u-boot/common/mcheck_core.inc.h

/* SPDX-License-Identifier: GPL-2.0+ */
/*
 * Copyright (C) 2024 Free Software Foundation, Inc.
 * Written by Eugene Uriev, based on glibc 2.0 prototype of Mike Haertel.
 *
 * This library is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Library General Public License as
 * published by the Free Software Foundation; either version 2 of the
 * License, or (at your option) any later version.
 *
 * This library is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Library General Public License for more details.
 * <https://www.gnu.org/licenses/>
 */

/*
 * TL;DR: this is a porting of glibc mcheck into U-Boot
 *
 * This file contains no entities for external linkage.
 * So mcheck protection may be used in parallel, e.g. for "malloc_simple(..)" and "malloc(..)".
 * To do so, the file should be shared/include twice, - without linkage conflicts.
 * I.e. "core"-part is shared as a source, but not as a binary.
 * Maybe some optimization here make sense, to engage more binary sharing too.
 * But, currently I strive to keep it as simple, as possible.
 * And this, programmers'-only, mode don't pretend to be main.
 *
 * This library is aware of U-Boot specific. It's also aware of ARM alignment concerns.
 * Unlike glibc-clients, U-Boot has limited malloc-usage, and only one thread.
 * So it's better to make the protection heavier.
 * Thus overflow canary here is greater, than glibc's one. Underflow canary is bigger too.
 * U-Boot also allows to use fixed-size heap-registry, instead of double-linked list in glibc.
 *
 * Heavy canary allows to catch not only memset(..)-errors,
 * but overflow/underflow of struct-array access:
 *	{
 *		struct mystruct* p = malloc(sizeof(struct mystruct) * N);
 *		p[-1].field1 = 0;
 *		p[N].field2 = 13;
 *	}
 * TODO: In order to guarantee full coverage of that kind of errors, a user can add variable-size
 *       canaries here. So pre- and post-canary with size >= reqested_size, could be provided
 *       (with the price of 3x heap-usage). Therefore, it would catch 100% of changes beyond
 *       an array, for index(+1/-1) errors.
 *
 * U-Boot is a BL, not an OS with a lib. Activity of the library is set not in runtime,
 * rather in compile-time, by CONFIG_MCHECK_HEAP_PROTECTION macro. That
 * guarantees that we haven't missed first malloc.
 */

/*
 * Testing
 *  This library had been successfully tested for U-Boot @ ARM SoC chip / 64bits.
 *  Proven for both default and pedantic mode: confirms U-Boot to be clean, and catches
 *  intentional/testing corruptions. Working with malloc_trim is not tested.
 */
#ifndef _MCHECKCORE_INC_H
#define _MCHECKCORE_INC_H      1
#include "mcheck.h"

#if CONFIG_IS_ENABLED(MCHECK_HEAP_PROTECTION)
#define mcheck_flood memset

// these are from /dev/random:
#define MAGICWORD	0x99ccf430fa562a05ULL
#define MAGICFREE	0x4875e63c0c6fc08eULL
#define MAGICTAIL	0x918dbcd7df78dcd6ULL
#define MALLOCFLOOD	((char)0xb6)
#define FREEFLOOD	((char)0xf5)
#define PADDINGFLOOD	((char)0x58)

// Full test suite can exceed 10000 concurrent allocations
#define REGISTRY_SZ	12000
#define CANARY_DEPTH	2
#define MCHECK_CALLER_LEN	48

// avoid problems with BSS at early stage:
static char mcheck_pedantic_flag __section(".data") = 0;
static void *mcheck_registry[REGISTRY_SZ] __section(".data") = {0};
static size_t mcheck_chunk_count __section(".data") = 0;
static size_t mcheck_chunk_count_max __section(".data") = 0;

typedef unsigned long long mcheck_elem;
typedef struct {
	mcheck_elem elems[CANARY_DEPTH];
} mcheck_canary;
struct mcheck_hdr {
	size_t size; /* Exact size requested by user.  */
	size_t aln_skip; /* Ignored bytes, before the mcheck_hdr, to fulfill alignment */
	mcheck_canary canary; /* Magic number to check header integrity.  */
	char caller[MCHECK_CALLER_LEN]; /* caller info for debugging */
};

static void mcheck_default_abort(enum mcheck_status status, const void *p)
{
	const char *msg;

	switch (status) {
	case MCHECK_OK:
		msg = "memory is consistent, library is buggy\n";
		break;
	case MCHECK_HEAD:
		msg = "memory clobbered before allocated block\n";
		break;
	case MCHECK_TAIL:
		msg = "memory clobbered past end of allocated block\n";
		break;
	case MCHECK_FREE:
		msg = "block freed twice\n";
		break;
	default:
		msg = "bogus mcheck_status, library is buggy\n";
		break;
	}
	printf("\n\nmcheck: %p:%s!!! [%zu]\n\n", p, msg, mcheck_chunk_count_max);
}

static mcheck_abortfunc_t mcheck_abortfunc = &mcheck_default_abort;

static inline size_t allign_size_up(size_t sz, size_t grain)
{
	return (sz + grain - 1) & ~(grain - 1);
}

#define mcheck_allign_customer_size(SZ) allign_size_up(SZ, sizeof(mcheck_elem))
#define mcheck_evaluate_memalign_prefix_size(ALIGN) allign_size_up(sizeof(struct mcheck_hdr), ALIGN)

static enum mcheck_status mcheck_OnNok(enum mcheck_status status, const void *p)
{
	(*mcheck_abortfunc)(status, p);
	return status;
}

static enum mcheck_status mcheck_checkhdr(const struct mcheck_hdr *hdr)
{
	int i;

	for (i = 0; i < CANARY_DEPTH; ++i)
		if (hdr->canary.elems[i] == MAGICFREE)
			return mcheck_OnNok(MCHECK_FREE, hdr + 1);

	for (i = 0; i < CANARY_DEPTH; ++i)
		if (hdr->canary.elems[i] != MAGICWORD)
			return mcheck_OnNok(MCHECK_HEAD, hdr + 1);

	const size_t payload_size = hdr->size;
	const size_t payload_size_aligned = mcheck_allign_customer_size(payload_size);
	const size_t padd_size = payload_size_aligned - hdr->size;

	const char *payload = (const char *)&hdr[1];

	for (i = 0; i < padd_size; ++i)
		if (payload[payload_size + i] != PADDINGFLOOD)
			return mcheck_OnNok(MCHECK_TAIL, hdr + 1);

	const mcheck_canary *tail = (const mcheck_canary *)&payload[payload_size_aligned];

	for (i = 0; i < CANARY_DEPTH; ++i)
		if (tail->elems[i] != MAGICTAIL)
			return mcheck_OnNok(MCHECK_TAIL, hdr + 1);
	return MCHECK_OK;
}

enum { KEEP_CONTENT = 0, CLEAN_CONTENT, ANY_ALIGNMENT = 1 };
static void *mcheck_free_helper(void *ptr, int clean_content)
{
	if (!ptr)
		return ptr;

	struct mcheck_hdr *hdr = &((struct mcheck_hdr *)ptr)[-1];
	int i;

	mcheck_checkhdr(hdr);
	for (i = 0; i < CANARY_DEPTH; ++i)
		hdr->canary.elems[i] = MAGICFREE;

	if (clean_content)
		mcheck_flood(ptr, FREEFLOOD, mcheck_allign_customer_size(hdr->size));

	for (i = 0; i < REGISTRY_SZ; ++i)
		if (mcheck_registry[i] == hdr) {
			mcheck_registry[i] = 0;
			break;
		}

	--mcheck_chunk_count;
	return (char *)hdr - hdr->aln_skip;
}

static void *mcheck_free_prehook(void *ptr) { return mcheck_free_helper(ptr, CLEAN_CONTENT); }
static void *mcheck_reallocfree_prehook(void *ptr) { return mcheck_free_helper(ptr, KEEP_CONTENT); }

static size_t mcheck_alloc_prehook(size_t sz)
{
	sz = mcheck_allign_customer_size(sz);
	return sizeof(struct mcheck_hdr) + sz + sizeof(mcheck_canary);
}

static void *mcheck_allocated_helper(void *altoghether_ptr, size_t customer_sz,
				     size_t alignment, int clean_content,
				     const char *caller)
{
	static bool overflow_msg_shown;
	const size_t slop = alignment ?
		mcheck_evaluate_memalign_prefix_size(alignment) - sizeof(struct mcheck_hdr) : 0;
	struct mcheck_hdr *hdr = (struct mcheck_hdr *)((char *)altoghether_ptr + slop);
	int i;

	hdr->size = customer_sz;
	hdr->aln_skip = slop;
	for (i = 0; i < CANARY_DEPTH; ++i)
		hdr->canary.elems[i] = MAGICWORD;
	if (caller)
		strlcpy(hdr->caller, caller, MCHECK_CALLER_LEN);
	else
		hdr->caller[0] = '\0';

	char *payload = (char *)&hdr[1];

	if (clean_content)
		mcheck_flood(payload, MALLOCFLOOD, customer_sz);

	const size_t customer_size_aligned = mcheck_allign_customer_size(customer_sz);

	mcheck_flood(payload + customer_sz, PADDINGFLOOD, customer_size_aligned - customer_sz);

	mcheck_canary *tail = (mcheck_canary *)&payload[customer_size_aligned];

	for (i = 0; i < CANARY_DEPTH; ++i)
		tail->elems[i] = MAGICTAIL;

	++mcheck_chunk_count;
	if (mcheck_chunk_count > mcheck_chunk_count_max)
		mcheck_chunk_count_max = mcheck_chunk_count;

	for (i = 0; i < REGISTRY_SZ; ++i)
		if (!mcheck_registry[i]) {
			mcheck_registry[i] = hdr;
			return payload; // normal end
		}

	if (!overflow_msg_shown) {
		overflow_msg_shown = true;
		printf("\n\nERROR: mcheck registry overflow, pedantic check would be incomplete!\n\n");
	}
	return payload;
}

static void *mcheck_alloc_posthook(void *altoghether_ptr, size_t customer_sz,
				   const char *caller)
{
	return mcheck_allocated_helper(altoghether_ptr, customer_sz,
				       ANY_ALIGNMENT, CLEAN_CONTENT, caller);
}

static void *mcheck_alloc_noclean_posthook(void *altoghether_ptr,
					   size_t customer_sz,
					   const char *caller)
{
	return mcheck_allocated_helper(altoghether_ptr, customer_sz,
				       ANY_ALIGNMENT, KEEP_CONTENT, caller);
}

static size_t mcheck_memalign_prehook(size_t alig, size_t sz)
{
	return mcheck_evaluate_memalign_prefix_size(alig) + sz + sizeof(mcheck_canary);
}

static void *mcheck_memalign_posthook(size_t alignment, void *altoghether_ptr,
				      size_t customer_sz, const char *caller)
{
	return mcheck_allocated_helper(altoghether_ptr, customer_sz, alignment,
				       CLEAN_CONTENT, caller);
}

static enum mcheck_status mcheck_mprobe(void *ptr)
{
	struct mcheck_hdr *hdr = &((struct mcheck_hdr *)ptr)[-1];

	return mcheck_checkhdr(hdr);
}

static void mcheck_pedantic_check(void)
{
	int i;

	for (i = 0; i < REGISTRY_SZ; ++i)
		if (mcheck_registry[i])
			mcheck_checkhdr(mcheck_registry[i]);
}

static void mcheck_pedantic_prehook(void)
{
	if (mcheck_pedantic_flag)
		mcheck_pedantic_check();
}

static void mcheck_initialize(mcheck_abortfunc_t new_func, char pedantic_flag)
{
	mcheck_abortfunc = (new_func) ? new_func : &mcheck_default_abort;
	mcheck_pedantic_flag = pedantic_flag;
}

void mcheck_on_ramrelocation(size_t offset)
{
	int i;

	/*
	 * Pre-relocation heap allocations are no longer valid after
	 * relocation. Clear the registry since we can't track them.
	 */
	for (i = 0; i < REGISTRY_SZ; ++i)
		mcheck_registry[i] = 0;

	mcheck_chunk_count = 0;
}
#endif
#endif