blob: 6902140992287c4abc08ff2b7d8e1464ed131608 [file] [log] [blame]
/* SPDX-License-Identifier: GPL-2.0+ */
/*
* Copyright (C) 2024 Free Software Foundation, Inc.
* Written by Eugene Uriev, based on glibc 2.0 prototype of Mike Haertel.
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public License as
* published by the Free Software Foundation; either version 2 of the
* License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Library General Public License for more details.
* <https://www.gnu.org/licenses/>
*/
/*
* TL;DR: this is a porting of glibc mcheck into U-Boot
*
* This file contains no entities for external linkage.
* So mcheck protection may be used in parallel, e.g. for "malloc_simple(..)" and "malloc(..)".
* To do so, the file should be shared/include twice, - without linkage conflicts.
* I.e. "core"-part is shared as a source, but not as a binary.
* Maybe some optimization here make sense, to engage more binary sharing too.
* But, currently I strive to keep it as simple, as possible.
* And this, programmers'-only, mode don't pretend to be main.
*
* This library is aware of U-Boot specific. It's also aware of ARM alignment concerns.
* Unlike glibc-clients, U-Boot has limited malloc-usage, and only one thread.
* So it's better to make the protection heavier.
* Thus overflow canary here is greater, than glibc's one. Underflow canary is bigger too.
* U-Boot also allows to use fixed-size heap-registry, instead of double-linked list in glibc.
*
* Heavy canary allows to catch not only memset(..)-errors,
* but overflow/underflow of struct-array access:
* {
* struct mystruct* p = malloc(sizeof(struct mystruct) * N);
* p[-1].field1 = 0;
* p[N].field2 = 13;
* }
* TODO: In order to guarantee full coverage of that kind of errors, a user can add variable-size
* canaries here. So pre- and post-canary with size >= reqested_size, could be provided
* (with the price of 3x heap-usage). Therefore, it would catch 100% of changes beyond
* an array, for index(+1/-1) errors.
*
* U-Boot is a BL, not an OS with a lib. Activity of the library is set not in runtime,
* rather in compile-time, by MCHECK_HEAP_PROTECTION macro. That guarantees that
* we haven't missed first malloc.
*/
/*
* Testing
* This library had been successfully tested for U-Boot @ ARM SoC chip / 64bits.
* Proven for both default and pedantic mode: confirms U-Boot to be clean, and catches
* intentional/testing corruptions. Working with malloc_trim is not tested.
*/
#ifndef _MCHECKCORE_INC_H
#define _MCHECKCORE_INC_H 1
#include "mcheck.h"
#if defined(MCHECK_HEAP_PROTECTION)
#define mcheck_flood memset
// these are from /dev/random:
#define MAGICWORD 0x99ccf430fa562a05ULL
#define MAGICFREE 0x4875e63c0c6fc08eULL
#define MAGICTAIL 0x918dbcd7df78dcd6ULL
#define MALLOCFLOOD ((char)0xb6)
#define FREEFLOOD ((char)0xf5)
#define PADDINGFLOOD ((char)0x58)
// my normal run demands 4427-6449 chunks:
#define REGISTRY_SZ 6608
#define CANARY_DEPTH 2
// avoid problems with BSS at early stage:
static char mcheck_pedantic_flag __section(".data") = 0;
static void *mcheck_registry[REGISTRY_SZ] __section(".data") = {0};
static size_t mcheck_chunk_count __section(".data") = 0;
static size_t mcheck_chunk_count_max __section(".data") = 0;
typedef unsigned long long mcheck_elem;
typedef struct {
mcheck_elem elems[CANARY_DEPTH];
} mcheck_canary;
struct mcheck_hdr {
size_t size; /* Exact size requested by user. */
size_t aln_skip; /* Ignored bytes, before the mcheck_hdr, to fulfill alignment */
mcheck_canary canary; /* Magic number to check header integrity. */
};
static void mcheck_default_abort(enum mcheck_status status, const void *p)
{
const char *msg;
switch (status) {
case MCHECK_OK:
msg = "memory is consistent, library is buggy\n";
break;
case MCHECK_HEAD:
msg = "memory clobbered before allocated block\n";
break;
case MCHECK_TAIL:
msg = "memory clobbered past end of allocated block\n";
break;
case MCHECK_FREE:
msg = "block freed twice\n";
break;
default:
msg = "bogus mcheck_status, library is buggy\n";
break;
}
printf("\n\nmcheck: %p:%s!!! [%zu]\n\n", p, msg, mcheck_chunk_count_max);
}
static mcheck_abortfunc_t mcheck_abortfunc = &mcheck_default_abort;
static inline size_t allign_size_up(size_t sz, size_t grain)
{
return (sz + grain - 1) & ~(grain - 1);
}
#define mcheck_allign_customer_size(SZ) allign_size_up(SZ, sizeof(mcheck_elem))
#define mcheck_evaluate_memalign_prefix_size(ALIGN) allign_size_up(sizeof(struct mcheck_hdr), ALIGN)
static enum mcheck_status mcheck_OnNok(enum mcheck_status status, const void *p)
{
(*mcheck_abortfunc)(status, p);
return status;
}
static enum mcheck_status mcheck_checkhdr(const struct mcheck_hdr *hdr)
{
int i;
for (i = 0; i < CANARY_DEPTH; ++i)
if (hdr->canary.elems[i] == MAGICFREE)
return mcheck_OnNok(MCHECK_FREE, hdr + 1);
for (i = 0; i < CANARY_DEPTH; ++i)
if (hdr->canary.elems[i] != MAGICWORD)
return mcheck_OnNok(MCHECK_HEAD, hdr + 1);
const size_t payload_size = hdr->size;
const size_t payload_size_aligned = mcheck_allign_customer_size(payload_size);
const size_t padd_size = payload_size_aligned - hdr->size;
const char *payload = (const char *)&hdr[1];
for (i = 0; i < padd_size; ++i)
if (payload[payload_size + i] != PADDINGFLOOD)
return mcheck_OnNok(MCHECK_TAIL, hdr + 1);
const mcheck_canary *tail = (const mcheck_canary *)&payload[payload_size_aligned];
for (i = 0; i < CANARY_DEPTH; ++i)
if (tail->elems[i] != MAGICTAIL)
return mcheck_OnNok(MCHECK_TAIL, hdr + 1);
return MCHECK_OK;
}
enum { KEEP_CONTENT = 0, CLEAN_CONTENT, ANY_ALIGNMENT = 1 };
static void *mcheck_free_helper(void *ptr, int clean_content)
{
if (!ptr)
return ptr;
struct mcheck_hdr *hdr = &((struct mcheck_hdr *)ptr)[-1];
int i;
mcheck_checkhdr(hdr);
for (i = 0; i < CANARY_DEPTH; ++i)
hdr->canary.elems[i] = MAGICFREE;
if (clean_content)
mcheck_flood(ptr, FREEFLOOD, mcheck_allign_customer_size(hdr->size));
for (i = 0; i < REGISTRY_SZ; ++i)
if (mcheck_registry[i] == hdr) {
mcheck_registry[i] = 0;
break;
}
--mcheck_chunk_count;
return (char *)hdr - hdr->aln_skip;
}
static void *mcheck_free_prehook(void *ptr) { return mcheck_free_helper(ptr, CLEAN_CONTENT); }
static void *mcheck_reallocfree_prehook(void *ptr) { return mcheck_free_helper(ptr, KEEP_CONTENT); }
static size_t mcheck_alloc_prehook(size_t sz)
{
sz = mcheck_allign_customer_size(sz);
return sizeof(struct mcheck_hdr) + sz + sizeof(mcheck_canary);
}
static void *mcheck_allocated_helper(void *altoghether_ptr, size_t customer_sz,
size_t alignment, int clean_content)
{
const size_t slop = alignment ?
mcheck_evaluate_memalign_prefix_size(alignment) - sizeof(struct mcheck_hdr) : 0;
struct mcheck_hdr *hdr = (struct mcheck_hdr *)((char *)altoghether_ptr + slop);
int i;
hdr->size = customer_sz;
hdr->aln_skip = slop;
for (i = 0; i < CANARY_DEPTH; ++i)
hdr->canary.elems[i] = MAGICWORD;
char *payload = (char *)&hdr[1];
if (clean_content)
mcheck_flood(payload, MALLOCFLOOD, customer_sz);
const size_t customer_size_aligned = mcheck_allign_customer_size(customer_sz);
mcheck_flood(payload + customer_sz, PADDINGFLOOD, customer_size_aligned - customer_sz);
mcheck_canary *tail = (mcheck_canary *)&payload[customer_size_aligned];
for (i = 0; i < CANARY_DEPTH; ++i)
tail->elems[i] = MAGICTAIL;
++mcheck_chunk_count;
if (mcheck_chunk_count > mcheck_chunk_count_max)
mcheck_chunk_count_max = mcheck_chunk_count;
for (i = 0; i < REGISTRY_SZ; ++i)
if (!mcheck_registry[i]) {
mcheck_registry[i] = hdr;
return payload; // normal end
}
static char *overflow_msg = "\n\n\nERROR: mcheck registry overflow, pedantic check would be incomplete!!\n\n\n\n";
printf("%s", overflow_msg);
overflow_msg = "(mcheck registry full)";
return payload;
}
static void *mcheck_alloc_posthook(void *altoghether_ptr, size_t customer_sz)
{
return mcheck_allocated_helper(altoghether_ptr, customer_sz, ANY_ALIGNMENT, CLEAN_CONTENT);
}
static void *mcheck_alloc_noclean_posthook(void *altoghether_ptr, size_t customer_sz)
{
return mcheck_allocated_helper(altoghether_ptr, customer_sz, ANY_ALIGNMENT, KEEP_CONTENT);
}
static size_t mcheck_memalign_prehook(size_t alig, size_t sz)
{
return mcheck_evaluate_memalign_prefix_size(alig) + sz + sizeof(mcheck_canary);
}
static void *mcheck_memalign_posthook(size_t alignment, void *altoghether_ptr, size_t customer_sz)
{
return mcheck_allocated_helper(altoghether_ptr, customer_sz, alignment, CLEAN_CONTENT);
}
static enum mcheck_status mcheck_mprobe(void *ptr)
{
struct mcheck_hdr *hdr = &((struct mcheck_hdr *)ptr)[-1];
return mcheck_checkhdr(hdr);
}
static void mcheck_pedantic_check(void)
{
int i;
for (i = 0; i < REGISTRY_SZ; ++i)
if (mcheck_registry[i])
mcheck_checkhdr(mcheck_registry[i]);
}
static void mcheck_pedantic_prehook(void)
{
if (mcheck_pedantic_flag)
mcheck_pedantic_check();
}
static void mcheck_initialize(mcheck_abortfunc_t new_func, char pedantic_flag)
{
mcheck_abortfunc = (new_func) ? new_func : &mcheck_default_abort;
mcheck_pedantic_flag = pedantic_flag;
}
void mcheck_on_ramrelocation(size_t offset)
{
char *p;
int i;
// Simple, but inaccurate strategy: drop the pre-reloc heap
for (i = 0; i < REGISTRY_SZ; ++i)
if ((p = mcheck_registry[i]) != NULL ) {
printf("mcheck, WRN: forgetting %p chunk\n", p);
mcheck_registry[i] = 0;
}
mcheck_chunk_count = 0;
}
#endif
#endif