Add an android_unsafe_frame_pointer_chase function.

This function will be used by Scudo and GWP-ASan to efficiently collect
stack traces for frames built with frame pointers.

Bug: 135634846
Bug: 135772972
Change-Id: Ic63efdbafe11dfbb1226b5b4b403d53c4dbf28f3
Merged-In: Ic63efdbafe11dfbb1226b5b4b403d53c4dbf28f3

9 files changed, 244 insertions, 0 deletions

diff --git a/libc/Android.bp b/libc/Android.bp
index 0f8ed3e59..5d217cb50 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -1286,12 +1286,14 @@ cc_library_static {
         // The following implementations depend on pthread data or implementation,
         // so we can't include them in libc_ndk.a.
         "bionic/__cxa_thread_atexit_impl.cpp",
+        "bionic/android_unsafe_frame_pointer_chase.cpp",
         "stdlib/atexit.c",
         "bionic/fork.cpp",
     ],
 
     cppflags: ["-Wold-style-cast"],
     include_dirs: ["bionic/libstdc++/include"],
+    header_libs: ["bionic_libc_platform_headers"],
     name: "libc_pthread",
 }
 
diff --git a/libc/bionic/__libc_init_main_thread.cpp b/libc/bionic/__libc_init_main_thread.cpp
index 94cf1f8e3..56a848888 100644
--- a/libc/bionic/__libc_init_main_thread.cpp
+++ b/libc/bionic/__libc_init_main_thread.cpp
@@ -81,6 +81,7 @@ extern "C" void __libc_init_main_thread_early(const KernelArgumentBlock& args,
   __set_tls(&temp_tcb->tls_slot(0));
   main_thread.tid = __getpid();
   main_thread.set_cached_pid(main_thread.tid);
+  main_thread.stack_top = reinterpret_cast<uintptr_t>(args.argv);
 }
 
 // This code is used both by each new pthread and the code that initializes the main thread.
diff --git a/libc/bionic/android_unsafe_frame_pointer_chase.cpp b/libc/bionic/android_unsafe_frame_pointer_chase.cpp
new file mode 100644
index 000000000..0fb086e49
--- /dev/null
+++ b/libc/bionic/android_unsafe_frame_pointer_chase.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "platform/bionic/android_unsafe_frame_pointer_chase.h"
+
+#include "pthread_internal.h"
+#include "platform/bionic/mte.h"
+
+/*
+ * Implement fast stack unwinding for stack frames with frame pointers. Stores at most num_entries
+ * return addresses to buffer buf. Returns the number of available return addresses, which may be
+ * greater than num_entries.
+ *
+ * This function makes no guarantees about its behavior on encountering a frame built without frame
+ * pointers, except that it should not crash or enter an infinite loop, and that any frames prior to
+ * the frame built without frame pointers should be correct.
+ *
+ * This function is only meant to be used with memory safety tools such as sanitizers which need to
+ * take stack traces efficiently. Normal applications should use APIs such as libunwindstack or
+ * _Unwind_Backtrace.
+ */
+__attribute__((no_sanitize("address", "hwaddress"))) size_t android_unsafe_frame_pointer_chase(
+    uintptr_t* buf, size_t num_entries) {
+  // Disable MTE checks for the duration of this function, since we can't be sure that following
+  // next_frame pointers won't cause us to read from tagged memory. ASAN/HWASAN are disabled here
+  // for the same reason.
+  ScopedDisableMTE x;
+
+  struct frame_record {
+    uintptr_t next_frame, return_addr;
+  };
+
+  auto begin = reinterpret_cast<uintptr_t>(__builtin_frame_address(0));
+  uintptr_t end = __get_thread()->stack_top;
+  size_t num_frames = 0;
+  while (1) {
+    auto* frame = reinterpret_cast<frame_record*>(begin);
+    if (num_frames < num_entries) {
+      buf[num_frames] = frame->return_addr;
+    }
+    ++num_frames;
+    if (frame->next_frame < begin + sizeof(frame_record) || frame->next_frame >= end ||
+        frame->next_frame % sizeof(void*) != 0) {
+      break;
+    }
+    begin = frame->next_frame;
+  }
+
+  return num_frames;
+}
diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp
index 4f7ac2bb2..d4a8bef26 100644
--- a/libc/bionic/pthread_create.cpp
+++ b/libc/bionic/pthread_create.cpp
@@ -300,6 +300,7 @@ static int __allocate_thread(pthread_attr_t* attr, bionic_tcb** tcbp, void** chi
   thread->mmap_size = mapping.mmap_size;
   thread->mmap_base_unguarded = mapping.mmap_base_unguarded;
   thread->mmap_size_unguarded = mapping.mmap_size_unguarded;
+  thread->stack_top = reinterpret_cast<uintptr_t>(stack_top);
 
   *tcbp = tcb;
   *child_stack = stack_top;
diff --git a/libc/bionic/pthread_internal.h b/libc/bionic/pthread_internal.h
index 22b0558da..ab8b9556d 100644
--- a/libc/bionic/pthread_internal.h
+++ b/libc/bionic/pthread_internal.h
@@ -125,6 +125,10 @@ class pthread_internal_t {
   //    code to handle retries.
   void* shadow_call_stack_guard_region;
 
+  // A pointer to the top of the stack. This lets android_unsafe_frame_pointer_chase determine the
+  // top of the stack quickly, which would otherwise require special logic for the main thread.
+  uintptr_t stack_top;
+
   Lock startup_handshake_lock;
 
   void* mmap_base;
diff --git a/libc/libc.map.txt b/libc/libc.map.txt
index 2ca4b212d..54da02ef0 100644
--- a/libc/libc.map.txt
+++ b/libc/libc.map.txt
@@ -1707,6 +1707,7 @@ LIBC_PRIVATE {
     android_gethostbyaddrfornetcontext;
     android_gethostbynamefornet;
     android_gethostbynamefornetcontext;
+    android_unsafe_frame_pointer_chase;
     arc4random_addrandom; # arm x86 mips
     arc4random_stir; # arm x86 mips
     atexit; # arm
diff --git a/libc/platform/bionic/android_unsafe_frame_pointer_chase.h b/libc/platform/bionic/android_unsafe_frame_pointer_chase.h
new file mode 100644
index 000000000..2b9a32fda
--- /dev/null
+++ b/libc/platform/bionic/android_unsafe_frame_pointer_chase.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *  * Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *  * Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in
+ *    the documentation and/or other materials provided with the
+ *    distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+/*
+ * Implement fast stack unwinding for stack frames with frame pointers. Stores at most num_entries
+ * return addresses to buffer buf. Returns the number of available return addresses, which may be
+ * greater than num_entries.
+ *
+ * This function makes no guarantees about its behavior on encountering a frame built without frame
+ * pointers, except that it should not crash or enter an infinite loop, and that any frames prior to
+ * the frame built without frame pointers should be correct.
+ *
+ * This function is only meant to be used with memory safety tools such as sanitizers which need to
+ * take stack traces efficiently. Normal applications should use APIs such as libunwindstack or
+ * _Unwind_Backtrace.
+ */
+extern "C" size_t android_unsafe_frame_pointer_chase(uintptr_t* buf, size_t num_entries);
diff --git a/tests/Android.bp b/tests/Android.bp
index e5301323b..cb275a266 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -295,6 +295,20 @@ cc_test_library {
     },
 }
 
+cc_test_library {
+    name: "libBionicFramePointerTests",
+    defaults: ["bionic_tests_defaults"],
+    srcs: [
+        "android_unsafe_frame_pointer_chase_test.cpp",
+    ],
+    include_dirs: [
+        "bionic/libc",
+    ],
+    cflags: [
+        "-fno-omit-frame-pointer",
+    ],
+}
+
 // -----------------------------------------------------------------------------
 // Fortify tests.
 // -----------------------------------------------------------------------------
@@ -444,6 +458,7 @@ cc_test_library {
     whole_static_libs: [
         "libBionicStandardTests",
         "libBionicElfTlsTests",
+        "libBionicFramePointerTests",
         "libfortify1-tests-clang",
         "libfortify1-new-tests-clang",
         "libfortify2-tests-clang",
diff --git a/tests/android_unsafe_frame_pointer_chase_test.cpp b/tests/android_unsafe_frame_pointer_chase_test.cpp
new file mode 100644
index 000000000..dd04c3377
--- /dev/null
+++ b/tests/android_unsafe_frame_pointer_chase_test.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#if defined(__BIONIC__)
+
+#include "platform/bionic/android_unsafe_frame_pointer_chase.h"
+
+// Prevent tail calls inside recurse.
+__attribute__((weak, noinline)) size_t nop(size_t val) {
+  return val;
+}
+
+// Call android_unsafe_frame_pointer_chase inside count recurse stack frames.
+__attribute__((weak, noinline)) int recurse(int count, uintptr_t* buf, size_t num_entries) {
+  if (count != 0) return nop(recurse(count - 1, buf, num_entries));
+  return nop(android_unsafe_frame_pointer_chase(buf, num_entries));
+}
+
+static constexpr size_t kNumFrames = 32;
+
+static bool CheckFrames(uintptr_t* frames, size_t num_frames) {
+  // We expect one recurse frame calling android_unsafe_frame_pointer_chase, followed by kNumFrames identical
+  // recurse frames calling themselves, followed by at least one frame (the first caller of
+  // recurse).
+  if (num_frames < kNumFrames + 2) {
+    printf("num_frames (0x%zu) < kNumFrames + 2", num_frames);
+    return false;
+  }
+
+  if (frames[0] == frames[1]) {
+    printf("frames[0] == frames[1] (0x%zx)", frames[0]);
+    return false;
+  }
+
+  for (size_t i = 2; i <= kNumFrames; ++i) {
+    if (frames[i] != frames[1]) {
+      printf("frames[i] (0x%zx) != frames[1] (0x%zx)", frames[i], frames[1]);
+      return false;
+    }
+  }
+
+  if (frames[kNumFrames] == frames[kNumFrames + 1]) {
+    printf("frames[kNumFrames] == frames[kNumFrames + 1] (0x%zx)", frames[kNumFrames]);
+    return false;
+  }
+
+  return true;
+}
+
+TEST(android_unsafe_frame_pointer_chase, main_thread) {
+  size_t size = recurse(kNumFrames, 0, 0);
+
+  uintptr_t frames[kNumFrames + 2];
+  size_t size2 = recurse(kNumFrames, frames, kNumFrames + 2);
+  EXPECT_EQ(size2, size);
+
+  EXPECT_TRUE(CheckFrames(frames, size));
+}
+
+static void *BacktraceThread(void *) {
+  size_t size = recurse(kNumFrames, 0, 0);
+
+  uintptr_t frames[kNumFrames + 2];
+  size_t size2 = recurse(kNumFrames, frames, kNumFrames + 2);
+  if (size2 != size) {
+    return (void*)"size2 != size";
+  }
+
+  if (!CheckFrames(frames, size)) {
+    return (void*)"CheckFrames failed";
+  }
+  return nullptr;
+}
+
+TEST(android_unsafe_frame_pointer_chase, pthread) {
+  pthread_t t;
+  ASSERT_EQ(0, pthread_create(&t, nullptr, BacktraceThread, nullptr));
+  void* retval;
+  ASSERT_EQ(0, pthread_join(t, &retval));
+  EXPECT_EQ(nullptr, reinterpret_cast<char*>(retval));
+}
+
+#endif // __BIONIC__