hwasan_checks.h 4.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144
  1. //===-- hwasan_checks.h -----------------------------------------*- C++ -*-===//
  2. //
  3. // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
  4. // See https://llvm.org/LICENSE.txt for license information.
  5. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
  6. //
  7. //===----------------------------------------------------------------------===//
  8. //
  9. // This file is a part of HWAddressSanitizer.
  10. //
  11. //===----------------------------------------------------------------------===//
  12. #ifndef HWASAN_CHECKS_H
  13. #define HWASAN_CHECKS_H
  14. #include "hwasan_allocator.h"
  15. #include "hwasan_mapping.h"
  16. #include "sanitizer_common/sanitizer_common.h"
  17. namespace __hwasan {
  18. template <unsigned X>
  19. __attribute__((always_inline)) static void SigTrap(uptr p) {
  20. #if defined(__aarch64__)
  21. (void)p;
  22. // 0x900 is added to do not interfere with the kernel use of lower values of
  23. // brk immediate.
  24. register uptr x0 asm("x0") = p;
  25. asm("brk %1\n\t" ::"r"(x0), "n"(0x900 + X));
  26. #elif defined(__x86_64__)
  27. // INT3 + NOP DWORD ptr [EAX + X] to pass X to our signal handler, 5 bytes
  28. // total. The pointer is passed via rdi.
  29. // 0x40 is added as a safeguard, to help distinguish our trap from others and
  30. // to avoid 0 offsets in the command (otherwise it'll be reduced to a
  31. // different nop command, the three bytes one).
  32. asm volatile(
  33. "int3\n"
  34. "nopl %c0(%%rax)\n" ::"n"(0x40 + X),
  35. "D"(p));
  36. #elif SANITIZER_RISCV64
  37. // Put pointer into x10
  38. // addiw contains immediate of 0x40 + X, where 0x40 is magic number and X
  39. // encodes access size
  40. register uptr x10 asm("x10") = p;
  41. asm volatile(
  42. "ebreak\n"
  43. "addiw x0, x0, %1\n" ::"r"(x10),
  44. "I"(0x40 + X));
  45. #else
  46. // FIXME: not always sigill.
  47. __builtin_trap();
  48. #endif
  49. // __builtin_unreachable();
  50. }
  51. // Version with access size which is not power of 2
  52. template <unsigned X>
  53. __attribute__((always_inline)) static void SigTrap(uptr p, uptr size) {
  54. #if defined(__aarch64__)
  55. register uptr x0 asm("x0") = p;
  56. register uptr x1 asm("x1") = size;
  57. asm("brk %2\n\t" ::"r"(x0), "r"(x1), "n"(0x900 + X));
  58. #elif defined(__x86_64__)
  59. // Size is stored in rsi.
  60. asm volatile(
  61. "int3\n"
  62. "nopl %c0(%%rax)\n" ::"n"(0x40 + X),
  63. "D"(p), "S"(size));
  64. #elif SANITIZER_RISCV64
  65. // Put access size into x11
  66. register uptr x10 asm("x10") = p;
  67. register uptr x11 asm("x11") = size;
  68. asm volatile(
  69. "ebreak\n"
  70. "addiw x0, x0, %2\n" ::"r"(x10),
  71. "r"(x11), "I"(0x40 + X));
  72. #else
  73. __builtin_trap();
  74. #endif
  75. // __builtin_unreachable();
  76. }
  77. __attribute__((always_inline, nodebug)) static bool PossiblyShortTagMatches(
  78. tag_t mem_tag, uptr ptr, uptr sz) {
  79. tag_t ptr_tag = GetTagFromPointer(ptr);
  80. if (ptr_tag == mem_tag)
  81. return true;
  82. if (mem_tag >= kShadowAlignment)
  83. return false;
  84. if ((ptr & (kShadowAlignment - 1)) + sz > mem_tag)
  85. return false;
  86. #if !defined(__aarch64__) && !(SANITIZER_RISCV64)
  87. ptr = UntagAddr(ptr);
  88. #endif
  89. return *(u8 *)(ptr | (kShadowAlignment - 1)) == ptr_tag;
  90. }
  91. enum class ErrorAction { Abort, Recover };
  92. enum class AccessType { Load, Store };
  93. template <ErrorAction EA, AccessType AT, unsigned LogSize>
  94. __attribute__((always_inline, nodebug)) static void CheckAddress(uptr p) {
  95. if (!InTaggableRegion(p))
  96. return;
  97. uptr ptr_raw = p & ~kAddressTagMask;
  98. tag_t mem_tag = *(tag_t *)MemToShadow(ptr_raw);
  99. if (UNLIKELY(!PossiblyShortTagMatches(mem_tag, p, 1 << LogSize))) {
  100. SigTrap<0x20 * (EA == ErrorAction::Recover) +
  101. 0x10 * (AT == AccessType::Store) + LogSize>(p);
  102. if (EA == ErrorAction::Abort)
  103. __builtin_unreachable();
  104. }
  105. }
  106. template <ErrorAction EA, AccessType AT>
  107. __attribute__((always_inline, nodebug)) static void CheckAddressSized(uptr p,
  108. uptr sz) {
  109. if (sz == 0 || !InTaggableRegion(p))
  110. return;
  111. tag_t ptr_tag = GetTagFromPointer(p);
  112. uptr ptr_raw = p & ~kAddressTagMask;
  113. tag_t *shadow_first = (tag_t *)MemToShadow(ptr_raw);
  114. tag_t *shadow_last = (tag_t *)MemToShadow(ptr_raw + sz);
  115. for (tag_t *t = shadow_first; t < shadow_last; ++t)
  116. if (UNLIKELY(ptr_tag != *t)) {
  117. SigTrap<0x20 * (EA == ErrorAction::Recover) +
  118. 0x10 * (AT == AccessType::Store) + 0xf>(p, sz);
  119. if (EA == ErrorAction::Abort)
  120. __builtin_unreachable();
  121. }
  122. uptr end = p + sz;
  123. uptr tail_sz = end & 0xf;
  124. if (UNLIKELY(tail_sz != 0 &&
  125. !PossiblyShortTagMatches(
  126. *shadow_last, end & ~(kShadowAlignment - 1), tail_sz))) {
  127. SigTrap<0x20 * (EA == ErrorAction::Recover) +
  128. 0x10 * (AT == AccessType::Store) + 0xf>(p, sz);
  129. if (EA == ErrorAction::Abort)
  130. __builtin_unreachable();
  131. }
  132. }
  133. } // end namespace __hwasan
  134. #endif // HWASAN_CHECKS_H