1 /*
2 * Copyright (C) 2019 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * * Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in
12 * the documentation and/or other materials provided with the
13 * distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include "heap_tagging.h"
30 #include "malloc_common.h"
31 #include "malloc_tagged_pointers.h"
32
33 #include <platform/bionic/malloc.h>
34 #include <platform/bionic/mte_kernel.h>
35
36 extern "C" void scudo_malloc_disable_memory_tagging();
37 extern "C" void scudo_malloc_set_track_allocation_stacks(int);
38
39 static HeapTaggingLevel heap_tagging_level = M_HEAP_TAGGING_LEVEL_NONE;
40
SetDefaultHeapTaggingLevel()41 void SetDefaultHeapTaggingLevel() {
42 #if defined(__aarch64__)
43 #ifdef ANDROID_EXPERIMENTAL_MTE
44 // First, try enabling MTE in asynchronous mode, with tag 0 excluded. This will fail if the kernel
45 // or hardware doesn't support MTE, and we will fall back to just enabling tagged pointers in
46 // syscall arguments.
47 if (prctl(PR_SET_TAGGED_ADDR_CTRL,
48 PR_TAGGED_ADDR_ENABLE | PR_MTE_TCF_ASYNC | (0xfffe << PR_MTE_TAG_SHIFT), 0, 0,
49 0) == 0) {
50 heap_tagging_level = M_HEAP_TAGGING_LEVEL_ASYNC;
51 return;
52 }
53 #endif // ANDROID_EXPERIMENTAL_MTE
54
55 // Allow the kernel to accept tagged pointers in syscall arguments. This is a no-op (kernel
56 // returns -EINVAL) if the kernel doesn't understand the prctl.
57 if (prctl(PR_SET_TAGGED_ADDR_CTRL, PR_TAGGED_ADDR_ENABLE, 0, 0, 0) == 0) {
58 #if !__has_feature(hwaddress_sanitizer)
59 heap_tagging_level = M_HEAP_TAGGING_LEVEL_TBI;
60 __libc_globals.mutate([](libc_globals* globals) {
61 // Arrange for us to set pointer tags to POINTER_TAG, check tags on
62 // deallocation and untag when passing pointers to the allocator.
63 globals->heap_pointer_tag = (reinterpret_cast<uintptr_t>(POINTER_TAG) << TAG_SHIFT) |
64 (0xffull << CHECK_SHIFT) | (0xffull << UNTAG_SHIFT);
65 });
66 #endif // hwaddress_sanitizer
67 }
68 #endif // aarch64
69 }
70
SetHeapTaggingLevel(void * arg,size_t arg_size)71 bool SetHeapTaggingLevel(void* arg, size_t arg_size) {
72 if (arg_size != sizeof(HeapTaggingLevel)) {
73 return false;
74 }
75
76 auto tag_level = *reinterpret_cast<HeapTaggingLevel*>(arg);
77 if (tag_level == heap_tagging_level) {
78 return true;
79 }
80
81 switch (tag_level) {
82 case M_HEAP_TAGGING_LEVEL_NONE:
83 #if defined(USE_SCUDO)
84 scudo_malloc_disable_memory_tagging();
85 #endif
86 if (heap_tagging_level == M_HEAP_TAGGING_LEVEL_TBI) {
87 __libc_globals.mutate([](libc_globals* globals) {
88 // Preserve the untag mask (we still want to untag pointers when passing them to the
89 // allocator), but clear the fixed tag and the check mask, so that pointers are no longer
90 // tagged and checks no longer happen.
91 globals->heap_pointer_tag = static_cast<uintptr_t>(0xffull << UNTAG_SHIFT);
92 });
93 }
94 break;
95 case M_HEAP_TAGGING_LEVEL_TBI:
96 case M_HEAP_TAGGING_LEVEL_ASYNC:
97 case M_HEAP_TAGGING_LEVEL_SYNC:
98 if (heap_tagging_level == M_HEAP_TAGGING_LEVEL_NONE) {
99 error_log(
100 "SetHeapTaggingLevel: re-enabling tagging after it was disabled is not supported");
101 return false;
102 } else if (tag_level == M_HEAP_TAGGING_LEVEL_TBI ||
103 heap_tagging_level == M_HEAP_TAGGING_LEVEL_TBI) {
104 error_log("SetHeapTaggingLevel: switching between TBI and ASYNC/SYNC is not supported");
105 return false;
106 }
107
108 if (tag_level == M_HEAP_TAGGING_LEVEL_ASYNC) {
109 #if defined(USE_SCUDO)
110 scudo_malloc_set_track_allocation_stacks(0);
111 #endif
112 } else if (tag_level == M_HEAP_TAGGING_LEVEL_SYNC) {
113 #if defined(USE_SCUDO)
114 scudo_malloc_set_track_allocation_stacks(1);
115 #endif
116 }
117 break;
118 default:
119 error_log("SetHeapTaggingLevel: unknown tagging level");
120 return false;
121 }
122
123 heap_tagging_level = tag_level;
124 info_log("SetHeapTaggingLevel: tag level set to %d", tag_level);
125
126 return true;
127 }
128