1 // Copyright 2023 The Chromium Authors
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "base/memory/raw_ptr_asan_hooks.h"
6
7 #if BUILDFLAG(USE_ASAN_BACKUP_REF_PTR)
8
9 #include <cstring>
10
11 #include <sanitizer/asan_interface.h>
12
13 #include "base/compiler_specific.h"
14 #include "base/debug/alias.h"
15 #include "base/memory/raw_ptr_asan_service.h"
16
17 namespace base::internal {
18
19 namespace {
IsFreedHeapPointer(uintptr_t address)20 bool IsFreedHeapPointer(uintptr_t address) {
21 // Use `__asan_region_is_poisoned` instead of `__asan_address_is_poisoned`
22 // because the latter may crash on an invalid pointer.
23 if (!__asan_region_is_poisoned(reinterpret_cast<void*>(address), 1)) {
24 return false;
25 }
26
27 // Make sure the address is on the heap and is not in a redzone.
28 void* region_ptr;
29 size_t region_size;
30 const char* allocation_type = __asan_locate_address(
31 reinterpret_cast<void*>(address), nullptr, 0, ®ion_ptr, ®ion_size);
32
33 auto region_base = reinterpret_cast<uintptr_t>(region_ptr);
34 if (strcmp(allocation_type, "heap") != 0 || address < region_base ||
35 address >=
36 region_base + region_size) { // We exclude pointers one past the end
37 // of an allocations from the analysis
38 // for now because they're to fragile.
39 return false;
40 }
41
42 // Make sure the allocation has been actually freed rather than
43 // user-poisoned.
44 int free_thread_id = -1;
45 __asan_get_free_stack(region_ptr, nullptr, 0, &free_thread_id);
46 return free_thread_id != -1;
47 }
48
49 // Force a non-optimizable memory load operation to trigger an ASan crash.
CrashImmediatelyOnUseAfterFree(uintptr_t address)50 NOINLINE NOT_TAIL_CALLED void CrashImmediatelyOnUseAfterFree(
51 uintptr_t address) {
52 NO_CODE_FOLDING();
53 auto unused = *reinterpret_cast<char const volatile*>(address);
54 asm volatile("" : "+r"(unused));
55 }
56
WrapPtr(uintptr_t address)57 void WrapPtr(uintptr_t address) {
58 auto& service = RawPtrAsanService::GetInstance();
59
60 if (service.is_instantiation_check_enabled() && IsFreedHeapPointer(address)) {
61 RawPtrAsanService::SetPendingReport(
62 RawPtrAsanService::ReportType::kInstantiation,
63 reinterpret_cast<void*>(address));
64 service.CrashOnDanglingInstantiation(reinterpret_cast<void*>(address));
65 }
66 }
67
ReleaseWrappedPtr(uintptr_t)68 void ReleaseWrappedPtr(uintptr_t) {}
69
SafelyUnwrapForDereference(uintptr_t address)70 void SafelyUnwrapForDereference(uintptr_t address) {
71 if (RawPtrAsanService::GetInstance().is_dereference_check_enabled() &&
72 IsFreedHeapPointer(address)) {
73 RawPtrAsanService::SetPendingReport(
74 RawPtrAsanService::ReportType::kDereference,
75 reinterpret_cast<void*>(address));
76 CrashImmediatelyOnUseAfterFree(address);
77 }
78 }
79
SafelyUnwrapForExtraction(uintptr_t address)80 void SafelyUnwrapForExtraction(uintptr_t address) {
81 auto& service = RawPtrAsanService::GetInstance();
82
83 if ((service.is_extraction_check_enabled() ||
84 service.is_dereference_check_enabled()) &&
85 IsFreedHeapPointer(address)) {
86 RawPtrAsanService::SetPendingReport(
87 RawPtrAsanService::ReportType::kExtraction,
88 reinterpret_cast<void*>(address));
89 // If the dereference check is enabled, we still record the extraction event
90 // to catch the potential subsequent dangling dereference, but don't report
91 // the extraction itself.
92 if (service.is_extraction_check_enabled()) {
93 service.WarnOnDanglingExtraction(reinterpret_cast<void*>(address));
94 }
95 }
96 }
97
UnsafelyUnwrapForComparison(uintptr_t)98 void UnsafelyUnwrapForComparison(uintptr_t) {}
99
Advance(uintptr_t,uintptr_t)100 void Advance(uintptr_t, uintptr_t) {}
101
Duplicate(uintptr_t)102 void Duplicate(uintptr_t) {}
103
WrapPtrForDuplication(uintptr_t)104 void WrapPtrForDuplication(uintptr_t) {}
105
UnsafelyUnwrapForDuplication(uintptr_t)106 void UnsafelyUnwrapForDuplication(uintptr_t) {}
107
108 } // namespace
109
GetRawPtrAsanHooks()110 const RawPtrHooks* GetRawPtrAsanHooks() {
111 static constexpr RawPtrHooks hooks = {
112 WrapPtr,
113 ReleaseWrappedPtr,
114 SafelyUnwrapForDereference,
115 SafelyUnwrapForExtraction,
116 UnsafelyUnwrapForComparison,
117 Advance,
118 Duplicate,
119 WrapPtrForDuplication,
120 UnsafelyUnwrapForDuplication,
121 };
122
123 return &hooks;
124 }
125
126 } // namespace base::internal
127
128 #endif // BUILDFLAG(USE_ASAN_BACKUP_REF_PTR)
129