[MTE] Add MEMTAG_OPTIONS and arm64.memtag.process.* sysprop parsing.
These two options allow for ARM MTE to be enabled dynamically (instead
of at compile time via the ELF note). They are settable from a non-root
shell to allow device owners to test system binaries with MTE.
The following values may be set:
1. 'off' -> No MTE, uses TBI on compatible devices.
2. 'sync' -> SYNC MTE.
3. 'async' -> ASYNC MTE.
The following methods can be used to launch a process (sanitizer-status)
with configurable values:
1. adb shell MEMTAG_OPTIONS=async sanitizer-status
2. adb shell setprop arm64.memtag.process.sanitizer-status async && \
adb shell sanitizer-status
Note: The system server will require some special handing in the zygote
pre-fork to check the sysprops. The zygote should always have the ELF
note. TODO in a subsequent patch.
Bug: 135772972
Bug: 172365548
Test: Launching sanitizer-status above using both the settings.
Change-Id: Ic1dbf3985a3f23521ec86725ec482c8f6739c182
diff --git a/libc/bionic/heap_tagging.cpp b/libc/bionic/heap_tagging.cpp
index 49b02da..4b3d43c 100644
--- a/libc/bionic/heap_tagging.cpp
+++ b/libc/bionic/heap_tagging.cpp
@@ -52,6 +52,9 @@
globals->heap_pointer_tag = (reinterpret_cast<uintptr_t>(POINTER_TAG) << TAG_SHIFT) |
(0xffull << CHECK_SHIFT) | (0xffull << UNTAG_SHIFT);
});
+#if defined(USE_SCUDO)
+ scudo_malloc_disable_memory_tagging();
+#endif // USE_SCUDO
break;
#if defined(USE_SCUDO)
case M_HEAP_TAGGING_LEVEL_SYNC:
diff --git a/libc/bionic/libc_init_static.cpp b/libc/bionic/libc_init_static.cpp
index 3705606..2e4ee11 100644
--- a/libc/bionic/libc_init_static.cpp
+++ b/libc/bionic/libc_init_static.cpp
@@ -39,15 +39,17 @@
#include "libc_init_common.h"
#include "pthread_internal.h"
+#include "platform/bionic/macros.h"
+#include "platform/bionic/mte.h"
#include "platform/bionic/page.h"
+#include "private/KernelArgumentBlock.h"
+#include "private/bionic_asm.h"
+#include "private/bionic_asm_note.h"
#include "private/bionic_call_ifunc_resolver.h"
#include "private/bionic_elf_tls.h"
#include "private/bionic_globals.h"
-#include "platform/bionic/macros.h"
-#include "private/bionic_asm.h"
-#include "private/bionic_asm_note.h"
#include "private/bionic_tls.h"
-#include "private/KernelArgumentBlock.h"
+#include "sys/system_properties.h"
#if __has_feature(hwaddress_sanitizer)
#include <sanitizer/hwasan_interface.h>
@@ -61,6 +63,7 @@
#endif
extern "C" int __cxa_atexit(void (*)(void *), void *, void *);
+extern "C" const char* __gnu_basename(const char* path);
static void call_array(init_func_t** list, int argc, char* argv[], char* envp[]) {
// First element is -1, list is null-terminated
@@ -160,6 +163,30 @@
layout.finish_layout();
}
+// Get the presiding config string, in the following order of priority:
+// 1. Environment variables.
+// 2. System properties, in the order they're specified in sys_prop_names.
+// If neither of these options are specified, this function returns false.
+// Otherwise, it returns true, and the presiding options string is written to
+// the `options` buffer of size `size`. If this function returns true, `options`
+// is guaranteed to be null-terminated. `options_size` should be at least
+// PROP_VALUE_MAX.
+bool get_config_from_env_or_sysprops(const char* env_var_name, const char* const* sys_prop_names,
+ size_t sys_prop_names_size, char* options,
+ size_t options_size) {
+ const char* env = getenv(env_var_name);
+ if (env && *env != '\0') {
+ strncpy(options, env, options_size);
+ options[options_size - 1] = '\0'; // Ensure null-termination.
+ return true;
+ }
+
+ for (size_t i = 0; i < sys_prop_names_size; ++i) {
+ if (__system_property_get(sys_prop_names[i], options) && *options != '\0') return true;
+ }
+ return false;
+}
+
#ifdef __aarch64__
static bool __read_memtag_note(const ElfW(Nhdr)* note, const char* name, const char* desc,
unsigned* result) {
@@ -204,42 +231,94 @@
return 0;
}
+// Returns true if there's an environment setting (either sysprop or env var)
+// that should overwrite the ELF note, and places the equivalent heap tagging
+// level into *level.
+static bool get_environment_memtag_setting(HeapTaggingLevel* level) {
+ static const char kMemtagPrognameSyspropPrefix[] = "arm64.memtag.process.";
+
+ const char* progname = __libc_shared_globals()->init_progname;
+ if (progname == nullptr) return false;
+
+ const char* basename = __gnu_basename(progname);
+
+ static constexpr size_t kOptionsSize = PROP_VALUE_MAX;
+ char options_str[kOptionsSize];
+ size_t sysprop_size = strlen(basename) + strlen(kMemtagPrognameSyspropPrefix) + 1;
+ char* sysprop_name = static_cast<char*>(alloca(sysprop_size));
+
+ async_safe_format_buffer(sysprop_name, sysprop_size, "%s%s", kMemtagPrognameSyspropPrefix,
+ basename);
+
+ if (!get_config_from_env_or_sysprops("MEMTAG_OPTIONS", &sysprop_name,
+ /* sys_prop_names_size */ 1, options_str, kOptionsSize)) {
+ return false;
+ }
+
+ if (strcmp("sync", options_str) == 0) {
+ *level = M_HEAP_TAGGING_LEVEL_SYNC;
+ } else if (strcmp("async", options_str) == 0) {
+ *level = M_HEAP_TAGGING_LEVEL_ASYNC;
+ } else if (strcmp("off", options_str) == 0) {
+ *level = M_HEAP_TAGGING_LEVEL_TBI;
+ } else {
+ async_safe_format_log(
+ ANDROID_LOG_ERROR, "libc",
+ "unrecognized memtag level: \"%s\" (options are \"sync\", \"async\", or \"off\").",
+ options_str);
+ return false;
+ }
+
+ return true;
+}
+
+// Returns the initial heap tagging level. Note: This function will never return
+// M_HEAP_TAGGING_LEVEL_NONE, if MTE isn't enabled for this process we enable
+// M_HEAP_TAGGING_LEVEL_TBI.
+static HeapTaggingLevel __get_heap_tagging_level(const void* phdr_start, size_t phdr_ct,
+ uintptr_t load_bias) {
+ HeapTaggingLevel level;
+ if (get_environment_memtag_setting(&level)) return level;
+
+ unsigned note_val =
+ __get_memtag_note(reinterpret_cast<const ElfW(Phdr)*>(phdr_start), phdr_ct, load_bias);
+ if (note_val & ~(NT_MEMTAG_LEVEL_MASK | NT_MEMTAG_HEAP)) {
+ async_safe_fatal("unrecognized android.memtag note: desc = %d", note_val);
+ }
+
+ if (!(note_val & NT_MEMTAG_HEAP)) return M_HEAP_TAGGING_LEVEL_TBI;
+
+ unsigned memtag_level = note_val & NT_MEMTAG_LEVEL_MASK;
+ switch (memtag_level) {
+ case NT_MEMTAG_LEVEL_ASYNC:
+ return M_HEAP_TAGGING_LEVEL_ASYNC;
+ case NT_MEMTAG_LEVEL_DEFAULT:
+ case NT_MEMTAG_LEVEL_SYNC:
+ return M_HEAP_TAGGING_LEVEL_SYNC;
+ default:
+ async_safe_fatal("unrecognized android.memtag note: level = %d", memtag_level);
+ }
+}
+
// Figure out the desired memory tagging mode (sync/async, heap/globals/stack) for this executable.
// This function is called from the linker before the main executable is relocated.
__attribute__((no_sanitize("hwaddress", "memtag"))) void __libc_init_mte(const void* phdr_start,
size_t phdr_ct,
uintptr_t load_bias) {
- unsigned v =
- __get_memtag_note(reinterpret_cast<const ElfW(Phdr)*>(phdr_start), phdr_ct, load_bias);
+ HeapTaggingLevel level = __get_heap_tagging_level(phdr_start, phdr_ct, load_bias);
- if (v & ~(NT_MEMTAG_LEVEL_MASK | NT_MEMTAG_HEAP)) {
- async_safe_fatal("unrecognized android.memtag note: desc = %d", v);
- }
+ if (level == M_HEAP_TAGGING_LEVEL_SYNC || level == M_HEAP_TAGGING_LEVEL_ASYNC) {
+ unsigned long prctl_arg = PR_TAGGED_ADDR_ENABLE | PR_MTE_TAG_SET_NONZERO;
+ prctl_arg |= (level == M_HEAP_TAGGING_LEVEL_SYNC) ? PR_MTE_TCF_SYNC : PR_MTE_TCF_ASYNC;
- if (v & NT_MEMTAG_HEAP) {
- unsigned memtag_level = v & NT_MEMTAG_LEVEL_MASK;
- unsigned long arg = PR_TAGGED_ADDR_ENABLE | (0xfffe << PR_MTE_TAG_SHIFT);
- HeapTaggingLevel level;
- switch (memtag_level) {
- case NT_MEMTAG_LEVEL_ASYNC:
- arg |= PR_MTE_TCF_ASYNC;
- level = M_HEAP_TAGGING_LEVEL_ASYNC;
- break;
- case NT_MEMTAG_LEVEL_DEFAULT:
- case NT_MEMTAG_LEVEL_SYNC:
- arg |= PR_MTE_TCF_SYNC;
- level = M_HEAP_TAGGING_LEVEL_SYNC;
- break;
- default:
- async_safe_fatal("unrecognized android.memtag note: level = %d", memtag_level);
- }
-
- if (prctl(PR_SET_TAGGED_ADDR_CTRL, arg, 0, 0, 0) == 0) {
+ if (prctl(PR_SET_TAGGED_ADDR_CTRL, prctl_arg, 0, 0, 0) == 0) {
__libc_shared_globals()->initial_heap_tagging_level = level;
return;
}
}
+ // MTE was either not enabled, or wasn't supported on this device. Try and use
+ // TBI.
if (prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0) == 0) {
__libc_shared_globals()->initial_heap_tagging_level = M_HEAP_TAGGING_LEVEL_TBI;
}
diff --git a/libc/platform/bionic/mte.h b/libc/platform/bionic/mte.h
index b11b1a6..73cd821 100644
--- a/libc/platform/bionic/mte.h
+++ b/libc/platform/bionic/mte.h
@@ -29,6 +29,13 @@
#pragma once
#include <sys/auxv.h>
+#include <sys/prctl.h>
+
+// Note: Most PR_MTE_* constants come from the upstream kernel. This tag mask
+// allows for the hardware to provision any nonzero tag. Zero tags are reserved
+// for scudo to use for the chunk headers in order to prevent linear heap
+// overflow/underflow.
+#define PR_MTE_TAG_SET_NONZERO (0xfffeUL << PR_MTE_TAG_SHIFT)
inline bool mte_supported() {
#if defined(__aarch64__)