diff options
Diffstat (limited to 'libc')
| -rw-r--r-- | libc/Android.bp | 2 | ||||
| -rw-r--r-- | libc/bionic/__libc_init_main_thread.cpp | 1 | ||||
| -rw-r--r-- | libc/bionic/android_unsafe_frame_pointer_chase.cpp | 75 | ||||
| -rw-r--r-- | libc/bionic/pthread_create.cpp | 1 | ||||
| -rw-r--r-- | libc/bionic/pthread_internal.h | 4 | ||||
| -rw-r--r-- | libc/libc.map.txt | 1 | ||||
| -rw-r--r-- | libc/platform/bionic/android_unsafe_frame_pointer_chase.h | 47 |
7 files changed, 131 insertions, 0 deletions
diff --git a/libc/Android.bp b/libc/Android.bp index 0f8ed3e59..5d217cb50 100644 --- a/libc/Android.bp +++ b/libc/Android.bp @@ -1286,12 +1286,14 @@ cc_library_static { // The following implementations depend on pthread data or implementation, // so we can't include them in libc_ndk.a. "bionic/__cxa_thread_atexit_impl.cpp", + "bionic/android_unsafe_frame_pointer_chase.cpp", "stdlib/atexit.c", "bionic/fork.cpp", ], cppflags: ["-Wold-style-cast"], include_dirs: ["bionic/libstdc++/include"], + header_libs: ["bionic_libc_platform_headers"], name: "libc_pthread", } diff --git a/libc/bionic/__libc_init_main_thread.cpp b/libc/bionic/__libc_init_main_thread.cpp index 94cf1f8e3..56a848888 100644 --- a/libc/bionic/__libc_init_main_thread.cpp +++ b/libc/bionic/__libc_init_main_thread.cpp @@ -81,6 +81,7 @@ extern "C" void __libc_init_main_thread_early(const KernelArgumentBlock& args, __set_tls(&temp_tcb->tls_slot(0)); main_thread.tid = __getpid(); main_thread.set_cached_pid(main_thread.tid); + main_thread.stack_top = reinterpret_cast<uintptr_t>(args.argv); } // This code is used both by each new pthread and the code that initializes the main thread. diff --git a/libc/bionic/android_unsafe_frame_pointer_chase.cpp b/libc/bionic/android_unsafe_frame_pointer_chase.cpp new file mode 100644 index 000000000..0fb086e49 --- /dev/null +++ b/libc/bionic/android_unsafe_frame_pointer_chase.cpp @@ -0,0 +1,75 @@ +/* + * Copyright (C) 2020 The Android Open Source Project + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT + * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#include "platform/bionic/android_unsafe_frame_pointer_chase.h" + +#include "pthread_internal.h" +#include "platform/bionic/mte.h" + +/* + * Implement fast stack unwinding for stack frames with frame pointers. Stores at most num_entries + * return addresses to buffer buf. Returns the number of available return addresses, which may be + * greater than num_entries. + * + * This function makes no guarantees about its behavior on encountering a frame built without frame + * pointers, except that it should not crash or enter an infinite loop, and that any frames prior to + * the frame built without frame pointers should be correct. + * + * This function is only meant to be used with memory safety tools such as sanitizers which need to + * take stack traces efficiently. Normal applications should use APIs such as libunwindstack or + * _Unwind_Backtrace. + */ +__attribute__((no_sanitize("address", "hwaddress"))) size_t android_unsafe_frame_pointer_chase( + uintptr_t* buf, size_t num_entries) { + // Disable MTE checks for the duration of this function, since we can't be sure that following + // next_frame pointers won't cause us to read from tagged memory. ASAN/HWASAN are disabled here + // for the same reason. + ScopedDisableMTE x; + + struct frame_record { + uintptr_t next_frame, return_addr; + }; + + auto begin = reinterpret_cast<uintptr_t>(__builtin_frame_address(0)); + uintptr_t end = __get_thread()->stack_top; + size_t num_frames = 0; + while (1) { + auto* frame = reinterpret_cast<frame_record*>(begin); + if (num_frames < num_entries) { + buf[num_frames] = frame->return_addr; + } + ++num_frames; + if (frame->next_frame < begin + sizeof(frame_record) || frame->next_frame >= end || + frame->next_frame % sizeof(void*) != 0) { + break; + } + begin = frame->next_frame; + } + + return num_frames; +} diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp index 4f7ac2bb2..d4a8bef26 100644 --- a/libc/bionic/pthread_create.cpp +++ b/libc/bionic/pthread_create.cpp @@ -300,6 +300,7 @@ static int __allocate_thread(pthread_attr_t* attr, bionic_tcb** tcbp, void** chi thread->mmap_size = mapping.mmap_size; thread->mmap_base_unguarded = mapping.mmap_base_unguarded; thread->mmap_size_unguarded = mapping.mmap_size_unguarded; + thread->stack_top = reinterpret_cast<uintptr_t>(stack_top); *tcbp = tcb; *child_stack = stack_top; diff --git a/libc/bionic/pthread_internal.h b/libc/bionic/pthread_internal.h index 22b0558da..ab8b9556d 100644 --- a/libc/bionic/pthread_internal.h +++ b/libc/bionic/pthread_internal.h @@ -125,6 +125,10 @@ class pthread_internal_t { // code to handle retries. void* shadow_call_stack_guard_region; + // A pointer to the top of the stack. This lets android_unsafe_frame_pointer_chase determine the + // top of the stack quickly, which would otherwise require special logic for the main thread. + uintptr_t stack_top; + Lock startup_handshake_lock; void* mmap_base; diff --git a/libc/libc.map.txt b/libc/libc.map.txt index 2ca4b212d..54da02ef0 100644 --- a/libc/libc.map.txt +++ b/libc/libc.map.txt @@ -1707,6 +1707,7 @@ LIBC_PRIVATE { android_gethostbyaddrfornetcontext; android_gethostbynamefornet; android_gethostbynamefornetcontext; + android_unsafe_frame_pointer_chase; arc4random_addrandom; # arm x86 mips arc4random_stir; # arm x86 mips atexit; # arm diff --git a/libc/platform/bionic/android_unsafe_frame_pointer_chase.h b/libc/platform/bionic/android_unsafe_frame_pointer_chase.h new file mode 100644 index 000000000..2b9a32fda --- /dev/null +++ b/libc/platform/bionic/android_unsafe_frame_pointer_chase.h @@ -0,0 +1,47 @@ +/* + * Copyright (C) 2020 The Android Open Source Project + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * * Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * * Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS + * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT + * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS + * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE + * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, + * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS + * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED + * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT + * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF + * SUCH DAMAGE. + */ + +#pragma once + +#include <stddef.h> +#include <stdint.h> + +/* + * Implement fast stack unwinding for stack frames with frame pointers. Stores at most num_entries + * return addresses to buffer buf. Returns the number of available return addresses, which may be + * greater than num_entries. + * + * This function makes no guarantees about its behavior on encountering a frame built without frame + * pointers, except that it should not crash or enter an infinite loop, and that any frames prior to + * the frame built without frame pointers should be correct. + * + * This function is only meant to be used with memory safety tools such as sanitizers which need to + * take stack traces efficiently. Normal applications should use APIs such as libunwindstack or + * _Unwind_Backtrace. + */ +extern "C" size_t android_unsafe_frame_pointer_chase(uintptr_t* buf, size_t num_entries); |