Loading...
--- libmalloc/libmalloc-474.0.13/src/pgm_malloc.c
+++ libmalloc/libmalloc-374.100.5/src/pgm_malloc.c
@@ -24,6 +24,9 @@
#include "pgm_malloc.h"
#include <TargetConditionals.h>
+#if !TARGET_OS_DRIVERKIT
+# include <dlfcn.h> // dladdr()
+#endif
#include <mach/mach_time.h> // mach_absolute_time()
#include <sys/codesign.h> // csops()
@@ -86,6 +89,7 @@
uint32_t max_metadata;
uint32_t sample_counter_range;
uint32_t min_alignment;
+ bool signal_handler;
bool debug;
uint64_t debug_log_throttle_ms;
@@ -124,27 +128,6 @@
#pragma mark -
-#pragma mark Thread Local Sample Counter
-
-MALLOC_STATIC_ASSERT(sizeof(void *) >= sizeof(uint32_t), "Pointer is used as 32bit counter");
-
-#define TSD_GET_COUNTER() ((uint32_t)_pthread_getspecific_direct(__TSD_MALLOC_PROB_GUARD_SAMPLE_COUNTER))
-#define TSD_SET_COUNTER(val) _pthread_setspecific_direct(__TSD_MALLOC_PROB_GUARD_SAMPLE_COUNTER, (void *)(uintptr_t)val)
-
-static const uint32_t k_no_sample = UINT32_MAX;
-
-void
-pgm_thread_set_disabled(bool disabled)
-{
- if (disabled) {
- TSD_SET_COUNTER(k_no_sample);
- } else {
- TSD_SET_COUNTER(0);
- }
-}
-
-
-#pragma mark -
#pragma mark Decider Functions
// The "decider" functions are performance critical. They should be inlinable and must not lock.
@@ -163,17 +146,15 @@
static inline boolean_t
should_sample_counter(uint32_t counter_range)
{
- uint32_t counter = TSD_GET_COUNTER();
- if (counter == k_no_sample) {
- return false;
- }
+ MALLOC_STATIC_ASSERT(sizeof(void *) >= sizeof(uint32_t), "Pointer is used as 32bit counter");
+ uint32_t counter = (uint32_t)_pthread_getspecific_direct(__TSD_MALLOC_PROB_GUARD_SAMPLE_COUNTER);
// 0 -> regenerate counter; 1 -> sample allocation
if (counter == 0) {
counter = rand_uniform(counter_range);
} else {
counter--;
}
- TSD_SET_COUNTER(counter);
+ _pthread_setspecific_direct(__TSD_MALLOC_PROB_GUARD_SAMPLE_COUNTER, (void *)(uintptr_t)counter);
return counter == 0;
}
#endif
@@ -730,8 +711,6 @@
return check_configuration(zone) &&
// Quarantine
(zone->size == quarantine_size(zone->num_slots)) &&
- (zone->begin % PAGE_SIZE == 0) &&
- (zone->size % PAGE_SIZE == 0) &&
(zone->begin + zone->size == zone->end) &&
(zone->begin < zone->end) &&
(zone->region_size == 2 * k_zone_spacer + zone->size) &&
@@ -749,12 +728,6 @@
}
static bool
-check_introspection(const pgm_zone_t *zone)
-{
- return true;
-}
-
-static bool
check_slot(const pgm_zone_t *zone, const slot_t *slot)
{
if (slot->state == ss_unused) {
@@ -815,28 +788,13 @@
#pragma mark -
#pragma mark Introspection Functions
-typedef enum {
- rt_zone_only = 1 << 0,
- rt_introspection = 1 << 1,
- rt_slots = 1 << 2,
- rt_metadata = 1 << 3,
-} read_type_t;
-
-#define READ(remote_address, size, local_memory, checker, check_data) \
+typedef enum { rt_zone_only, rt_slots, rt_slots_and_metadata } read_type_t;
+
+#define READ(remote_address, size, local_memory, checker, zone) \
{ \
kern_return_t kr = reader(task, (vm_address_t)remote_address, size, (void **)local_memory); \
if (kr != KERN_SUCCESS) return kr; \
- if (!checker(check_data)) return KERN_FAILURE; \
-}
-
-// Avoid ptrauth: ptr loaded from corpse can't be authenticated in ReportCrash proccess.
-static const malloc_introspection_t *
-get_introspection_ptr(const pgm_zone_t *zone)
-{
- // return zone->malloc_zone.introspect;
- vm_address_t ptr_addr = (vm_address_t)zone + offsetof(malloc_zone_t, introspect);
- vm_address_t ptr = *(vm_address_t *)ptr_addr;
- return ptrauth_strip((malloc_introspection_t *)ptr, ptrauth_key_process_independent_data);
+ if (!checker(zone)) return KERN_FAILURE; \
}
static kern_return_t
@@ -850,13 +808,10 @@
READ(zone_address, sizeof(pgm_zone_t), &zone_ptr, check_zone, zone_ptr);
*zone = *zone_ptr; // Copy to writable memory
- if (read_type & rt_introspection) {
- READ(get_introspection_ptr(zone), sizeof(malloc_introspection_t), &zone->malloc_zone.introspect, check_introspection, zone);
- }
- if (read_type & rt_slots) {
+ if (read_type >= rt_slots) {
READ(zone->slots, zone->num_slots * sizeof(slot_t), &zone->slots, check_slots, zone);
}
- if (read_type & rt_metadata) {
+ if (read_type >= rt_slots_and_metadata) {
READ(zone->metadata, zone->max_metadata * sizeof(metadata_t), &zone->metadata, check_metadata, zone);
}
return KERN_SUCCESS;
@@ -868,7 +823,7 @@
kern_return_t kr = read_zone(task, zone_address, reader, &zone_copy, read_type); \
if (kr != KERN_SUCCESS) return kr; \
} \
- const pgm_zone_t *zone = &zone_copy;
+ pgm_zone_t *zone = &zone_copy;
#define RECORD(remote_address, size_, type) \
{ \
@@ -911,7 +866,7 @@
}
static void
-pgm_statistics(const pgm_zone_t *zone, malloc_statistics_t *stats)
+pgm_statistics(pgm_zone_t *zone, malloc_statistics_t *stats)
{
*stats = (malloc_statistics_t){
.blocks_in_use = zone->num_allocations,
@@ -1057,9 +1012,6 @@
#else
.enumerate_unavailable_without_blocks = NULL,
#endif
-
- // Zone type
- .zone_type = MALLOC_ZONE_TYPE_PGM,
};
static const malloc_zone_t malloc_zone_template = {
@@ -1082,15 +1034,14 @@
// Introspection
.zone_name = "ProbGuardMallocZone",
- .version = 14,
+ .version = 12,
.introspect = (malloc_introspection_t *)&introspection_template, // Effectively const.
// Specialized operations
.memalign = FN_PTR(pgm_memalign),
.free_definite_size = FN_PTR(pgm_free_definite_size),
.pressure_relief = NULL,
- .claimed_address = FN_PTR(pgm_claimed_address),
- .try_free_default = NULL,
+ .claimed_address = FN_PTR(pgm_claimed_address)
};
@@ -1100,7 +1051,8 @@
static const char *
env_var(const char *name)
{
- return getenv(name);
+ const char **env = (const char **)*_NSGetEnviron();
+ return _simple_getenv(env, name);
}
static uint32_t
@@ -1127,29 +1079,6 @@
#pragma mark -
#pragma mark Zone Configuration
-static struct {
- bool internal_build;
- bool MallocProbGuard_is_set;
- bool MallocProbGuard;
- bool MallocProbGuardViaLaunchd;
-} g_env;
-
-void
-pgm_init_config(bool internal_build)
-{
- // Avoid dirty memory; do not write in the common case
- if (internal_build) {
- g_env.internal_build = internal_build;
- }
- if (env_var("MallocProbGuard")) {
- g_env.MallocProbGuard_is_set = true;
- g_env.MallocProbGuard = env_bool("MallocProbGuard");
- }
- if (env_bool("MallocProbGuardViaLaunchd")) {
- g_env.MallocProbGuardViaLaunchd = true;
- }
-}
-
static bool
is_platform_binary(void)
{
@@ -1174,7 +1103,7 @@
return false;
}
#else
- if (!g_env.MallocProbGuardViaLaunchd) {
+ if (!env_bool("MallocProbGuardViaLaunchd")) {
return false;
}
#endif
@@ -1193,16 +1122,12 @@
}
#endif
-#define PGM_ALLOW_NON_INTERNAL_ACTIVATION 0
-
-
bool
-pgm_should_enable(void)
-{
- if (g_env.MallocProbGuard_is_set) {
- return g_env.MallocProbGuard;
- }
- bool internal_build = g_env.internal_build;
+pgm_should_enable(bool internal_build)
+{
+ if (env_var("MallocProbGuard")) {
+ return env_bool("MallocProbGuard");
+ }
if (FEATURE_FLAG(ProbGuard, true) && should_activate(internal_build)) {
#if TARGET_OS_OSX || TARGET_OS_IOS
return true;
@@ -1210,8 +1135,6 @@
if (is_high_memory_device()) {
return true;
}
-#elif PGM_ALLOW_NON_INTERNAL_ACTIVATION
- return true;
#elif TARGET_OS_DRIVERKIT
// Never enable for DriverKit
#else
@@ -1232,10 +1155,15 @@
return (TARGET_OS_OSX ? 8 : 2) * 1024;
}
+// TODO(yln): uniform sampling is likely not optimal here, since we will tend to
+// sample around the average of our range, which is probably more frequent than
+// what we want. We probably want the average to be less frequent, but still be
+// able to reach the "very frequent" end of our range occassionally. Consider
+// using a geometric (or other weighted distribution) here.
static uint32_t
choose_sample_rate(void)
{
- uint32_t min = 500, max = 5000;
+ uint32_t min = 500, max = 10000;
return rand_uniform(max - min) + min;
}
@@ -1273,6 +1201,7 @@
zone->sample_counter_range = (sample_rate != 1) ? (2 * sample_rate) : 1;
bool strict_alignment = env_var("MallocProbGuardStrictAlignment") ? env_bool("MallocProbGuardStrictAlignment") : FEATURE_FLAG(ProbGuardStrictAlignment, false);
zone->min_alignment = (strict_alignment && MALLOC_TARGET_64BIT) ? 1 : 16; // Darwin ABI requires 16 byte alignment.
+ zone->signal_handler = env_bool("MallocProbGuardSignalHandler");
zone->debug = env_bool("MallocProbGuardDebug");
zone->debug_log_throttle_ms = env_uint("MallocProbGuardDebugLogThrottleInMillis", 1000);
@@ -1324,6 +1253,7 @@
init_lock(zone);
}
+static void install_signal_handler(void *unused);
malloc_zone_t *
pgm_create_zone(malloc_zone_t *wrapped_zone)
{
@@ -1335,6 +1265,11 @@
pgm_zone_t *zone = (pgm_zone_t *)my_vm_map(sizeof(pgm_zone_t), VM_PROT_READ_WRITE, VM_MEMORY_MALLOC);
setup_zone(zone, wrapped_zone);
my_vm_protect((vm_address_t)zone, PAGE_MAX_SIZE, VM_PROT_READ);
+
+ if (zone->signal_handler) {
+ static os_once_t once_pred;
+ os_once(&once_pred, NULL, &install_signal_handler);
+ }
return (malloc_zone_t *)zone;
}
@@ -1371,10 +1306,8 @@
return;
}
if (should_log(zone)) {
- malloc_report(ASL_LEVEL_INFO,
- "ProbGuard: %9s 0x%llx, fill state: %3u/%u\n", label,
- (unsigned long long)addr, zone->num_allocations,
- zone->max_allocations);
+ malloc_report(ASL_LEVEL_INFO, "ProbGuard: %9s 0x%lx, fill state: %3u/%u\n",
+ label, addr, zone->num_allocations, zone->max_allocations);
}
if (!pgm_check(zone)) {
MALLOC_REPORT_FATAL_ERROR(addr, "ProbGuard: zone integrity check failed");
@@ -1416,29 +1349,16 @@
}
}
-#define KR_NO_PGM (KERN_RETURN_MAX + 1)
-static kern_return_t
+static void
diagnose_page_fault(const pgm_zone_t *zone, vm_address_t fault_address, pgm_report_t *report)
{
- if (!is_guarded(zone, fault_address)) {
- return KR_NO_PGM;
- }
-
slot_lookup_t res = lookup_slot(zone, fault_address);
- // Guaranteed by lookup_slot()
MALLOC_ASSERT(res.slot < zone->num_slots);
- // Checked by read_zone()
MALLOC_ASSERT(zone->slots[res.slot].metadata < zone->max_metadata);
slot_state_t ss = zone->slots[res.slot].state;
- // We should have gotten here because of a page fault.
- if (ss == ss_allocated && res.bounds != b_oob_guard_page) {
- malloc_report(ASL_LEVEL_ERR | MALLOC_REPORT_LOG_ONLY,
- "Failed to generate PGM report for fault address %p: "
- "slot is unexpectedly allocated with bounds %d\n",
- (void *)fault_address, (int)res.bounds);
- return KERN_FAILURE;
- }
+ // We got here because of a page fault.
+ MALLOC_ASSERT(ss != ss_allocated || res.bounds == b_oob_guard_page);
// Note that all of the following error conditions may also be caused by:
// *) Randomly corrupted pointer
@@ -1473,26 +1393,82 @@
}
break;
default:
- // Checked by read_zone()
__builtin_unreachable();
}
report->fault_address = fault_address;
fill_in_report(zone, res.slot, report);
+}
+
+
+#pragma mark -
+#pragma mark Error Printing
+
+static const uint32_t k_buf_len = 1024;
+static void
+get_symbol_and_module_name(vm_address_t addr, char buf[k_buf_len])
+{
+ int success = 0;
+#if !TARGET_OS_DRIVERKIT
+ Dl_info info;
+ success = dladdr((void *)addr, &info);
+ if (success) {
+ snprintf(buf, k_buf_len, "%s (%s)", info.dli_sname, info.dli_fname);
+ }
+#endif
+ if (!success) {
+ snprintf(buf, k_buf_len, "%p", (void *)addr);
+ }
+}
+
+static void
+print_trace(stack_trace_t *trace, const char *label)
+{
+ malloc_report(ASL_LEVEL_ERR, "%s trace (thread %llu, time: %llu):\n", label, trace->thread_id, trace->time);
+ for (uint32_t i = 0; i < trace->num_frames; i++) {
+ char sym_name[k_buf_len];
+ get_symbol_and_module_name(trace->frames[i], sym_name);
+ malloc_report(ASL_LEVEL_ERR, " #%u %s\n", i, sym_name);
+ }
+ malloc_report(ASL_LEVEL_ERR, "\n", label);
+}
+
+static void
+print_report(pgm_report_t *report)
+{
+ malloc_report(ASL_LEVEL_ERR, "ProbGuard: invalid access at 0x%lx\n",
+ report->fault_address);
+ malloc_report(ASL_LEVEL_ERR, "Error type: %s (%s confidence)\n",
+ report->error_type, report->confidence);
+ malloc_report(ASL_LEVEL_ERR, "Nearest allocation: 0x%lx, size: %lu, state: %s\n",
+ report->nearest_allocation, report->allocation_size, report->allocation_state);
+
+ if (report->num_traces >= 1) {
+ print_trace(&report->alloc_trace, "Allocation");
+ if (report->num_traces >= 2) {
+ print_trace(&report->dealloc_trace, "Deallocation");
+ }
+ } else {
+ malloc_report(ASL_LEVEL_ERR, "Allocation stack traces not available. "
+ "Try increasing `MallocProbGuardMetadata` and rerun.\n");
+ }
+}
+
+
+#pragma mark -
+#pragma mark Crash Reporter API
+
+static kern_return_t
+diagnose_fault_from_external_process(vm_address_t fault_address, pgm_report_t *report,
+ task_t task, vm_address_t zone_address, memory_reader_t reader)
+{
+ READ_ZONE(zone, rt_slots_and_metadata);
+ diagnose_page_fault(zone, fault_address, report);
return KERN_SUCCESS;
}
-
-#pragma mark -
-#pragma mark Crash Reporter SPI
-
-// KERN_FAILURE - memory read error
-// KERN_SUCCESS - memory read ok, PGM report filled
-// KR_NO_PGM - memory read ok, but no PGM result, try next zone
-MALLOC_STATIC_ASSERT(KR_NO_PGM > KERN_RETURN_MAX, "KR_NO_PGM");
-
static crash_reporter_memory_reader_t g_crm_reader;
-static const uint32_t k_max_read_memory = 4; // See read_zone() and read_type_t
+static const uint32_t k_max_read_memory = 3;
static void *read_memory[k_max_read_memory];
static uint32_t num_read_memory;
static kern_return_t
@@ -1501,15 +1477,13 @@
MALLOC_ASSERT(num_read_memory < k_max_read_memory);
void *ptr = g_crm_reader(task, address, size);
*local_memory = ptr;
- if (!ptr) return KERN_FAILURE;
read_memory[num_read_memory++] = ptr;
- return KERN_SUCCESS;
+ return ptr ? KERN_SUCCESS : KERN_FAILURE;
}
static memory_reader_t *
setup_memory_reader(crash_reporter_memory_reader_t crm_reader)
{
- MALLOC_ASSERT(crm_reader);
g_crm_reader = crm_reader;
num_read_memory = 0;
return memory_reader_adapter;
@@ -1521,59 +1495,9 @@
for (uint32_t i = 0; i < num_read_memory; i++) {
free(read_memory[i]);
}
- num_read_memory = 0;
-}
-
-static kern_return_t
-is_pgm_zone(vm_address_t zone_address, task_t task, memory_reader_t reader)
-{
- READ_ZONE(zone, rt_introspection);
- if (zone->malloc_zone.version < 14)
- return KR_NO_PGM;
- unsigned zone_type = get_introspection_ptr(zone)->zone_type;
- return (zone_type == MALLOC_ZONE_TYPE_PGM) ? KERN_SUCCESS : KR_NO_PGM;
-}
-
-static kern_return_t
-diagnose_fault_from_external_process(vm_address_t fault_address, pgm_report_t *report,
- task_t task, vm_address_t zone_address, memory_reader_t reader)
-{
- READ_ZONE(zone, rt_slots | rt_metadata);
- return diagnose_page_fault(zone, fault_address, report);
-}
-
-static kern_return_t
-extract_report_select_zone(vm_address_t fault_address, pgm_report_t *report,
- task_t task, vm_address_t *zone_addresses, uint32_t zone_count, memory_reader_t reader)
-{
- for (uint32_t i = 0; i < zone_count; i++) {
- kern_return_t kr = is_pgm_zone(zone_addresses[i], task, reader);
- free_read_memory();
- if (kr == KR_NO_PGM) continue;
- if (kr != KERN_SUCCESS) return kr;
-
- kr = diagnose_fault_from_external_process(fault_address, report, task, zone_addresses[i], reader);
- free_read_memory();
- if (kr == KR_NO_PGM) continue;
- return kr;
- }
- return KERN_FAILURE;
}
static _malloc_lock_s crash_reporter_lock = _MALLOC_LOCK_INIT;
-kern_return_t
-pgm_extract_report_from_corpse(vm_address_t fault_address, pgm_report_t *report, task_t task,
- vm_address_t *zone_addresses, uint32_t zone_count, crash_reporter_memory_reader_t crm_reader)
-{
- _malloc_lock_lock(&crash_reporter_lock);
-
- memory_reader_t *reader = setup_memory_reader(crm_reader);
- kern_return_t kr = extract_report_select_zone(fault_address, report, task, zone_addresses, zone_count, reader);
-
- _malloc_lock_unlock(&crash_reporter_lock);
- return kr;
-}
-
kern_return_t
pgm_diagnose_fault_from_crash_reporter(vm_address_t fault_address, pgm_report_t *report,
task_t task, vm_address_t zone_address, crash_reporter_memory_reader_t crm_reader)
@@ -1582,9 +1506,69 @@
memory_reader_t *reader = setup_memory_reader(crm_reader);
kern_return_t kr = diagnose_fault_from_external_process(fault_address, report, task, zone_address, reader);
+ free_read_memory();
_malloc_lock_unlock(&crash_reporter_lock);
return kr;
+}
+
+
+#pragma mark -
+#pragma mark Signal Handler
+
+extern malloc_zone_t **malloc_zones;
+static void
+report_error_from_signal_handler(vm_address_t fault_address)
+{
+ pgm_zone_t *zone = (pgm_zone_t *)malloc_zones[0];
+ MALLOC_ASSERT(zone->malloc_zone.size == FN_PTR(pgm_size));
+
+ if (!is_guarded(zone, fault_address)) {
+ return;
+ }
+
+ pgm_report_t report;
+ {
+ trylock(zone); // Best-effort locking to avoid deadlock.
+ diagnose_page_fault(zone, fault_address, &report);
+ unlock(zone);
+ }
+ print_report(&report);
+
+ MALLOC_REPORT_FATAL_ERROR(fault_address, "ProbGuard: invalid access detected");
+}
+
+static struct sigaction prev_sigaction;
+static void
+signal_handler(int sig, siginfo_t *info, void *ucontext)
+{
+ MALLOC_ASSERT(sig == SIGBUS);
+ report_error_from_signal_handler((vm_address_t)info->si_addr);
+
+ // Delegate to previous handler.
+ if (prev_sigaction.sa_flags & SA_SIGINFO) {
+ prev_sigaction.sa_sigaction(sig, info, ucontext);
+ } else if (prev_sigaction.sa_handler == SIG_IGN ||
+ prev_sigaction.sa_handler == SIG_DFL) {
+ // If the previous handler was the default handler, or was ignoring this
+ // signal, install the default handler and re-raise the signal in order to
+ // get a core dump and terminate this process.
+ signal(SIGBUS, SIG_DFL);
+ raise(SIGBUS);
+ } else {
+ prev_sigaction.sa_handler(sig);
+ }
+}
+
+static void
+install_signal_handler(void *unused)
+{
+ struct sigaction act = {
+ .sa_sigaction = &signal_handler,
+ .sa_flags = SA_SIGINFO
+ };
+ int res = sigaction(SIGBUS, &act, &prev_sigaction);
+ MALLOC_ASSERT(res == 0);
}
@@ -1648,7 +1632,7 @@
kern_return_t kr = mach_vm_map(target, &address, size_rounded, mask, flags,
object, offset, copy, cur_protection, max_protection, inheritance);
MALLOC_ASSERT(kr == KERN_SUCCESS);
- return (vm_address_t)address;
+ return address;
}
static vm_address_t