hwasan_dynamic_shadow.cpp 4.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143
  1. //===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===//
  2. //
  3. // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
  4. // See https://llvm.org/LICENSE.txt for license information.
  5. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
  6. //
  7. //===----------------------------------------------------------------------===//
  8. ///
  9. /// \file
  10. /// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory
  11. /// region and handles ifunc resolver case, when necessary.
  12. ///
  13. //===----------------------------------------------------------------------===//
  14. #include "hwasan_dynamic_shadow.h"
  15. #include <elf.h>
  16. #include <link.h>
  17. #include "hwasan.h"
  18. #include "hwasan_mapping.h"
  19. #include "hwasan_thread_list.h"
  20. #include "sanitizer_common/sanitizer_common.h"
  21. #include "sanitizer_common/sanitizer_posix.h"
  22. // The code in this file needs to run in an unrelocated binary. It should not
  23. // access any external symbol, including its own non-hidden globals.
  24. #if SANITIZER_ANDROID
  25. extern "C" {
  26. INTERFACE_ATTRIBUTE void __hwasan_shadow();
  27. decltype(__hwasan_shadow)* __hwasan_premap_shadow();
  28. } // extern "C"
  29. namespace __hwasan {
  30. // Conservative upper limit.
  31. static uptr PremapShadowSize() {
  32. return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale,
  33. GetMmapGranularity());
  34. }
  35. static uptr PremapShadow() {
  36. return MapDynamicShadow(PremapShadowSize(), kShadowScale,
  37. kShadowBaseAlignment, kHighMemEnd);
  38. }
  39. static bool IsPremapShadowAvailable() {
  40. const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow);
  41. const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow);
  42. // shadow == resolver is how Android KitKat and older handles ifunc.
  43. // shadow == 0 just in case.
  44. return shadow != 0 && shadow != resolver;
  45. }
  46. static uptr FindPremappedShadowStart(uptr shadow_size_bytes) {
  47. const uptr granularity = GetMmapGranularity();
  48. const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow);
  49. const uptr premap_shadow_size = PremapShadowSize();
  50. const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity);
  51. // We may have mapped too much. Release extra memory.
  52. UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size);
  53. return shadow_start;
  54. }
  55. } // namespace __hwasan
  56. extern "C" {
  57. decltype(__hwasan_shadow)* __hwasan_premap_shadow() {
  58. // The resolver might be called multiple times. Map the shadow just once.
  59. static __sanitizer::uptr shadow = 0;
  60. if (!shadow)
  61. shadow = __hwasan::PremapShadow();
  62. return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow);
  63. }
  64. // __hwasan_shadow is a "function" that has the same address as the first byte
  65. // of the shadow mapping.
  66. INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow")))
  67. void __hwasan_shadow();
  68. extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[],
  69. __rela_iplt_end[];
  70. } // extern "C"
  71. namespace __hwasan {
  72. void InitShadowGOT() {
  73. // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This
  74. // needs to be done before other ifunc resolvers (which are handled by libc)
  75. // because a resolver might read __hwasan_shadow.
  76. typedef ElfW(Addr) (*ifunc_resolver_t)(void);
  77. for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) {
  78. ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset);
  79. ElfW(Addr) resolver = r->r_addend;
  80. if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) {
  81. *offset = reinterpret_cast<ifunc_resolver_t>(resolver)();
  82. break;
  83. }
  84. }
  85. }
  86. uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
  87. if (IsPremapShadowAvailable())
  88. return FindPremappedShadowStart(shadow_size_bytes);
  89. return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,
  90. kHighMemEnd);
  91. }
  92. } // namespace __hwasan
  93. #elif SANITIZER_FUCHSIA
  94. namespace __hwasan {
  95. void InitShadowGOT() {}
  96. } // namespace __hwasan
  97. #else
  98. namespace __hwasan {
  99. void InitShadowGOT() {}
  100. uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
  101. # if defined(HWASAN_ALIASING_MODE)
  102. constexpr uptr kAliasSize = 1ULL << kAddressTagShift;
  103. constexpr uptr kNumAliases = 1ULL << kTagBits;
  104. return MapDynamicShadowAndAliases(shadow_size_bytes, kAliasSize, kNumAliases,
  105. RingBufferSize());
  106. # endif
  107. return MapDynamicShadow(shadow_size_bytes, kShadowScale, kShadowBaseAlignment,
  108. kHighMemEnd);
  109. }
  110. } // namespace __hwasan
  111. #endif // SANITIZER_ANDROID