Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Do not sanitize kernel area on 32-bit targets #278

Closed
ramosian-glider opened this issue Aug 31, 2015 · 16 comments
Closed

Do not sanitize kernel area on 32-bit targets #278

ramosian-glider opened this issue Aug 31, 2015 · 16 comments

Comments

@ramosian-glider
Copy link
Member

Originally reported on Google Code with ID 278

As suggested in https://groups.google.com/forum/#!topic/address-sanitizer/aX4J7H36QDk
it may make sense to avoid mmaping shadow memory for kernel area ( (0xc0000000 - 0xffffffff)
on 32-bit Linux targets. This would save us 128M of virtual adresses.

Reported by tetra2005 on 2014-03-19 15:49:08

@ramosian-glider
Copy link
Member Author

Posted draft commit in http://llvm-reviews.chandlerc.com/D3119

Reported by tetra2005 on 2014-03-19 15:52:33

@ramosian-glider
Copy link
Member Author

64-bit app on x86_64 machine:
|| `[0x10007fff8000, 0x7fffffffffff]` || HighMem    ||
|| `[0x02008fff7000, 0x10007fff7fff]` || HighShadow ||
|| `[0x00008fff7000, 0x02008fff6fff]` || ShadowGap  ||
|| `[0x00007fff8000, 0x00008fff6fff]` || LowShadow  ||
|| `[0x000000000000, 0x00007fff7fff]` || LowMem     ||

32-bit app on x86_64 machine:
|| `[0x40000000, 0xffffffff]` || HighMem    ||
|| `[0x28000000, 0x3fffffff]` || HighShadow ||
|| `[0x24000000, 0x27ffffff]` || ShadowGap  ||
|| `[0x20000000, 0x23ffffff]` || LowShadow  ||
|| `[0x00000000, 0x1fffffff]` || LowMem     ||

32-bit app on i686 machine:
|| `[0x38000000, 0xbfffffff]` || HighMem    ||
|| `[0x27000000, 0x37ffffff]` || HighShadow ||
|| `[0x24000000, 0x26ffffff]` || ShadowGap  ||
|| `[0x20000000, 0x23ffffff]` || LowShadow  ||
|| `[0x00000000, 0x1fffffff]` || LowMem     ||

check-asan and check-sanitizer tests passed (apart from non-portable tests).

Reported by tetra2005 on 2014-03-19 15:54:59

@ramosian-glider
Copy link
Member Author

should be fixed by http://llvm.org/viewvc/llvm-project?rev=204897&view=rev

Reported by konstantin.s.serebryany on 2014-03-27 15:03:56

  • Status changed: Fixed

@ramosian-glider
Copy link
Member Author

fix reverted in http://llvm.org/viewvc/llvm-project?rev=207768&view=rev

Reported by konstantin.s.serebryany on 2014-05-01 16:35:17

  • Status changed: New

@ramosian-glider
Copy link
Member Author

Ok, how about this - try mapping 1 page in the middle of high Gb and see if resulting
addresss managed to get there.

Reported by tetra2005 on 2014-05-05 06:00:17

@ramosian-glider
Copy link
Member Author

Another option would be to scan /proc/PID/maps for read-write regions in high addresses
but this sounds somewhat less robust...

Reported by tetra2005 on 2014-05-05 12:36:41

@ramosian-glider
Copy link
Member Author

We can try 
  1. checking /proc/PID/maps
  2. mmapping several addresses in the upper 1Gb
  3. checking where is the current stack pointer

None of that is exceptionally robust (although #3 should work on most systems I've
encountered). 
Maybe also hide this feature under a flag?

Reported by konstantin.s.serebryany on 2014-05-06 11:49:49

@ramosian-glider
Copy link
Member Author

I'd say mmaping the last page in address space and checking the output sounds pretty
robust. I'm ok with flag though.

Reported by tetra2005 on 2014-05-06 12:34:44

@ramosian-glider
Copy link
Member Author

>> mmaping the last page
This is a subset of #2

Reported by konstantin.s.serebryany on 2014-05-06 12:50:51

@ramosian-glider
Copy link
Member Author

Why do you suggest several mappings btw? AFAIK mmap will try to map the closest page
to the requested one.

Reported by tetra2005 on 2014-05-06 13:00:52

@ramosian-glider
Copy link
Member Author

ah, you suggest to use a hint, not MAP_FIXED. 
May work. Especially if you hide it under a flag :) 

Reported by konstantin.s.serebryany on 2014-05-06 13:49:13

@ramosian-glider
Copy link
Member Author

Ok, I'll send a patch then. As for flags - as I said I personally have no problem with
them but this feature looks really important. Perhaps we could enable it by default
when it's proven stable?

Reported by tetra2005 on 2014-05-06 14:32:51

@ramosian-glider
Copy link
Member Author

We can have it under a flag which is *on* by default,
but it's important to be able to disable it if it goes wrong somewhere

Reported by konstantin.s.serebryany on 2014-05-06 14:36:41

@ramosian-glider
Copy link
Member Author

Ok, mmap trick didn't work for (it looks like kernel does not respect address hint deeply
enough). All other tricks are rather unstable as well.

I think the core problem with schroot is that it sets non-trivial personality. We should
be able to detect this (by checking return value of personality(-1)) and leave default
4G limit unchanged.

Reported by tetra2005 on 2014-05-08 12:15:20

@ramosian-glider
Copy link
Member Author

Done in r204897 and r208760.

Reported by tetra2005 on 2014-06-17 17:12:48

  • Status changed: Done

@ramosian-glider
Copy link
Member Author

Adding Project:AddressSanitizer as part of GitHub migration.

Reported by ramosian.glider on 2015-07-30 09:14:07

  • Labels added: ProjectAddressSanitizer

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant