malloc/malloc-check.c

   1 /* glibc.malloc.check implementation.
   2    Copyright (C) 2001-2024 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public License as
   7    published by the Free Software Foundation; either version 2.1 of the
   8    License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; see the file COPYING.LIB.  If
  17    not, see <https://www.gnu.org/licenses/>.  */
  18
  19 #define __mremap mremap
  20 #include "malloc.c"
  21
  22 /* When memory is tagged, the checking data is stored in the user part
  23    of the chunk.  We can't rely on the user not having modified the
  24    tags, so fetch the tag at each location before dereferencing
  25    it.  */
  26 #define SAFE_CHAR_OFFSET(p,offset) \
  27   ((unsigned char *) tag_at (((unsigned char *) p) + offset))
  28
  29 /* A simple, standard set of debugging hooks.  Overhead is `only' one
  30    byte per chunk; still this will catch most cases of double frees or
  31    overruns.  The goal here is to avoid obscure crashes due to invalid
  32    usage, unlike in the MALLOC_DEBUG code. */
  33
  34 static unsigned char
  35 magicbyte (const void *p)
  36 {
  37   unsigned char magic;
  38
  39   magic = (((uintptr_t) p >> 3) ^ ((uintptr_t) p >> 11)) & 0xFF;
  40   /* Do not return 1.  See the comment in mem2mem_check().  */
  41   if (magic == 1)
  42     ++magic;
  43   return magic;
  44 }
  45
  46 /* Visualize the chunk as being partitioned into blocks of 255 bytes from the
  47    highest address of the chunk, downwards.  The end of each block tells
  48    us the size of that block, up to the actual size of the requested
  49    memory.  Our magic byte is right at the end of the requested size, so we
  50    must reach it with this iteration, otherwise we have witnessed a memory
  51    corruption.  */
  52 static size_t
  53 malloc_check_get_size (void *mem)
  54 {
  55   size_t size;
  56   unsigned char c;
  57   mchunkptr p = mem2chunk (mem);
  58   unsigned char magic = magicbyte (p);
  59
  60   for (size = CHUNK_HDR_SZ + memsize (p) - 1;
  61        (c = *SAFE_CHAR_OFFSET (p, size)) != magic;
  62        size -= c)
  63     {
  64       if (c <= 0 || size < (c + CHUNK_HDR_SZ))
  65         malloc_printerr ("malloc_check_get_size: memory corruption");
  66     }
  67
  68   /* chunk2mem size.  */
  69   return size - CHUNK_HDR_SZ;
  70 }
  71
  72 /* Instrument a chunk with overrun detector byte(s) and convert it
  73    into a user pointer with requested size req_sz. */
  74
  75 static void *
  76 mem2mem_check (void *ptr, size_t req_sz)
  77 {
  78   mchunkptr p;
  79   unsigned char *m_ptr = ptr;
  80   size_t max_sz, block_sz, i;
  81   unsigned char magic;
  82
  83   if (!ptr)
  84     return ptr;
  85
  86   p = mem2chunk (ptr);
  87   magic = magicbyte (p);
  88   max_sz = memsize (p);
  89
  90   for (i = max_sz - 1; i > req_sz; i -= block_sz)
  91     {
  92       block_sz = MIN (i - req_sz, 0xff);
  93       /* Don't allow the magic byte to appear in the chain of length bytes.
  94          For the following to work, magicbyte cannot return 0x01.  */
  95       if (block_sz == magic)
  96         --block_sz;
  97
  98       *SAFE_CHAR_OFFSET (m_ptr, i) = block_sz;
  99     }
 100   *SAFE_CHAR_OFFSET (m_ptr, req_sz) = magic;
 101   return (void *) m_ptr;
 102 }
 103
 104 /* Convert a pointer to be free()d or realloc()ed to a valid chunk
 105    pointer.  If the provided pointer is not valid, return NULL. */
 106
 107 static mchunkptr
 108 mem2chunk_check (void *mem, unsigned char **magic_p)
 109 {
 110   mchunkptr p;
 111   INTERNAL_SIZE_T sz, c;
 112   unsigned char magic;
 113
 114   if (!aligned_OK (mem))
 115     return NULL;
 116
 117   p = mem2chunk (mem);
 118   sz = chunksize (p);
 119   magic = magicbyte (p);
 120   if (!chunk_is_mmapped (p))
 121     {
 122       /* Must be a chunk in conventional heap memory. */
 123       int contig = contiguous (&main_arena);
 124       if ((contig &&
 125            ((char *) p < mp_.sbrk_base ||
 126             ((char *) p + sz) >= (mp_.sbrk_base + main_arena.system_mem))) ||
 127           sz < MINSIZE || sz & MALLOC_ALIGN_MASK || !inuse (p) ||
 128           (!prev_inuse (p) && ((prev_size (p) & MALLOC_ALIGN_MASK) != 0 ||
 129                                (contig && (char *) prev_chunk (p) < mp_.sbrk_base) ||
 130                                next_chunk (prev_chunk (p)) != p)))
 131         return NULL;
 132
 133       for (sz = CHUNK_HDR_SZ + memsize (p) - 1;
 134            (c = *SAFE_CHAR_OFFSET (p, sz)) != magic;
 135            sz -= c)
 136         {
 137           if (c == 0 || sz < (c + CHUNK_HDR_SZ))
 138             return NULL;
 139         }
 140     }
 141   else
 142     {
 143       unsigned long offset, page_mask = GLRO (dl_pagesize) - 1;
 144
 145       /* mmap()ed chunks have MALLOC_ALIGNMENT or higher power-of-two
 146          alignment relative to the beginning of a page.  Check this
 147          first. */
 148       offset = (unsigned long) mem & page_mask;
 149       if ((offset != MALLOC_ALIGNMENT && offset != 0 && offset != 0x10 &&
 150            offset != 0x20 && offset != 0x40 && offset != 0x80 && offset != 0x100 &&
 151            offset != 0x200 && offset != 0x400 && offset != 0x800 && offset != 0x1000 &&
 152            offset < 0x2000) ||
 153           !chunk_is_mmapped (p) || prev_inuse (p) ||
 154           ((((unsigned long) p - prev_size (p)) & page_mask) != 0) ||
 155           ((prev_size (p) + sz) & page_mask) != 0)
 156         return NULL;
 157
 158       for (sz = CHUNK_HDR_SZ + memsize (p) - 1;
 159            (c = *SAFE_CHAR_OFFSET (p, sz)) != magic;
 160            sz -= c)
 161         {
 162           if (c == 0 || sz < (c + CHUNK_HDR_SZ))
 163             return NULL;
 164         }
 165     }
 166
 167   unsigned char* safe_p = SAFE_CHAR_OFFSET (p, sz);
 168   *safe_p ^= 0xFF;
 169   if (magic_p)
 170     *magic_p = safe_p;
 171   return p;
 172 }
 173
 174 /* Check for corruption of the top chunk.  */
 175 static void
 176 top_check (void)
 177 {
 178   mchunkptr t = top (&main_arena);
 179
 180   if (t == initial_top (&main_arena) ||
 181       (!chunk_is_mmapped (t) &&
 182        chunksize (t) >= MINSIZE &&
 183        prev_inuse (t) &&
 184        (!contiguous (&main_arena) ||
 185         (char *) t + chunksize (t) == mp_.sbrk_base + main_arena.system_mem)))
 186     return;
 187
 188   malloc_printerr ("malloc: top chunk is corrupt");
 189 }
 190
 191 static void *
 192 malloc_check (size_t sz)
 193 {
 194   void *victim;
 195   size_t nb;
 196
 197   if (__builtin_add_overflow (sz, 1, &nb))
 198     {
 199       __set_errno (ENOMEM);
 200       return NULL;
 201     }
 202
 203   __libc_lock_lock (main_arena.mutex);
 204   top_check ();
 205   victim = _int_malloc (&main_arena, nb);
 206   __libc_lock_unlock (main_arena.mutex);
 207   return mem2mem_check (tag_new_usable (victim), sz);
 208 }
 209
 210 static void
 211 free_check (void *mem)
 212 {
 213   mchunkptr p;
 214
 215   if (!mem)
 216     return;
 217
 218   int err = errno;
 219
 220   /* Quickly check that the freed pointer matches the tag for the memory.
 221      This gives a useful double-free detection.  */
 222   if (__glibc_unlikely (mtag_enabled))
 223     *(volatile char *)mem;
 224
 225   __libc_lock_lock (main_arena.mutex);
 226   p = mem2chunk_check (mem, NULL);
 227   if (!p)
 228     malloc_printerr ("free(): invalid pointer");
 229   if (chunk_is_mmapped (p))
 230     {
 231       __libc_lock_unlock (main_arena.mutex);
 232       munmap_chunk (p);
 233     }
 234   else
 235     {
 236       /* Mark the chunk as belonging to the library again.  */
 237       (void)tag_region (chunk2mem (p), memsize (p));
 238       _int_free (&main_arena, p, 1);
 239       __libc_lock_unlock (main_arena.mutex);
 240     }
 241   __set_errno (err);
 242 }
 243
 244 static void *
 245 realloc_check (void *oldmem, size_t bytes)
 246 {
 247   INTERNAL_SIZE_T chnb;
 248   void *newmem = 0;
 249   unsigned char *magic_p;
 250   size_t rb;
 251
 252   if (__builtin_add_overflow (bytes, 1, &rb))
 253     {
 254       __set_errno (ENOMEM);
 255       return NULL;
 256     }
 257   if (oldmem == 0)
 258     return malloc_check (bytes);
 259
 260   if (bytes == 0)
 261     {
 262       free_check (oldmem);
 263       return NULL;
 264     }
 265
 266   /* Quickly check that the freed pointer matches the tag for the memory.
 267      This gives a useful double-free detection.  */
 268   if (__glibc_unlikely (mtag_enabled))
 269     *(volatile char *)oldmem;
 270
 271   __libc_lock_lock (main_arena.mutex);
 272   const mchunkptr oldp = mem2chunk_check (oldmem, &magic_p);
 273   __libc_lock_unlock (main_arena.mutex);
 274   if (!oldp)
 275     malloc_printerr ("realloc(): invalid pointer");
 276   const INTERNAL_SIZE_T oldsize = chunksize (oldp);
 277
 278   chnb = checked_request2size (rb);
 279   if (chnb == 0)
 280     {
 281       __set_errno (ENOMEM);
 282       goto invert;
 283     }
 284
 285   __libc_lock_lock (main_arena.mutex);
 286
 287   if (chunk_is_mmapped (oldp))
 288     {
 289 #if HAVE_MREMAP
 290       mchunkptr newp = mremap_chunk (oldp, chnb);
 291       if (newp)
 292         newmem = chunk2mem_tag (newp);
 293       else
 294 #endif
 295       {
 296         /* Note the extra SIZE_SZ overhead. */
 297         if (oldsize - SIZE_SZ >= chnb)
 298           newmem = oldmem; /* do nothing */
 299         else
 300           {
 301             /* Must alloc, copy, free. */
 302             top_check ();
 303             newmem = _int_malloc (&main_arena, rb);
 304             if (newmem)
 305               {
 306                 memcpy (newmem, oldmem, oldsize - CHUNK_HDR_SZ);
 307                 munmap_chunk (oldp);
 308               }
 309           }
 310       }
 311     }
 312   else
 313     {
 314       top_check ();
 315       newmem = _int_realloc (&main_arena, oldp, oldsize, chnb);
 316     }
 317
 318   DIAG_PUSH_NEEDS_COMMENT;
 319 #if __GNUC_PREREQ (7, 0)
 320   /* GCC 7 warns about magic_p may be used uninitialized.  But we never
 321      reach here if magic_p is uninitialized.  */
 322   DIAG_IGNORE_NEEDS_COMMENT (7, "-Wmaybe-uninitialized");
 323 #endif
 324   /* mem2chunk_check changed the magic byte in the old chunk.
 325      If newmem is NULL, then the old chunk will still be used though,
 326      so we need to invert that change here.  */
 327 invert:
 328   if (newmem == NULL)
 329     *magic_p ^= 0xFF;
 330   DIAG_POP_NEEDS_COMMENT;
 331
 332   __libc_lock_unlock (main_arena.mutex);
 333
 334   return mem2mem_check (tag_new_usable (newmem), bytes);
 335 }
 336
 337 static void *
 338 memalign_check (size_t alignment, size_t bytes)
 339 {
 340   void *mem;
 341
 342   if (alignment <= MALLOC_ALIGNMENT)
 343     return malloc_check (bytes);
 344
 345   if (alignment < MINSIZE)
 346     alignment = MINSIZE;
 347
 348   /* If the alignment is greater than SIZE_MAX / 2 + 1 it cannot be a
 349      power of 2 and will cause overflow in the check below.  */
 350   if (alignment > SIZE_MAX / 2 + 1)
 351     {
 352       __set_errno (EINVAL);
 353       return NULL;
 354     }
 355
 356   /* Check for overflow.  */
 357   if (bytes > SIZE_MAX - alignment - MINSIZE)
 358     {
 359       __set_errno (ENOMEM);
 360       return NULL;
 361     }
 362
 363   /* Make sure alignment is power of 2.  */
 364   if (!powerof2 (alignment))
 365     {
 366       size_t a = MALLOC_ALIGNMENT * 2;
 367       while (a < alignment)
 368         a <<= 1;
 369       alignment = a;
 370     }
 371
 372   __libc_lock_lock (main_arena.mutex);
 373   top_check ();
 374   mem = _int_memalign (&main_arena, alignment, bytes + 1);
 375   __libc_lock_unlock (main_arena.mutex);
 376   return mem2mem_check (tag_new_usable (mem), bytes);
 377 }
 378
 379 static void
 380 TUNABLE_CALLBACK (set_mallopt_check) (tunable_val_t *valp)
 381 {
 382   int32_t value = (int32_t) valp->numval;
 383   if (value != 0)
 384     __malloc_debug_enable (MALLOC_CHECK_HOOK);
 385 }
 386
 387 static bool
 388 initialize_malloc_check (void)
 389 {
 390   /* This is the copy of the malloc initializer that we pulled in along with
 391      malloc-check.  This does not affect any of the libc malloc structures.  */
 392   ptmalloc_init ();
 393   TUNABLE_GET (check, int32_t, TUNABLE_CALLBACK (set_mallopt_check));
 394   return __is_malloc_debug_enabled (MALLOC_CHECK_HOOK);
 395 }