base();
malloc_data->chunk_size = mmap_region.read32(offsetof(CommonHeader, m_size)).value();
bool is_chunked_block = malloc_data->chunk_size <= size_classes[num_size_classes - 1];
if (is_chunked_block)
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
malloc_data->mallocations.resize((ChunkedBlock::block_size - sizeof(ChunkedBlock)) / malloc_data->chunk_size);
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
else
malloc_data->mallocations.resize(1);
dbgln("Tracking malloc block @ {:p} with chunk_size={}, chunk_count={}", malloc_data->address, malloc_data->chunk_size, malloc_data->mallocations.size());
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
}
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
malloc_data->mallocation_for_address(address) = { address, size, true, false, m_emulator.raw_backtrace(), Vector<FlatPtr>() };
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
ALWAYS_INLINE Mallocation& MallocRegionMetadata::mallocation_for_address(FlatPtr address) const
UserspaceEmulator: Add some helpers to tidy up TrackedChunkedBlock
2020-11-14 14:36:17 -03:00
{
return const_cast<Mallocation&>(this->mallocations[chunk_index_for_address(address)]);
}
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
ALWAYS_INLINE size_t MallocRegionMetadata::chunk_index_for_address(FlatPtr address) const
UserspaceEmulator: Add some helpers to tidy up TrackedChunkedBlock
2020-11-14 14:36:17 -03:00
{
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
bool is_chunked_block = chunk_size <= size_classes[num_size_classes - 1];
if (!is_chunked_block) {
// This is a BigAllocationBlock
return 0;
}
UserspaceEmulator: Add some helpers to tidy up TrackedChunkedBlock
2020-11-14 14:36:17 -03:00
auto chunk_offset = address - (this->address + sizeof(ChunkedBlock));
return chunk_offset / this->chunk_size;
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
void MallocTracer::target_did_free(Badge<SoftCPU>, FlatPtr address)
{
UserspaceEmulator: Don't complain about free(nullptr)
2020-07-15 18:53:58 -03:00
if (!address)
return;
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
if (auto* mallocation = find_mallocation(address)) {
if (mallocation->freed) {
reportln("\n=={}== \033[31;1mDouble free()\033[0m, {:p}", getpid(), address);
reportln("=={}== Address {} has already been passed to free()", getpid(), address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
} else {
mallocation->freed = true;
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
mallocation->free_backtrace = m_emulator.raw_backtrace();
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return;
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator: Replace printf usages with format. This replaces almost all usages. Some have to remain because 'outf' always appends a newline. (It inherits this behaviour from LogStream.)
2020-09-30 10:30:42 -03:00
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mInvalid free()\033[0m, {:p}", getpid(), address);
reportln("=={}== Address {} has never been returned by malloc()", getpid(), address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator+LibC: Have UE notice realloc() and update accounting When a mallocation is shrunk/grown without moving, UE needs to update its precise metadata about the mallocation, since it tracks *exactly* how many bytes were allocated, not just the malloc chunk size.
2020-11-08 06:10:41 -03:00
void MallocTracer::target_did_realloc(Badge<SoftCPU>, FlatPtr address, size_t size)
{
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
auto* region = m_emulator.mmu().find_region({ 0x20, address });
UserspaceEmulator+LibC: Have UE notice realloc() and update accounting When a mallocation is shrunk/grown without moving, UE needs to update its precise metadata about the mallocation, since it tracks *exactly* how many bytes were allocated, not just the malloc chunk size.
2020-11-08 06:10:41 -03:00
ASSERT(region);
ASSERT(region->is_mmap());
auto& mmap_region = static_cast<MmapRegion&>(*region);
ASSERT(mmap_region.is_malloc_block());
auto* existing_mallocation = find_mallocation(address);
ASSERT(existing_mallocation);
ASSERT(!existing_mallocation->freed);
size_t old_size = existing_mallocation->size;
auto* shadow_bits = mmap_region.shadow_data() + address - mmap_region.base();
if (size > old_size) {
memset(shadow_bits + old_size, 1, size - old_size);
} else {
memset(shadow_bits + size, 1, old_size - size);
}
existing_mallocation->size = size;
// FIXME: Should we track malloc/realloc backtrace separately perhaps?
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
existing_mallocation->malloc_backtrace = m_emulator.raw_backtrace();
UserspaceEmulator+LibC: Have UE notice realloc() and update accounting When a mallocation is shrunk/grown without moving, UE needs to update its precise metadata about the mallocation, since it tracks *exactly* how many bytes were allocated, not just the malloc chunk size.
2020-11-08 06:10:41 -03:00
}
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
Mallocation* MallocTracer::find_mallocation(FlatPtr address)
{
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
auto* region = m_emulator.mmu().find_region({ 0x23, address });
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
if (!region)
return nullptr;
return find_mallocation(*region, address);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
Mallocation* MallocTracer::find_mallocation_before(FlatPtr address)
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
{
Mallocation* found_mallocation = nullptr;
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
for_each_mallocation([&](auto& mallocation) {
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (mallocation.address >= address)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (!found_mallocation || (mallocation.address > found_mallocation->address))
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
found_mallocation = const_cast<Mallocation*>(&mallocation);
return IterationDecision::Continue;
});
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
return found_mallocation;
}
UserspaceEmulator: Hang malloc metadata on malloc block MmapRegions Instead of tracking known malloc blocks in a separate hash table, add an optional malloc metadata pointer to MmapRegion. This makes finding the malloc metadata for a given pointer extremely fast since it can piggyback on the page table array. :^)
2020-11-16 05:33:30 -03:00
Mallocation* MallocTracer::find_mallocation_after(FlatPtr address)
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
{
Mallocation* found_mallocation = nullptr;
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
for_each_mallocation([&](auto& mallocation) {
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
if (mallocation.address <= address)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
if (!found_mallocation || (mallocation.address < found_mallocation->address))
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
found_mallocation = const_cast<Mallocation*>(&mallocation);
return IterationDecision::Continue;
});
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
return found_mallocation;
}
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
void MallocTracer::audit_read(const Region& region, FlatPtr address, size_t size)
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
{
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (!m_auditing_enabled)
return;
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
if (m_emulator.is_in_malloc_or_free())
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
auto* mallocation = find_mallocation(region, address);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (!mallocation) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mHeap buffer overflow\033[0m, invalid {}-byte read at address {:p}", getpid(), size, address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
auto* mallocation_before = find_mallocation_before(address);
auto* mallocation_after = find_mallocation_after(address);
size_t distance_to_mallocation_before = mallocation_before ? (address - mallocation_before->address - mallocation_before->size) : 0;
size_t distance_to_mallocation_after = mallocation_after ? (mallocation_after->address - address) : 0;
if (mallocation_before && (!mallocation_after || distance_to_mallocation_before < distance_to_mallocation_after)) {
reportln("=={}== Address is {} byte(s) after block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_before, mallocation_before->size, mallocation_before->address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation_before->malloc_backtrace);
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
return;
}
if (mallocation_after && (!mallocation_before || distance_to_mallocation_after < distance_to_mallocation_before)) {
reportln("=={}== Address is {} byte(s) before block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_after, mallocation_after->size, mallocation_after->address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation_after->malloc_backtrace);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
size_t offset_into_mallocation = address - mallocation->address;
if (mallocation->freed) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mUse-after-free\033[0m, invalid {}-byte read at address {:p}", getpid(), size, address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Address is {} byte(s) into block of size {}, allocated at:", getpid(), offset_into_mallocation, mallocation->size);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation->malloc_backtrace);
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Later freed at:", getpid());
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation->free_backtrace);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
}
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
void MallocTracer::audit_write(const Region& region, FlatPtr address, size_t size)
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
{
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (!m_auditing_enabled)
return;
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
if (m_emulator.is_in_malloc_or_free())
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator: Make big malloc block lookup O(1) as well By passing the Region& to the auditing functions, we know exactly which block we are hitting. This allows us to track big mallocations the same way we already do chunked ones. This gets rid of the O(n) scan in find_mallocation() for allocations larger than the maximum malloc chunk size. :^)
2020-11-16 09:18:28 -03:00
auto* mallocation = find_mallocation(region, address);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (!mallocation) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mHeap buffer overflow\033[0m, invalid {}-byte write at address {:p}", getpid(), size, address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
auto* mallocation_before = find_mallocation_before(address);
auto* mallocation_after = find_mallocation_after(address);
size_t distance_to_mallocation_before = mallocation_before ? (address - mallocation_before->address - mallocation_before->size) : 0;
size_t distance_to_mallocation_after = mallocation_after ? (mallocation_after->address - address) : 0;
if (mallocation_before && (!mallocation_after || distance_to_mallocation_before < distance_to_mallocation_after)) {
reportln("=={}== Address is {} byte(s) after block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_before, mallocation_before->size, mallocation_before->address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation_before->malloc_backtrace);
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
return;
}
if (mallocation_after && (!mallocation_before || distance_to_mallocation_after < distance_to_mallocation_before)) {
reportln("=={}== Address is {} byte(s) before block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_after, mallocation_after->size, mallocation_after->address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation_after->malloc_backtrace);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
size_t offset_into_mallocation = address - mallocation->address;
if (mallocation->freed) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mUse-after-free\033[0m, invalid {}-byte write at address {:p}", getpid(), size, address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace();
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Address is {} byte(s) into block of size {}, allocated at:", getpid(), offset_into_mallocation, mallocation->size);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation->malloc_backtrace);
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Later freed at:", getpid());
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation->free_backtrace);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
}
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
bool MallocTracer::is_reachable(const Mallocation& mallocation) const
{
ASSERT(!mallocation.freed);
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
bool reachable = false;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
// 1. Search in active (non-freed) mallocations for pointers to this mallocation
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
for_each_mallocation([&](auto& other_mallocation) {
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (&mallocation == &other_mallocation)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Skip freed mallocations in reachability scan Something being reachable from a freed mallocation doesn't make it actually reachable. Thanks to Jonas Bengtsson for spotting this! :^)
2020-07-16 19:24:23 -03:00
if (other_mallocation.freed)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
size_t pointers_in_mallocation = other_mallocation.size / sizeof(u32);
for (size_t i = 0; i < pointers_in_mallocation; ++i) {
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
auto value = m_emulator.mmu().read32({ 0x20, other_mallocation.address + i * sizeof(u32) });
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
if (value.value() == mallocation.address && !value.is_uninitialized()) {
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
#ifdef REACHABLE_DEBUG
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("mallocation {:p} is reachable from other mallocation {:p}", mallocation.address, other_mallocation.address);
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
#endif
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
reachable = true;
return IterationDecision::Break;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
}
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
});
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
if (reachable)
return true;
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
// 2. Search in other memory regions for pointers to this mallocation
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.mmu().for_each_region([&](auto& region) {
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
// Skip the stack
if (region.is_stack())
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Don't scan text segment for malloc leaks There will be no (true positive) malloc addresses in the text segment.
2020-07-16 14:27:03 -03:00
if (region.is_text())
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
// Skip malloc blocks
if (region.is_mmap() && static_cast<const MmapRegion&>(region).is_malloc_block())
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
size_t pointers_in_region = region.size() / sizeof(u32);
for (size_t i = 0; i < pointers_in_region; ++i) {
auto value = region.read32(i * sizeof(u32));
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
if (value.value() == mallocation.address && !value.is_uninitialized()) {
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
#ifdef REACHABLE_DEBUG
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("mallocation {:p} is reachable from region {:p}-{:p}", mallocation.address, region.base(), region.end() - 1);
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
#endif
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
reachable = true;
return IterationDecision::Break;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
}
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
return IterationDecision::Continue;
});
return reachable;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
void MallocTracer::dump_leak_report()
{
TemporaryChange change(m_auditing_enabled, false);
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
size_t bytes_leaked = 0;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
size_t leaks_found = 0;
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
for_each_mallocation([&](auto& mallocation) {
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (mallocation.freed)
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (is_reachable(mallocation))
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
++leaks_found;
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
bytes_leaked += mallocation.size;
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mLeak\033[0m, {}-byte allocation at address {:p}", getpid(), mallocation.size, mallocation.address);
UserspaceEmulator: Keep Emulator& closer to the action in some places This avoids the cost of calling Emulator::the() in some very hot paths.
2020-11-16 10:39:05 -03:00
m_emulator.dump_backtrace(mallocation.malloc_backtrace);
UserspaceEmulator: Track malloc ChunkedBlocks for faster auditing Instead of doing an O(n) scan over all the mallocations whenever we're doing a read/write audit, UE now keeps track of ChunkedBlocks and their chunks. Both the block lookup and the chunk lookup is O(1). We know what ChunkedBlocks look like via mallocdefs.h from LibC. Note that the old linear scan is still in use for big mallocations, but the vast majority of mallocations are chunked, so this helps a lot. This makes malloc auditing significantly faster! :^)
2020-11-14 14:27:08 -03:00
return IterationDecision::Continue;
});
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
if (!leaks_found)
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[32;1mNo leaks found!\033[0m", getpid());
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
else
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1m{} leak(s) found: {} byte(s) leaked\033[0m", getpid(), leaks_found, bytes_leaked);
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
Reference in a new issue Copy permalink