1 /*
2 * Copyright (C) 2019 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * * Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in
12 * the documentation and/or other materials provided with the
13 * distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include "heap_tagging.h"
30 #include "malloc_common.h"
31 #include "malloc_tagged_pointers.h"
32
33 #include <bionic/pthread_internal.h>
34 #include <platform/bionic/malloc.h>
35
36 extern "C" void scudo_malloc_disable_memory_tagging();
37 extern "C" void scudo_malloc_set_track_allocation_stacks(int);
38
39 // Protected by `g_heap_tagging_lock`.
40 static HeapTaggingLevel heap_tagging_level = M_HEAP_TAGGING_LEVEL_NONE;
41
SetDefaultHeapTaggingLevel()42 void SetDefaultHeapTaggingLevel() {
43 #if defined(__aarch64__)
44 #if !__has_feature(hwaddress_sanitizer)
45 heap_tagging_level = __libc_shared_globals()->initial_heap_tagging_level;
46 #endif
47 switch (heap_tagging_level) {
48 case M_HEAP_TAGGING_LEVEL_TBI:
49 __libc_globals.mutate([](libc_globals* globals) {
50 // Arrange for us to set pointer tags to POINTER_TAG, check tags on
51 // deallocation and untag when passing pointers to the allocator.
52 globals->heap_pointer_tag = (reinterpret_cast<uintptr_t>(POINTER_TAG) << TAG_SHIFT) |
53 (0xffull << CHECK_SHIFT) | (0xffull << UNTAG_SHIFT);
54 });
55 #if defined(USE_SCUDO)
56 scudo_malloc_disable_memory_tagging();
57 #endif // USE_SCUDO
58 break;
59 #if defined(USE_SCUDO)
60 case M_HEAP_TAGGING_LEVEL_SYNC:
61 scudo_malloc_set_track_allocation_stacks(1);
62 break;
63
64 case M_HEAP_TAGGING_LEVEL_NONE:
65 scudo_malloc_disable_memory_tagging();
66 break;
67 #endif // USE_SCUDO
68 default:
69 break;
70 }
71 #endif // aarch64
72 }
73
set_tcf_on_all_threads(int tcf)74 static bool set_tcf_on_all_threads(int tcf) {
75 static int g_tcf;
76 g_tcf = tcf;
77
78 return android_run_on_all_threads(
79 [](void*) {
80 int tagged_addr_ctrl = prctl(PR_GET_TAGGED_ADDR_CTRL, 0, 0, 0, 0);
81 if (tagged_addr_ctrl < 0) {
82 return false;
83 }
84
85 tagged_addr_ctrl = (tagged_addr_ctrl & ~PR_MTE_TCF_MASK) | g_tcf;
86 if (prctl(PR_SET_TAGGED_ADDR_CTRL, tagged_addr_ctrl, 0, 0, 0) < 0) {
87 return false;
88 }
89 return true;
90 },
91 nullptr);
92 }
93
94 pthread_mutex_t g_heap_tagging_lock = PTHREAD_MUTEX_INITIALIZER;
95
96 // Requires `g_heap_tagging_lock` to be held.
GetHeapTaggingLevel()97 HeapTaggingLevel GetHeapTaggingLevel() {
98 return heap_tagging_level;
99 }
100
101 // Requires `g_heap_tagging_lock` to be held.
SetHeapTaggingLevel(HeapTaggingLevel tag_level)102 bool SetHeapTaggingLevel(HeapTaggingLevel tag_level) {
103 if (tag_level == heap_tagging_level) {
104 return true;
105 }
106
107 switch (tag_level) {
108 case M_HEAP_TAGGING_LEVEL_NONE:
109 if (heap_tagging_level == M_HEAP_TAGGING_LEVEL_TBI) {
110 __libc_globals.mutate([](libc_globals* globals) {
111 // Preserve the untag mask (we still want to untag pointers when passing them to the
112 // allocator), but clear the fixed tag and the check mask, so that pointers are no longer
113 // tagged and checks no longer happen.
114 globals->heap_pointer_tag = static_cast<uintptr_t>(0xffull << UNTAG_SHIFT);
115 });
116 } else if (!set_tcf_on_all_threads(PR_MTE_TCF_NONE)) {
117 error_log("SetHeapTaggingLevel: set_tcf_on_all_threads failed");
118 return false;
119 }
120 #if defined(USE_SCUDO)
121 scudo_malloc_disable_memory_tagging();
122 #endif
123 break;
124 case M_HEAP_TAGGING_LEVEL_TBI:
125 case M_HEAP_TAGGING_LEVEL_ASYNC:
126 case M_HEAP_TAGGING_LEVEL_SYNC:
127 if (heap_tagging_level == M_HEAP_TAGGING_LEVEL_NONE) {
128 #if !__has_feature(hwaddress_sanitizer)
129 // Suppress the error message in HWASan builds. Apps can try to enable TBI (or even MTE
130 // modes) being unaware of HWASan, fail them silently.
131 error_log(
132 "SetHeapTaggingLevel: re-enabling tagging after it was disabled is not supported");
133 #endif
134 return false;
135 } else if (tag_level == M_HEAP_TAGGING_LEVEL_TBI ||
136 heap_tagging_level == M_HEAP_TAGGING_LEVEL_TBI) {
137 error_log("SetHeapTaggingLevel: switching between TBI and ASYNC/SYNC is not supported");
138 return false;
139 }
140
141 if (tag_level == M_HEAP_TAGGING_LEVEL_ASYNC) {
142 // When entering ASYNC mode, specify that we want to allow upgrading to SYNC by OR'ing in
143 // the SYNC flag. But if the kernel doesn't support specifying multiple TCF modes, fall back
144 // to specifying a single mode.
145 if (!set_tcf_on_all_threads(PR_MTE_TCF_ASYNC | PR_MTE_TCF_SYNC)) {
146 set_tcf_on_all_threads(PR_MTE_TCF_ASYNC);
147 }
148 #if defined(USE_SCUDO)
149 scudo_malloc_set_track_allocation_stacks(0);
150 #endif
151 } else if (tag_level == M_HEAP_TAGGING_LEVEL_SYNC) {
152 set_tcf_on_all_threads(PR_MTE_TCF_SYNC);
153 #if defined(USE_SCUDO)
154 scudo_malloc_set_track_allocation_stacks(1);
155 #endif
156 }
157 break;
158 default:
159 error_log("SetHeapTaggingLevel: unknown tagging level");
160 return false;
161 }
162
163 heap_tagging_level = tag_level;
164 info_log("SetHeapTaggingLevel: tag level set to %d", tag_level);
165
166 return true;
167 }
168