1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 03:58:12 +00:00
Commit graph

7 commits

Author SHA1 Message Date
Andreas Kling
dd68370efc UserspaceEmulator: Put the memory reachability logging behind a macro 2020-07-16 19:21:45 +02:00
Andreas Kling
441918be7e UserspaceEmulator: Capture backtraces of malloc/free events
This lets us show backtraces for each leaked mallocation in the leak
report at the end. :^)
2020-07-16 19:21:45 +02:00
Andreas Kling
f6584bfc36 UserspaceEmulator: Implement very basic leak checking :^)
Upon exit, the emulator will now print a leak report of any malloc
allocations that are still live and don't have pointers to their base
address anywhere in either another live mallocation, or in one of the
non-malloc-block memory regions.

Note that the malloc-block memory region check is not fully functional
and this will work even better once we get that fixed.

This is pretty cool. :^)
2020-07-16 19:21:45 +02:00
Andreas Kling
323ec4c2ca UserspaceEmulator: Let's say "Use-after-free" instead of "UAF"
I don't know why I went with the compact format here.
2020-07-16 00:50:55 +02:00
Andreas Kling
c7cf87c9f8 UserspaceEmulator: Don't complain about free(nullptr) 2020-07-15 23:53:58 +02:00
Andreas Kling
092f643119 UserspaceEmulator: Log invalid and double free() calls :^)
We can easily catch free() on never-malloced addresses, as well as
double calls to free() on the same address, so let's do it!
2020-07-15 23:25:20 +02:00
Andreas Kling
c314292319 UserspaceEmulator: Catch use-after-frees by tracking malloc/free :^)
This patch introduces a "MallocTracer" to the UserspaceEmulator.
If this object is present on the Emulator, it can be notified whenever
the emulated program does a malloc() or free().

The notifications come in via a magic instruction sequence that we
embed in the LibC malloc() and free() functions. The sequence is:

    "salc x2, push reg32 x2, pop reg32 x3"

The data about the malloc/free operation is in the three pushes.
We make sure the sequence is harmless when running natively.

Memory accesses on MmapRegion are then audited to see if they fall
inside a known-to-be-freed malloc chunk. If so, we complain loud
and red in the debugger output. :^)

This is very, very cool! :^)

It's also a whole lot slower than before, since now we're auditing
memory accesses against a new set of metadata. This will need to be
optimized (and running in this mode should be opt-in, perhaps even
a separate program, etc.)
2020-07-15 23:25:20 +02:00