dmaax/ladybird
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
ladybird/DevTools/UserspaceEmulator/MallocTracer.cpp

309 lines
13 KiB
C++
Raw Normal View History

UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
/*
* Copyright (c) 2020, Andreas Kling <kling@serenityos.org>
* All rights reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions are met:
*
* 1. Redistributions of source code must retain the above copyright notice, this
* list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright notice,
* this list of conditions and the following disclaimer in the documentation
* and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
* AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
* SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
* CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
#include "MallocTracer.h"
#include "Emulator.h"
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
#include "MmapRegion.h"
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
#include <AK/LogStream.h>
Everywhere: Add missing <AK/TemporaryChange.h> includes Don't rely on HashTable.h pulling this in.
2020-10-15 15:46:52 -03:00
#include <AK/TemporaryChange.h>
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
#include <string.h>
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
//#define REACHABLE_DEBUG
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
namespace UserspaceEmulator {
MallocTracer::MallocTracer()
{
}
void MallocTracer::target_did_malloc(Badge<SoftCPU>, FlatPtr address, size_t size)
{
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
auto* region = Emulator::the().mmu().find_region({ 0x20, address });
ASSERT(region);
ASSERT(region->is_mmap());
auto& mmap_region = static_cast<MmapRegion&>(*region);
UserspaceEmulator: Mark mmap regions as malloc blocks when mallocing We don't have to be clever at all to figure out which MmapRegions are malloc blocks, we can just mark the containing region as such when the emulated process performs a malloc! :^)
2020-08-01 04:13:45 -03:00
// Mark the containing mmap region as a malloc block!
mmap_region.set_malloc(true);
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
auto* shadow_bits = mmap_region.shadow_data() + address - mmap_region.base();
memset(shadow_bits, 0, size);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
if (auto* existing_mallocation = find_mallocation(address)) {
ASSERT(existing_mallocation->freed);
existing_mallocation->size = size;
existing_mallocation->freed = false;
UserspaceEmulator: Reset malloc backtrace on mallocation reuse If a previously-freed malloc chunk is reused, forget any old backtraces and save a new malloc backtrace.
2020-07-16 15:55:41 -03:00
existing_mallocation->malloc_backtrace = Emulator::the().raw_backtrace();
existing_mallocation->free_backtrace.clear();
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
UserspaceEmulator: Capture backtraces of malloc/free events This lets us show backtraces for each leaked mallocation in the leak report at the end. :^)
2020-07-16 12:14:58 -03:00
m_mallocations.append({ address, size, false, Emulator::the().raw_backtrace(), Vector<FlatPtr>() });
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
void MallocTracer::target_did_free(Badge<SoftCPU>, FlatPtr address)
{
UserspaceEmulator: Don't complain about free(nullptr)
2020-07-15 18:53:58 -03:00
if (!address)
return;
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
for (auto& mallocation : m_mallocations) {
if (mallocation.address == address) {
UserspaceEmulator: Log invalid and double free() calls :^) We can easily catch free() on never-malloced addresses, as well as double calls to free() on the same address, so let's do it!
2020-07-15 18:23:21 -03:00
if (mallocation.freed) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mDouble free()\033[0m, {:p}", getpid(), address);
reportln("=={}== Address {} has already been passed to free()", getpid(), address);
UserspaceEmulator: Log invalid and double free() calls :^) We can easily catch free() on never-malloced addresses, as well as double calls to free() on the same address, so let's do it!
2020-07-15 18:23:21 -03:00
Emulator::the().dump_backtrace();
UserspaceEmulator: Capture backtraces of malloc/free events This lets us show backtraces for each leaked mallocation in the leak report at the end. :^)
2020-07-16 12:14:58 -03:00
} else {
mallocation.freed = true;
mallocation.free_backtrace = Emulator::the().raw_backtrace();
UserspaceEmulator: Log invalid and double free() calls :^) We can easily catch free() on never-malloced addresses, as well as double calls to free() on the same address, so let's do it!
2020-07-15 18:23:21 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
}
UserspaceEmulator: Replace printf usages with format. This replaces almost all usages. Some have to remain because 'outf' always appends a newline. (It inherits this behaviour from LogStream.)
2020-09-30 10:30:42 -03:00
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mInvalid free()\033[0m, {:p}", getpid(), address);
reportln("=={}== Address {} has never been returned by malloc()", getpid(), address);
UserspaceEmulator: Log invalid and double free() calls :^) We can easily catch free() on never-malloced addresses, as well as double calls to free() on the same address, so let's do it!
2020-07-15 18:23:21 -03:00
Emulator::the().dump_backtrace();
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
UserspaceEmulator+LibC: Have UE notice realloc() and update accounting When a mallocation is shrunk/grown without moving, UE needs to update its precise metadata about the mallocation, since it tracks *exactly* how many bytes were allocated, not just the malloc chunk size.
2020-11-08 06:10:41 -03:00
void MallocTracer::target_did_realloc(Badge<SoftCPU>, FlatPtr address, size_t size)
{
auto* region = Emulator::the().mmu().find_region({ 0x20, address });
ASSERT(region);
ASSERT(region->is_mmap());
auto& mmap_region = static_cast<MmapRegion&>(*region);
ASSERT(mmap_region.is_malloc_block());
auto* existing_mallocation = find_mallocation(address);
ASSERT(existing_mallocation);
ASSERT(!existing_mallocation->freed);
size_t old_size = existing_mallocation->size;
auto* shadow_bits = mmap_region.shadow_data() + address - mmap_region.base();
if (size > old_size) {
memset(shadow_bits + old_size, 1, size - old_size);
} else {
memset(shadow_bits + size, 1, old_size - size);
}
existing_mallocation->size = size;
// FIXME: Should we track malloc/realloc backtrace separately perhaps?
existing_mallocation->malloc_backtrace = Emulator::the().raw_backtrace();
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
MallocTracer::Mallocation* MallocTracer::find_mallocation(FlatPtr address)
{
for (auto& mallocation : m_mallocations) {
if (mallocation.contains(address))
return &mallocation;
}
return nullptr;
}
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
MallocTracer::Mallocation* MallocTracer::find_mallocation_before(FlatPtr address)
{
Mallocation* found_mallocation = nullptr;
for (auto& mallocation : m_mallocations) {
if (mallocation.address >= address)
continue;
if (!found_mallocation || (mallocation.address > found_mallocation->address))
found_mallocation = &mallocation;
}
return found_mallocation;
}
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
MallocTracer::Mallocation* MallocTracer::find_mallocation_after(FlatPtr address)
{
Mallocation* found_mallocation = nullptr;
for (auto& mallocation : m_mallocations) {
if (mallocation.address <= address)
continue;
if (!found_mallocation || (mallocation.address < found_mallocation->address))
found_mallocation = &mallocation;
}
return found_mallocation;
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
void MallocTracer::audit_read(FlatPtr address, size_t size)
{
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (!m_auditing_enabled)
return;
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
if (Emulator::the().is_in_malloc_or_free())
return;
auto* mallocation = find_mallocation(address);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (!mallocation) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mHeap buffer overflow\033[0m, invalid {}-byte read at address {:p}", getpid(), size, address);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
Emulator::the().dump_backtrace();
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
auto* mallocation_before = find_mallocation_before(address);
auto* mallocation_after = find_mallocation_after(address);
size_t distance_to_mallocation_before = mallocation_before ? (address - mallocation_before->address - mallocation_before->size) : 0;
size_t distance_to_mallocation_after = mallocation_after ? (mallocation_after->address - address) : 0;
if (mallocation_before && (!mallocation_after || distance_to_mallocation_before < distance_to_mallocation_after)) {
reportln("=={}== Address is {} byte(s) after block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_before, mallocation_before->size, mallocation_before->address);
Emulator::the().dump_backtrace(mallocation_before->malloc_backtrace);
return;
}
if (mallocation_after && (!mallocation_before || distance_to_mallocation_after < distance_to_mallocation_before)) {
reportln("=={}== Address is {} byte(s) before block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_after, mallocation_after->size, mallocation_after->address);
Emulator::the().dump_backtrace(mallocation_after->malloc_backtrace);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
size_t offset_into_mallocation = address - mallocation->address;
if (mallocation->freed) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mUse-after-free\033[0m, invalid {}-byte read at address {:p}", getpid(), size, address);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
Emulator::the().dump_backtrace();
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Address is {} byte(s) into block of size {}, allocated at:", getpid(), offset_into_mallocation, mallocation->size);
UserspaceEmulator: Include malloc/free backtraces in UAF logs :^) When catching a use-after-free, we now also print out the backtraces for where the memory was allocated, and for where it was freed. This will be extremely helpful for debugging.
2020-07-16 12:23:39 -03:00
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Later freed at:", getpid());
UserspaceEmulator: Include malloc/free backtraces in UAF logs :^) When catching a use-after-free, we now also print out the backtraces for where the memory was allocated, and for where it was freed. This will be extremely helpful for debugging.
2020-07-16 12:23:39 -03:00
Emulator::the().dump_backtrace(mallocation->free_backtrace);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
}
void MallocTracer::audit_write(FlatPtr address, size_t size)
{
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
if (!m_auditing_enabled)
return;
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
if (Emulator::the().is_in_malloc_or_free())
return;
auto* mallocation = find_mallocation(address);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
if (!mallocation) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mHeap buffer overflow\033[0m, invalid {}-byte write at address {:p}", getpid(), size, address);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
Emulator::the().dump_backtrace();
UserspaceEmulator: When auditing accesses, show nearest mallocation Instead of always showing the preceding mallocation, prefer showing the following one *if* it's closer to the audited address. This makes it easier to find bugs where the access is just before an allocation instead of just after it.
2020-11-13 06:58:31 -03:00
auto* mallocation_before = find_mallocation_before(address);
auto* mallocation_after = find_mallocation_after(address);
size_t distance_to_mallocation_before = mallocation_before ? (address - mallocation_before->address - mallocation_before->size) : 0;
size_t distance_to_mallocation_after = mallocation_after ? (mallocation_after->address - address) : 0;
if (mallocation_before && (!mallocation_after || distance_to_mallocation_before < distance_to_mallocation_after)) {
reportln("=={}== Address is {} byte(s) after block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_before, mallocation_before->size, mallocation_before->address);
Emulator::the().dump_backtrace(mallocation_before->malloc_backtrace);
return;
}
if (mallocation_after && (!mallocation_before || distance_to_mallocation_after < distance_to_mallocation_before)) {
reportln("=={}== Address is {} byte(s) before block of size {}, identity {:p}, allocated at:", getpid(), distance_to_mallocation_after, mallocation_after->size, mallocation_after->address);
Emulator::the().dump_backtrace(mallocation_after->malloc_backtrace);
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
UserspaceEmulator: Report heap buffer overflows :^)
2020-08-01 04:44:19 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
size_t offset_into_mallocation = address - mallocation->address;
if (mallocation->freed) {
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mUse-after-free\033[0m, invalid {}-byte write at address {:p}", getpid(), size, address);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
Emulator::the().dump_backtrace();
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Address is {} byte(s) into block of size {}, allocated at:", getpid(), offset_into_mallocation, mallocation->size);
UserspaceEmulator: Include malloc/free backtraces in UAF logs :^) When catching a use-after-free, we now also print out the backtraces for where the memory was allocated, and for where it was freed. This will be extremely helpful for debugging.
2020-07-16 12:23:39 -03:00
Emulator::the().dump_backtrace(mallocation->malloc_backtrace);
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("=={}== Later freed at:", getpid());
UserspaceEmulator: Include malloc/free backtraces in UAF logs :^) When catching a use-after-free, we now also print out the backtraces for where the memory was allocated, and for where it was freed. This will be extremely helpful for debugging.
2020-07-16 12:23:39 -03:00
Emulator::the().dump_backtrace(mallocation->free_backtrace);
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
return;
}
}
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
bool MallocTracer::is_reachable(const Mallocation& mallocation) const
{
ASSERT(!mallocation.freed);
// 1. Search in active (non-freed) mallocations for pointers to this mallocation
for (auto& other_mallocation : m_mallocations) {
if (&mallocation == &other_mallocation)
continue;
UserspaceEmulator: Skip freed mallocations in reachability scan Something being reachable from a freed mallocation doesn't make it actually reachable. Thanks to Jonas Bengtsson for spotting this! :^)
2020-07-16 19:24:23 -03:00
if (other_mallocation.freed)
continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
size_t pointers_in_mallocation = other_mallocation.size / sizeof(u32);
for (size_t i = 0; i < pointers_in_mallocation; ++i) {
auto value = Emulator::the().mmu().read32({ 0x20, other_mallocation.address + i * sizeof(u32) });
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
if (value.value() == mallocation.address && !value.is_uninitialized()) {
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
#ifdef REACHABLE_DEBUG
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("mallocation {:p} is reachable from other mallocation {:p}", mallocation.address, other_mallocation.address);
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
#endif
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
return true;
}
}
}
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
bool reachable = false;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
// 2. Search in other memory regions for pointers to this mallocation
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
Emulator::the().mmu().for_each_region([&](auto& region) {
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
// Skip the stack
if (region.is_stack())
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Don't scan text segment for malloc leaks There will be no (true positive) malloc addresses in the text segment.
2020-07-16 14:27:03 -03:00
if (region.is_text())
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
// Skip malloc blocks
if (region.is_mmap() && static_cast<const MmapRegion&>(region).is_malloc_block())
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
return IterationDecision::Continue;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
size_t pointers_in_region = region.size() / sizeof(u32);
for (size_t i = 0; i < pointers_in_region; ++i) {
auto value = region.read32(i * sizeof(u32));
UserspaceEmulator+LibX86: Start tracking uninitialized memory :^) This patch introduces the concept of shadow bits. For every byte of memory there is a corresponding shadow byte that contains metadata about that memory. Initially, the only metadata is whether the byte has been initialized or not. That's represented by the least significant shadow bit. Shadow bits travel together with regular values throughout the entire CPU and MMU emulation. There are two main helper classes to facilitate this: ValueWithShadow and ValueAndShadowReference. ValueWithShadow<T> is basically a struct { T value; T shadow; } whereas ValueAndShadowReference<T> is struct { T& value; T& shadow; }. The latter is used as a wrapper around general-purpose registers, since they can't use the plain ValueWithShadow memory as we need to be able to address individual 8-bit and 16-bit subregisters (EAX, AX, AL, AH.) Whenever a computation is made using uninitialized inputs, the result is tainted and becomes uninitialized as well. This allows us to track this state as it propagates throughout memory and registers. This patch doesn't yet keep track of tainted flags, that will be an important upcoming improvement to this. I'm sure I've messed up some things here and there, but it seems to basically work, so we have a place to start! :^)
2020-07-20 21:29:59 -03:00
if (value.value() == mallocation.address && !value.is_uninitialized()) {
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
#ifdef REACHABLE_DEBUG
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("mallocation {:p} is reachable from region {:p}-{:p}", mallocation.address, region.base(), region.end() - 1);
UserspaceEmulator: Put the memory reachability logging behind a macro
2020-07-16 12:16:21 -03:00
#endif
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
reachable = true;
return IterationDecision::Break;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
}
UserspaceEmulator: Add TLS regions to reachability checking
2020-07-16 14:14:54 -03:00
return IterationDecision::Continue;
});
return reachable;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
void MallocTracer::dump_leak_report()
{
TemporaryChange change(m_auditing_enabled, false);
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
size_t bytes_leaked = 0;
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
size_t leaks_found = 0;
for (auto& mallocation : m_mallocations) {
if (mallocation.freed)
continue;
if (is_reachable(mallocation))
continue;
++leaks_found;
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
bytes_leaked += mallocation.size;
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1mLeak\033[0m, {}-byte allocation at address {:p}", getpid(), mallocation.size, mallocation.address);
UserspaceEmulator: Capture backtraces of malloc/free events This lets us show backtraces for each leaked mallocation in the leak report at the end. :^)
2020-07-16 12:14:58 -03:00
Emulator::the().dump_backtrace(mallocation.malloc_backtrace);
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
if (!leaks_found)
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[32;1mNo leaks found!\033[0m", getpid());
UserspaceEmulator: Print the number of bytes leaked on exit :^)
2020-07-16 14:15:38 -03:00
else
UserspaceEmulator: Optionally write reports to the debug log ...and take a flag '--report-to-debug' that determines this behaviour.
2020-10-24 04:45:51 -03:00
reportln("\n=={}== \033[31;1m{} leak(s) found: {} byte(s) leaked\033[0m", getpid(), leaks_found, bytes_leaked);
UserspaceEmulator: Implement very basic leak checking :^) Upon exit, the emulator will now print a leak report of any malloc allocations that are still live and don't have pointers to their base address anywhere in either another live mallocation, or in one of the non-malloc-block memory regions. Note that the malloc-block memory region check is not fully functional and this will work even better once we get that fixed. This is pretty cool. :^)
2020-07-16 12:04:27 -03:00
}
UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^) This patch introduces a "MallocTracer" to the UserspaceEmulator. If this object is present on the Emulator, it can be notified whenever the emulated program does a malloc() or free(). The notifications come in via a magic instruction sequence that we embed in the LibC malloc() and free() functions. The sequence is: "salc x2, push reg32 x2, pop reg32 x3" The data about the malloc/free operation is in the three pushes. We make sure the sequence is harmless when running natively. Memory accesses on MmapRegion are then audited to see if they fall inside a known-to-be-freed malloc chunk. If so, we complain loud and red in the debugger output. :^) This is very, very cool! :^) It's also a whole lot slower than before, since now we're auditing memory accesses against a new set of metadata. This will need to be optimized (and running in this mode should be opt-in, perhaps even a separate program, etc.)
2020-07-15 16:46:50 -03:00
}
Reference in a new issue Copy permalink