summaryrefslogtreecommitdiffstats
path: root/mfbt/Poison.cpp
diff options
context:
space:
mode:
Diffstat (limited to 'mfbt/Poison.cpp')
-rw-r--r--mfbt/Poison.cpp208
1 files changed, 208 insertions, 0 deletions
diff --git a/mfbt/Poison.cpp b/mfbt/Poison.cpp
new file mode 100644
index 000000000..b2767011d
--- /dev/null
+++ b/mfbt/Poison.cpp
@@ -0,0 +1,208 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* vim: set ts=8 sts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * A poison value that can be used to fill a memory space with
+ * an address that leads to a safe crash when dereferenced.
+ */
+
+#include "mozilla/Poison.h"
+
+#include "mozilla/Assertions.h"
+#ifdef _WIN32
+# include <windows.h>
+#elif !defined(__OS2__)
+# include <unistd.h>
+# include <sys/mman.h>
+# ifndef MAP_ANON
+# ifdef MAP_ANONYMOUS
+# define MAP_ANON MAP_ANONYMOUS
+# else
+# error "Don't know how to get anonymous memory"
+# endif
+# endif
+#endif
+
+extern "C" {
+uintptr_t gMozillaPoisonValue;
+uintptr_t gMozillaPoisonBase;
+uintptr_t gMozillaPoisonSize;
+}
+
+// Freed memory is filled with a poison value, which we arrange to
+// form a pointer either to an always-unmapped region of the address
+// space, or to a page that has been reserved and rendered
+// inaccessible via OS primitives. See tests/TestPoisonArea.cpp for
+// extensive discussion of the requirements for this page. The code
+// from here to 'class FreeList' needs to be kept in sync with that
+// file.
+
+#ifdef _WIN32
+static void*
+ReserveRegion(uintptr_t aRegion, uintptr_t aSize)
+{
+ return VirtualAlloc((void*)aRegion, aSize, MEM_RESERVE, PAGE_NOACCESS);
+}
+
+static void
+ReleaseRegion(void* aRegion, uintptr_t aSize)
+{
+ VirtualFree(aRegion, aSize, MEM_RELEASE);
+}
+
+static bool
+ProbeRegion(uintptr_t aRegion, uintptr_t aSize)
+{
+ SYSTEM_INFO sinfo;
+ GetSystemInfo(&sinfo);
+ if (aRegion >= (uintptr_t)sinfo.lpMaximumApplicationAddress &&
+ aRegion + aSize >= (uintptr_t)sinfo.lpMaximumApplicationAddress) {
+ return true;
+ } else {
+ return false;
+ }
+}
+
+static uintptr_t
+GetDesiredRegionSize()
+{
+ SYSTEM_INFO sinfo;
+ GetSystemInfo(&sinfo);
+ return sinfo.dwAllocationGranularity;
+}
+
+#define RESERVE_FAILED 0
+
+#elif defined(__OS2__)
+static void*
+ReserveRegion(uintptr_t aRegion, uintptr_t aSize)
+{
+ // OS/2 doesn't support allocation at an arbitrary address,
+ // so return an address that is known to be invalid.
+ return (void*)0xFFFD0000;
+}
+
+static void
+ReleaseRegion(void* aRegion, uintptr_t aSize)
+{
+ return;
+}
+
+static bool
+ProbeRegion(uintptr_t aRegion, uintptr_t aSize)
+{
+ // There's no reliable way to probe an address in the system
+ // arena other than by touching it and seeing if a trap occurs.
+ return false;
+}
+
+static uintptr_t
+GetDesiredRegionSize()
+{
+ // Page size is fixed at 4k.
+ return 0x1000;
+}
+
+#define RESERVE_FAILED 0
+
+#else // Unix
+
+#include "mozilla/TaggedAnonymousMemory.h"
+
+static void*
+ReserveRegion(uintptr_t aRegion, uintptr_t aSize)
+{
+ return MozTaggedAnonymousMmap(reinterpret_cast<void*>(aRegion), aSize,
+ PROT_NONE, MAP_PRIVATE|MAP_ANON, -1, 0,
+ "poison");
+}
+
+static void
+ReleaseRegion(void* aRegion, uintptr_t aSize)
+{
+ munmap(aRegion, aSize);
+}
+
+static bool
+ProbeRegion(uintptr_t aRegion, uintptr_t aSize)
+{
+ if (madvise(reinterpret_cast<void*>(aRegion), aSize, MADV_NORMAL)) {
+ return true;
+ } else {
+ return false;
+ }
+}
+
+static uintptr_t
+GetDesiredRegionSize()
+{
+ return sysconf(_SC_PAGESIZE);
+}
+
+#define RESERVE_FAILED MAP_FAILED
+
+#endif // system dependencies
+
+static_assert(sizeof(uintptr_t) == 4 || sizeof(uintptr_t) == 8, "");
+static_assert(sizeof(uintptr_t) == sizeof(void*), "");
+
+static uintptr_t
+ReservePoisonArea(uintptr_t rgnsize)
+{
+ if (sizeof(uintptr_t) == 8) {
+ // Use the hardware-inaccessible region.
+ // We have to avoid 64-bit constants and shifts by 32 bits, since this
+ // code is compiled in 32-bit mode, although it is never executed there.
+ return
+ (((uintptr_t(0x7FFFFFFFu) << 31) << 1 | uintptr_t(0xF0DEAFFFu))
+ & ~(rgnsize-1));
+ }
+
+ // First see if we can allocate the preferred poison address from the OS.
+ uintptr_t candidate = (0xF0DEAFFF & ~(rgnsize-1));
+ void* result = ReserveRegion(candidate, rgnsize);
+ if (result == (void*)candidate) {
+ // success - inaccessible page allocated
+ return candidate;
+ }
+
+ // That didn't work, so see if the preferred address is within a range
+ // of permanently inacessible memory.
+ if (ProbeRegion(candidate, rgnsize)) {
+ // success - selected page cannot be usable memory
+ if (result != RESERVE_FAILED) {
+ ReleaseRegion(result, rgnsize);
+ }
+ return candidate;
+ }
+
+ // The preferred address is already in use. Did the OS give us a
+ // consolation prize?
+ if (result != RESERVE_FAILED) {
+ return uintptr_t(result);
+ }
+
+ // It didn't, so try to allocate again, without any constraint on
+ // the address.
+ result = ReserveRegion(0, rgnsize);
+ if (result != RESERVE_FAILED) {
+ return uintptr_t(result);
+ }
+
+ MOZ_CRASH("no usable poison region identified");
+}
+
+void
+mozPoisonValueInit()
+{
+ gMozillaPoisonSize = GetDesiredRegionSize();
+ gMozillaPoisonBase = ReservePoisonArea(gMozillaPoisonSize);
+
+ if (gMozillaPoisonSize == 0) { // can't happen
+ return;
+ }
+ gMozillaPoisonValue = gMozillaPoisonBase + gMozillaPoisonSize / 2 - 1;
+}