mfbt/Poison.cpp

   1 /* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
   2 /* vim: set ts=8 sts=2 et sw=2 tw=80: */
   3 /* This Source Code Form is subject to the terms of the Mozilla Public
   4  * License, v. 2.0. If a copy of the MPL was not distributed with this
   5  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
   6
   7 /*
   8  * A poison value that can be used to fill a memory space with
   9  * an address that leads to a safe crash when dereferenced.
  10  */
  11
  12 #include "mozilla/Poison.h"
  13
  14 #include "mozilla/Assertions.h"
  15 #ifdef _WIN32
  16 #  include <windows.h>
  17 #elif !defined(__OS2__)
  18 #  include <unistd.h>
  19 #  include <sys/mman.h>
  20 #  ifndef MAP_ANON
  21 #    ifdef MAP_ANONYMOUS
  22 #      define MAP_ANON MAP_ANONYMOUS
  23 #    else
  24 #      error "Don't know how to get anonymous memory"
  25 #    endif
  26 #  endif
  27 #endif
  28
  29 // Freed memory is filled with a poison value, which we arrange to
  30 // form a pointer either to an always-unmapped region of the address
  31 // space, or to a page that has been reserved and rendered
  32 // inaccessible via OS primitives.  See tests/TestPoisonArea.cpp for
  33 // extensive discussion of the requirements for this page.  The code
  34 // from here to 'class FreeList' needs to be kept in sync with that
  35 // file.
  36
  37 #ifdef _WIN32
  38 static void* ReserveRegion(uintptr_t aRegion, uintptr_t aSize) {
  39   return VirtualAlloc((void*)aRegion, aSize, MEM_RESERVE, PAGE_NOACCESS);
  40 }
  41
  42 static void ReleaseRegion(void* aRegion, uintptr_t aSize) {
  43   VirtualFree(aRegion, aSize, MEM_RELEASE);
  44 }
  45
  46 static bool ProbeRegion(uintptr_t aRegion, uintptr_t aSize) {
  47   SYSTEM_INFO sinfo;
  48   GetSystemInfo(&sinfo);
  49   if (aRegion >= (uintptr_t)sinfo.lpMaximumApplicationAddress &&
  50       aRegion + aSize >= (uintptr_t)sinfo.lpMaximumApplicationAddress) {
  51     return true;
  52   } else {
  53     return false;
  54   }
  55 }
  56
  57 static uintptr_t GetDesiredRegionSize() {
  58   SYSTEM_INFO sinfo;
  59   GetSystemInfo(&sinfo);
  60   return sinfo.dwAllocationGranularity;
  61 }
  62
  63 #  define RESERVE_FAILED 0
  64
  65 #elif defined(__OS2__)
  66 static void* ReserveRegion(uintptr_t aRegion, uintptr_t aSize) {
  67   // OS/2 doesn't support allocation at an arbitrary address,
  68   // so return an address that is known to be invalid.
  69   return (void*)0xFFFD0000;
  70 }
  71
  72 static void ReleaseRegion(void* aRegion, uintptr_t aSize) { return; }
  73
  74 static bool ProbeRegion(uintptr_t aRegion, uintptr_t aSize) {
  75   // There's no reliable way to probe an address in the system
  76   // arena other than by touching it and seeing if a trap occurs.
  77   return false;
  78 }
  79
  80 static uintptr_t GetDesiredRegionSize() {
  81   // Page size is fixed at 4k.
  82   return 0x1000;
  83 }
  84
  85 #  define RESERVE_FAILED 0
  86
  87 #else  // Unix
  88
  89 #  include "mozilla/TaggedAnonymousMemory.h"
  90
  91 static void* ReserveRegion(uintptr_t aRegion, uintptr_t aSize) {
  92   return MozTaggedAnonymousMmap(reinterpret_cast<void*>(aRegion), aSize,
  93                                 PROT_NONE, MAP_PRIVATE | MAP_ANON, -1, 0,
  94                                 "poison");
  95 }
  96
  97 static void ReleaseRegion(void* aRegion, uintptr_t aSize) {
  98   munmap(aRegion, aSize);
  99 }
 100
 101 static bool ProbeRegion(uintptr_t aRegion, uintptr_t aSize) {
 102 #  ifdef XP_SOLARIS
 103   if (posix_madvise(reinterpret_cast<void*>(aRegion), aSize,
 104                     POSIX_MADV_NORMAL)) {
 105 #  else
 106   if (madvise(reinterpret_cast<void*>(aRegion), aSize, MADV_NORMAL)) {
 107 #  endif
 108     return true;
 109   } else {
 110     return false;
 111   }
 112 }
 113
 114 static uintptr_t GetDesiredRegionSize() { return sysconf(_SC_PAGESIZE); }
 115
 116 #  define RESERVE_FAILED MAP_FAILED
 117
 118 #endif  // system dependencies
 119
 120 static_assert((sizeof(uintptr_t) == 4 || sizeof(uintptr_t) == 8) &&
 121               (sizeof(uintptr_t) == sizeof(void*)));
 122
 123 static uintptr_t ReservePoisonArea(uintptr_t rgnsize) {
 124   if (sizeof(uintptr_t) == 8) {
 125     // Use the hardware-inaccessible region.
 126     // We have to avoid 64-bit constants and shifts by 32 bits, since this
 127     // code is compiled in 32-bit mode, although it is never executed there.
 128     return (((uintptr_t(0x7FFFFFFFu) << 31) << 1 | uintptr_t(0xF0DEAFFFu)) &
 129             ~(rgnsize - 1));
 130   }
 131
 132   // First see if we can allocate the preferred poison address from the OS.
 133   uintptr_t candidate = (0xF0DEAFFF & ~(rgnsize - 1));
 134   void* result = ReserveRegion(candidate, rgnsize);
 135   if (result == (void*)candidate) {
 136     // success - inaccessible page allocated
 137     return candidate;
 138   }
 139
 140   // That didn't work, so see if the preferred address is within a range
 141   // of permanently inacessible memory.
 142   if (ProbeRegion(candidate, rgnsize)) {
 143     // success - selected page cannot be usable memory
 144     if (result != RESERVE_FAILED) {
 145       ReleaseRegion(result, rgnsize);
 146     }
 147     return candidate;
 148   }
 149
 150   // The preferred address is already in use.  Did the OS give us a
 151   // consolation prize?
 152   if (result != RESERVE_FAILED) {
 153     return uintptr_t(result);
 154   }
 155
 156   // It didn't, so try to allocate again, without any constraint on
 157   // the address.
 158   result = ReserveRegion(0, rgnsize);
 159   if (result != RESERVE_FAILED) {
 160     return uintptr_t(result);
 161   }
 162
 163   MOZ_CRASH("no usable poison region identified");
 164 }
 165
 166 static uintptr_t GetPoisonValue(uintptr_t aBase, uintptr_t aSize) {
 167   if (aSize == 0) {  // can't happen
 168     return 0;
 169   }
 170   return aBase + aSize / 2 - 1;
 171 }
 172
 173 // Poison is used so pervasively throughout the codebase that we decided it was
 174 // best to actually use ordered dynamic initialization of globals (AKA static
 175 // constructors) for this. This way everything will have properly initialized
 176 // poison -- except other dynamic initialization code in libmozglue, which there
 177 // shouldn't be much of. (libmozglue is one of the first things loaded, and
 178 // specifically comes before libxul, so nearly all gecko code runs strictly
 179 // after this.)
 180 extern "C" {
 181 uintptr_t gMozillaPoisonSize = GetDesiredRegionSize();
 182 uintptr_t gMozillaPoisonBase = ReservePoisonArea(gMozillaPoisonSize);
 183 uintptr_t gMozillaPoisonValue =
 184     GetPoisonValue(gMozillaPoisonBase, gMozillaPoisonSize);
 185 }