Add an android_unsafe_frame_pointer_chase function.
This function will be used by Scudo and GWP-ASan to efficiently collect
stack traces for frames built with frame pointers.
Bug: 135634846
Bug: 135772972
Change-Id: Ic63efdbafe11dfbb1226b5b4b403d53c4dbf28f3
Merged-In: Ic63efdbafe11dfbb1226b5b4b403d53c4dbf28f3
diff --git a/libc/Android.bp b/libc/Android.bp
index 0f8ed3e..5d217cb 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -1286,12 +1286,14 @@
// The following implementations depend on pthread data or implementation,
// so we can't include them in libc_ndk.a.
"bionic/__cxa_thread_atexit_impl.cpp",
+ "bionic/android_unsafe_frame_pointer_chase.cpp",
"stdlib/atexit.c",
"bionic/fork.cpp",
],
cppflags: ["-Wold-style-cast"],
include_dirs: ["bionic/libstdc++/include"],
+ header_libs: ["bionic_libc_platform_headers"],
name: "libc_pthread",
}
diff --git a/libc/bionic/__libc_init_main_thread.cpp b/libc/bionic/__libc_init_main_thread.cpp
index 94cf1f8..56a8488 100644
--- a/libc/bionic/__libc_init_main_thread.cpp
+++ b/libc/bionic/__libc_init_main_thread.cpp
@@ -81,6 +81,7 @@
__set_tls(&temp_tcb->tls_slot(0));
main_thread.tid = __getpid();
main_thread.set_cached_pid(main_thread.tid);
+ main_thread.stack_top = reinterpret_cast<uintptr_t>(args.argv);
}
// This code is used both by each new pthread and the code that initializes the main thread.
diff --git a/libc/bionic/android_unsafe_frame_pointer_chase.cpp b/libc/bionic/android_unsafe_frame_pointer_chase.cpp
new file mode 100644
index 0000000..0fb086e
--- /dev/null
+++ b/libc/bionic/android_unsafe_frame_pointer_chase.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include "platform/bionic/android_unsafe_frame_pointer_chase.h"
+
+#include "pthread_internal.h"
+#include "platform/bionic/mte.h"
+
+/*
+ * Implement fast stack unwinding for stack frames with frame pointers. Stores at most num_entries
+ * return addresses to buffer buf. Returns the number of available return addresses, which may be
+ * greater than num_entries.
+ *
+ * This function makes no guarantees about its behavior on encountering a frame built without frame
+ * pointers, except that it should not crash or enter an infinite loop, and that any frames prior to
+ * the frame built without frame pointers should be correct.
+ *
+ * This function is only meant to be used with memory safety tools such as sanitizers which need to
+ * take stack traces efficiently. Normal applications should use APIs such as libunwindstack or
+ * _Unwind_Backtrace.
+ */
+__attribute__((no_sanitize("address", "hwaddress"))) size_t android_unsafe_frame_pointer_chase(
+ uintptr_t* buf, size_t num_entries) {
+ // Disable MTE checks for the duration of this function, since we can't be sure that following
+ // next_frame pointers won't cause us to read from tagged memory. ASAN/HWASAN are disabled here
+ // for the same reason.
+ ScopedDisableMTE x;
+
+ struct frame_record {
+ uintptr_t next_frame, return_addr;
+ };
+
+ auto begin = reinterpret_cast<uintptr_t>(__builtin_frame_address(0));
+ uintptr_t end = __get_thread()->stack_top;
+ size_t num_frames = 0;
+ while (1) {
+ auto* frame = reinterpret_cast<frame_record*>(begin);
+ if (num_frames < num_entries) {
+ buf[num_frames] = frame->return_addr;
+ }
+ ++num_frames;
+ if (frame->next_frame < begin + sizeof(frame_record) || frame->next_frame >= end ||
+ frame->next_frame % sizeof(void*) != 0) {
+ break;
+ }
+ begin = frame->next_frame;
+ }
+
+ return num_frames;
+}
diff --git a/libc/bionic/pthread_create.cpp b/libc/bionic/pthread_create.cpp
index 4f7ac2b..d4a8bef 100644
--- a/libc/bionic/pthread_create.cpp
+++ b/libc/bionic/pthread_create.cpp
@@ -300,6 +300,7 @@
thread->mmap_size = mapping.mmap_size;
thread->mmap_base_unguarded = mapping.mmap_base_unguarded;
thread->mmap_size_unguarded = mapping.mmap_size_unguarded;
+ thread->stack_top = reinterpret_cast<uintptr_t>(stack_top);
*tcbp = tcb;
*child_stack = stack_top;
diff --git a/libc/bionic/pthread_internal.h b/libc/bionic/pthread_internal.h
index 22b0558..ab8b955 100644
--- a/libc/bionic/pthread_internal.h
+++ b/libc/bionic/pthread_internal.h
@@ -125,6 +125,10 @@
// code to handle retries.
void* shadow_call_stack_guard_region;
+ // A pointer to the top of the stack. This lets android_unsafe_frame_pointer_chase determine the
+ // top of the stack quickly, which would otherwise require special logic for the main thread.
+ uintptr_t stack_top;
+
Lock startup_handshake_lock;
void* mmap_base;
diff --git a/libc/libc.map.txt b/libc/libc.map.txt
index 2ca4b21..54da02e 100644
--- a/libc/libc.map.txt
+++ b/libc/libc.map.txt
@@ -1707,6 +1707,7 @@
android_gethostbyaddrfornetcontext;
android_gethostbynamefornet;
android_gethostbynamefornetcontext;
+ android_unsafe_frame_pointer_chase;
arc4random_addrandom; # arm x86 mips
arc4random_stir; # arm x86 mips
atexit; # arm
diff --git a/libc/platform/bionic/android_unsafe_frame_pointer_chase.h b/libc/platform/bionic/android_unsafe_frame_pointer_chase.h
new file mode 100644
index 0000000..2b9a32f
--- /dev/null
+++ b/libc/platform/bionic/android_unsafe_frame_pointer_chase.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+ * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+ * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+ * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+ * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+ * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#pragma once
+
+#include <stddef.h>
+#include <stdint.h>
+
+/*
+ * Implement fast stack unwinding for stack frames with frame pointers. Stores at most num_entries
+ * return addresses to buffer buf. Returns the number of available return addresses, which may be
+ * greater than num_entries.
+ *
+ * This function makes no guarantees about its behavior on encountering a frame built without frame
+ * pointers, except that it should not crash or enter an infinite loop, and that any frames prior to
+ * the frame built without frame pointers should be correct.
+ *
+ * This function is only meant to be used with memory safety tools such as sanitizers which need to
+ * take stack traces efficiently. Normal applications should use APIs such as libunwindstack or
+ * _Unwind_Backtrace.
+ */
+extern "C" size_t android_unsafe_frame_pointer_chase(uintptr_t* buf, size_t num_entries);
diff --git a/tests/Android.bp b/tests/Android.bp
index e530132..cb275a2 100644
--- a/tests/Android.bp
+++ b/tests/Android.bp
@@ -295,6 +295,20 @@
},
}
+cc_test_library {
+ name: "libBionicFramePointerTests",
+ defaults: ["bionic_tests_defaults"],
+ srcs: [
+ "android_unsafe_frame_pointer_chase_test.cpp",
+ ],
+ include_dirs: [
+ "bionic/libc",
+ ],
+ cflags: [
+ "-fno-omit-frame-pointer",
+ ],
+}
+
// -----------------------------------------------------------------------------
// Fortify tests.
// -----------------------------------------------------------------------------
@@ -444,6 +458,7 @@
whole_static_libs: [
"libBionicStandardTests",
"libBionicElfTlsTests",
+ "libBionicFramePointerTests",
"libfortify1-tests-clang",
"libfortify1-new-tests-clang",
"libfortify2-tests-clang",
diff --git a/tests/android_unsafe_frame_pointer_chase_test.cpp b/tests/android_unsafe_frame_pointer_chase_test.cpp
new file mode 100644
index 0000000..dd04c33
--- /dev/null
+++ b/tests/android_unsafe_frame_pointer_chase_test.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2020 The Android Open Source Project
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+#include <gtest/gtest.h>
+
+#if defined(__BIONIC__)
+
+#include "platform/bionic/android_unsafe_frame_pointer_chase.h"
+
+// Prevent tail calls inside recurse.
+__attribute__((weak, noinline)) size_t nop(size_t val) {
+ return val;
+}
+
+// Call android_unsafe_frame_pointer_chase inside count recurse stack frames.
+__attribute__((weak, noinline)) int recurse(int count, uintptr_t* buf, size_t num_entries) {
+ if (count != 0) return nop(recurse(count - 1, buf, num_entries));
+ return nop(android_unsafe_frame_pointer_chase(buf, num_entries));
+}
+
+static constexpr size_t kNumFrames = 32;
+
+static bool CheckFrames(uintptr_t* frames, size_t num_frames) {
+ // We expect one recurse frame calling android_unsafe_frame_pointer_chase, followed by kNumFrames identical
+ // recurse frames calling themselves, followed by at least one frame (the first caller of
+ // recurse).
+ if (num_frames < kNumFrames + 2) {
+ printf("num_frames (0x%zu) < kNumFrames + 2", num_frames);
+ return false;
+ }
+
+ if (frames[0] == frames[1]) {
+ printf("frames[0] == frames[1] (0x%zx)", frames[0]);
+ return false;
+ }
+
+ for (size_t i = 2; i <= kNumFrames; ++i) {
+ if (frames[i] != frames[1]) {
+ printf("frames[i] (0x%zx) != frames[1] (0x%zx)", frames[i], frames[1]);
+ return false;
+ }
+ }
+
+ if (frames[kNumFrames] == frames[kNumFrames + 1]) {
+ printf("frames[kNumFrames] == frames[kNumFrames + 1] (0x%zx)", frames[kNumFrames]);
+ return false;
+ }
+
+ return true;
+}
+
+TEST(android_unsafe_frame_pointer_chase, main_thread) {
+ size_t size = recurse(kNumFrames, 0, 0);
+
+ uintptr_t frames[kNumFrames + 2];
+ size_t size2 = recurse(kNumFrames, frames, kNumFrames + 2);
+ EXPECT_EQ(size2, size);
+
+ EXPECT_TRUE(CheckFrames(frames, size));
+}
+
+static void *BacktraceThread(void *) {
+ size_t size = recurse(kNumFrames, 0, 0);
+
+ uintptr_t frames[kNumFrames + 2];
+ size_t size2 = recurse(kNumFrames, frames, kNumFrames + 2);
+ if (size2 != size) {
+ return (void*)"size2 != size";
+ }
+
+ if (!CheckFrames(frames, size)) {
+ return (void*)"CheckFrames failed";
+ }
+ return nullptr;
+}
+
+TEST(android_unsafe_frame_pointer_chase, pthread) {
+ pthread_t t;
+ ASSERT_EQ(0, pthread_create(&t, nullptr, BacktraceThread, nullptr));
+ void* retval;
+ ASSERT_EQ(0, pthread_join(t, &retval));
+ EXPECT_EQ(nullptr, reinterpret_cast<char*>(retval));
+}
+
+#endif // __BIONIC__