1 //===-- hwasan_dynamic_shadow.cpp -------------------------------*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 /// 9 /// \file 10 /// This file is a part of HWAddressSanitizer. It reserves dynamic shadow memory 11 /// region and handles ifunc resolver case, when necessary. 12 /// 13 //===----------------------------------------------------------------------===// 14 15 #include "hwasan.h" 16 #include "hwasan_dynamic_shadow.h" 17 #include "hwasan_mapping.h" 18 #include "sanitizer_common/sanitizer_common.h" 19 #include "sanitizer_common/sanitizer_posix.h" 20 21 #include <elf.h> 22 #include <link.h> 23 24 // The code in this file needs to run in an unrelocated binary. It should not 25 // access any external symbol, including its own non-hidden globals. 26 27 namespace __hwasan { 28 29 static void UnmapFromTo(uptr from, uptr to) { 30 if (to == from) 31 return; 32 CHECK(to >= from); 33 uptr res = internal_munmap(reinterpret_cast<void *>(from), to - from); 34 if (UNLIKELY(internal_iserror(res))) { 35 Report("ERROR: %s failed to unmap 0x%zx (%zd) bytes at address %p\n", 36 SanitizerToolName, to - from, to - from, from); 37 CHECK("unable to unmap" && 0); 38 } 39 } 40 41 // Returns an address aligned to kShadowBaseAlignment, such that 42 // 2**kShadowBaseAlingment on the left and shadow_size_bytes bytes on the right 43 // of it are mapped no access. 44 static uptr MapDynamicShadow(uptr shadow_size_bytes) { 45 const uptr granularity = GetMmapGranularity(); 46 const uptr min_alignment = granularity << kShadowScale; 47 const uptr alignment = 1ULL << kShadowBaseAlignment; 48 CHECK_GE(alignment, min_alignment); 49 50 const uptr left_padding = 1ULL << kShadowBaseAlignment; 51 const uptr shadow_size = 52 RoundUpTo(shadow_size_bytes, granularity); 53 const uptr map_size = shadow_size + left_padding + alignment; 54 55 const uptr map_start = (uptr)MmapNoAccess(map_size); 56 CHECK_NE(map_start, ~(uptr)0); 57 58 const uptr shadow_start = RoundUpTo(map_start + left_padding, alignment); 59 60 UnmapFromTo(map_start, shadow_start - left_padding); 61 UnmapFromTo(shadow_start + shadow_size, map_start + map_size); 62 63 return shadow_start; 64 } 65 66 } // namespace __hwasan 67 68 #if SANITIZER_ANDROID 69 extern "C" { 70 71 INTERFACE_ATTRIBUTE void __hwasan_shadow(); 72 decltype(__hwasan_shadow)* __hwasan_premap_shadow(); 73 74 } // extern "C" 75 76 namespace __hwasan { 77 78 // Conservative upper limit. 79 static uptr PremapShadowSize() { 80 return RoundUpTo(GetMaxVirtualAddress() >> kShadowScale, 81 GetMmapGranularity()); 82 } 83 84 static uptr PremapShadow() { 85 return MapDynamicShadow(PremapShadowSize()); 86 } 87 88 static bool IsPremapShadowAvailable() { 89 const uptr shadow = reinterpret_cast<uptr>(&__hwasan_shadow); 90 const uptr resolver = reinterpret_cast<uptr>(&__hwasan_premap_shadow); 91 // shadow == resolver is how Android KitKat and older handles ifunc. 92 // shadow == 0 just in case. 93 return shadow != 0 && shadow != resolver; 94 } 95 96 static uptr FindPremappedShadowStart(uptr shadow_size_bytes) { 97 const uptr granularity = GetMmapGranularity(); 98 const uptr shadow_start = reinterpret_cast<uptr>(&__hwasan_shadow); 99 const uptr premap_shadow_size = PremapShadowSize(); 100 const uptr shadow_size = RoundUpTo(shadow_size_bytes, granularity); 101 102 // We may have mapped too much. Release extra memory. 103 UnmapFromTo(shadow_start + shadow_size, shadow_start + premap_shadow_size); 104 return shadow_start; 105 } 106 107 } // namespace __hwasan 108 109 extern "C" { 110 111 decltype(__hwasan_shadow)* __hwasan_premap_shadow() { 112 // The resolver might be called multiple times. Map the shadow just once. 113 static __sanitizer::uptr shadow = 0; 114 if (!shadow) 115 shadow = __hwasan::PremapShadow(); 116 return reinterpret_cast<decltype(__hwasan_shadow)*>(shadow); 117 } 118 119 // __hwasan_shadow is a "function" that has the same address as the first byte 120 // of the shadow mapping. 121 INTERFACE_ATTRIBUTE __attribute__((ifunc("__hwasan_premap_shadow"))) 122 void __hwasan_shadow(); 123 124 extern __attribute((weak, visibility("hidden"))) ElfW(Rela) __rela_iplt_start[], 125 __rela_iplt_end[]; 126 127 } // extern "C" 128 129 namespace __hwasan { 130 131 void InitShadowGOT() { 132 // Call the ifunc resolver for __hwasan_shadow and fill in its GOT entry. This 133 // needs to be done before other ifunc resolvers (which are handled by libc) 134 // because a resolver might read __hwasan_shadow. 135 typedef ElfW(Addr) (*ifunc_resolver_t)(void); 136 for (ElfW(Rela) *r = __rela_iplt_start; r != __rela_iplt_end; ++r) { 137 ElfW(Addr)* offset = reinterpret_cast<ElfW(Addr)*>(r->r_offset); 138 ElfW(Addr) resolver = r->r_addend; 139 if (resolver == reinterpret_cast<ElfW(Addr)>(&__hwasan_premap_shadow)) { 140 *offset = reinterpret_cast<ifunc_resolver_t>(resolver)(); 141 break; 142 } 143 } 144 } 145 146 uptr FindDynamicShadowStart(uptr shadow_size_bytes) { 147 if (IsPremapShadowAvailable()) 148 return FindPremappedShadowStart(shadow_size_bytes); 149 return MapDynamicShadow(shadow_size_bytes); 150 } 151 152 } // namespace __hwasan 153 #else 154 namespace __hwasan { 155 156 void InitShadowGOT() {} 157 158 uptr FindDynamicShadowStart(uptr shadow_size_bytes) { 159 return MapDynamicShadow(shadow_size_bytes); 160 } 161 162 } // namespace __hwasan 163 164 #endif // SANITIZER_ANDROID 165