1 //===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 ///
9 /// \file
10 /// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory
11 /// region and handles ifunc resolver case, when necessary.
12 ///
13 //===----------------------------------------------------------------------===//
14
15 #include "hwasan.h"
16 #include "hwasan_dynamic_shadow.h"
17 #include "hwasan_mapping.h"
18 #include "sanitizer_common/sanitizer_common.h"
19 #include "sanitizer_common/sanitizer_posix.h"
20
21 #include <elf.h>
22 #include <link.h>
23
24 // The code in this file needs to run in an unrelocated binary. It should not
25 // access any external symbol, including its own non-hidden globals.
26
27 namespace __hwasan {
28
UnmapFromTo(uptr from,uptr to)29 static void UnmapFromTo(uptr from, uptr to) {
30 if (to == from)
31 return;
32 CHECK(to >= from);
33 uptr res = internal_munmap(reinterpret_cast<void *>(from), to - from);
34 if (UNLIKELY(internal_iserror(res))) {
35 Report("ERROR: %s failed to unmap 0x%zx (%zd) bytes at address %p\n",
36 SanitizerToolName, to - from, to - from, from);
37 CHECK("unable to unmap" && 0);
38 }
39 }
40
41 // Returns an address aligned to kShadowBaseAlignment, such that
42 // 2**kShadowBaseAlingment on the left and shadow_size_bytes bytes on the right
43 // of it are mapped no access.
MapDynamicShadow(uptr shadow_size_bytes)44 static uptr MapDynamicShadow(uptr shadow_size_bytes) {
45 const uptr granularity = GetMmapGranularity();
46 const uptr min_alignment = granularity << kShadowScale;
47 const uptr alignment = 1ULL << kShadowBaseAlignment;
48 CHECK_GE(alignment, min_alignment);
49
50 const uptr left_padding = 1ULL << kShadowBaseAlignment;
51 const uptr shadow_size =
52 RoundUpTo(shadow_size_bytes, granularity);
53 const uptr map_size = shadow_size + left_padding + alignment;
54
55 const uptr map_start = (uptr)MmapNoAccess(map_size);
56 CHECK_NE(map_start, ~(uptr)0);
57
58 const uptr shadow_start = RoundUpTo(map_start + left_padding, alignment);
59
60 UnmapFromTo(map_start, shadow_start - left_padding);
61 UnmapFromTo(shadow_start + shadow_size, map_start + map_size);
62
63 return shadow_start;
64 }
65
66 } // namespace __hwasan
67
68 #if SANITIZER_ANDROID
69 extern "C" {
70
71 INTERFACE_ATTRIBUTE void __hwasan_shadow();
72 decltype(__hwasan_shadow)* __hwasan_premap_shadow();
73
74 } // extern "C"
75
76 namespace __hwasan {
77
78 // Conservative upper limit.
PremapShadowSize()79 static uptr PremapShadowSize() {
80 return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale,
81 GetMmapGranularity());
82 }
83
PremapShadow()84 static uptr PremapShadow() {
85 return MapDynamicShadow(PremapShadowSize());
86 }
87
IsPremapShadowAvailable()88 static bool IsPremapShadowAvailable() {
89 const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow);
90 const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow);
91 // shadow == resolver is how Android KitKat and older handles ifunc.
92 // shadow == 0 just in case.
93 return shadow != 0 && shadow != resolver;
94 }
95
FindPremappedShadowStart(uptr shadow_size_bytes)96 static uptr FindPremappedShadowStart(uptr shadow_size_bytes) {
97 const uptr granularity = GetMmapGranularity();
98 const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow);
99 const uptr premap_shadow_size = PremapShadowSize();
100 const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity);
101
102 // We may have mapped too much. Release extra memory.
103 UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size);
104 return shadow_start;
105 }
106
107 } // namespace __hwasan
108
109 extern "C" {
110
__hwasan_premap_shadow()111 decltype(__hwasan_shadow)* __hwasan_premap_shadow() {
112 // The resolver might be called multiple times. Map the shadow just once.
113 static __sanitizer::uptr shadow = 0;
114 if (!shadow)
115 shadow = __hwasan::PremapShadow();
116 return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow);
117 }
118
119 // __hwasan_shadow is a "function" that has the same address as the first byte
120 // of the shadow mapping.
121 INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow")))
122 void __hwasan_shadow();
123
124 extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[],
125 __rela_iplt_end[];
126
127 } // extern "C"
128
129 namespace __hwasan {
130
InitShadowGOT()131 void InitShadowGOT() {
132 // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This
133 // needs to be done before other ifunc resolvers (which are handled by libc)
134 // because a resolver might read __hwasan_shadow.
135 typedef ElfW(Addr) (*ifunc_resolver_t)(void);
136 for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) {
137 ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset);
138 ElfW(Addr) resolver = r->r_addend;
139 if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) {
140 *offset = reinterpret_cast<ifunc_resolver_t>(resolver)();
141 break;
142 }
143 }
144 }
145
FindDynamicShadowStart(uptr shadow_size_bytes)146 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
147 if (IsPremapShadowAvailable())
148 return FindPremappedShadowStart(shadow_size_bytes);
149 return MapDynamicShadow(shadow_size_bytes);
150 }
151
152 } // namespace __hwasan
153 #else
154 namespace __hwasan {
155
InitShadowGOT()156 void InitShadowGOT() {}
157
FindDynamicShadowStart(uptr shadow_size_bytes)158 uptr FindDynamicShadowStart(uptr shadow_size_bytes) {
159 return MapDynamicShadow(shadow_size_bytes);
160 }
161
162 } // namespace __hwasan
163
164 #endif // SANITIZER_ANDROID
165