Skip to content

Commit 456fc1f

Browse files
danogdanog
committed
More poisoning
1 parent d7f9b16 commit 456fc1f

File tree

1 file changed

+37
-32
lines changed

1 file changed

+37
-32
lines changed

‎Zend/zend_alloc.c‎

Lines changed: 37 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,10 @@ static size_t _real_page_size = ZEND_MM_PAGE_SIZE;
193193
ASAN_UNPOISON_MEMORY_REGION((_ptr), (_size));\
194194
} while (0);
195195

196+
#define ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(_ptr, _heap) do { \
197+
ZEND_ASAN_UNPOISON_MEMORY_REGION((_ptr), sizeof(zend_mm_chunk)); \
198+
ZEND_ASAN_UNPOISON_MEMORY_REGION((_heap), sizeof(zend_mm_heap)); \
199+
} while (0);
196200
#else
197201

198202
#define ZEND_ASAN_POISON_MEMORY_REGION
@@ -1012,7 +1016,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count ZEND_F
10121016
get_chunk:
10131017
if (heap->cached_chunks) {
10141018
heap->cached_chunks_count--;
1015-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1019+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
10161020
chunk = heap->cached_chunks;
10171021
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
10181022
heap->cached_chunks = chunk->next;
@@ -1027,12 +1031,12 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count ZEND_F
10271031
#else
10281032
zend_mm_safe_error(heap, "Allowed memory size of %zu bytes exhausted (tried to allocate %zu bytes)", heap->limit, ZEND_MM_PAGE_SIZE * pages_count);
10291033
#endif
1030-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1034+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
10311035
return NULL;
10321036
}
10331037
}
10341038
#endif
1035-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1039+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
10361040
chunk = (zend_mm_chunk*)zend_mm_chunk_alloc(heap, ZEND_MM_CHUNK_SIZE, ZEND_MM_CHUNK_SIZE);
10371041
if (UNEXPECTED(chunk == NULL)) {
10381042
/* insufficient memory */
@@ -1047,7 +1051,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count ZEND_F
10471051
#else
10481052
zend_mm_safe_error(heap, "Out of memory (allocated %zu bytes) (tried to allocate %zu bytes)", heap->real_size, ZEND_MM_PAGE_SIZE * pages_count);
10491053
#endif
1050-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1054+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
10511055
return NULL;
10521056
}
10531057
}
@@ -1073,7 +1077,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count ZEND_F
10731077
len = ZEND_MM_PAGES - ZEND_MM_FIRST_PAGE;
10741078
goto found;
10751079
} else {
1076-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1080+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
10771081
chunk = chunk->next;
10781082
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
10791083
steps++;
@@ -1100,7 +1104,7 @@ static void *zend_mm_alloc_pages(zend_mm_heap *heap, uint32_t pages_count ZEND_F
11001104
if (page_num == chunk->free_tail) {
11011105
chunk->free_tail = page_num + pages_count;
11021106
}
1103-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1107+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
11041108
return ZEND_MM_PAGE_ADDR(chunk, page_num);
11051109
}
11061110

@@ -1139,8 +1143,8 @@ static zend_always_inline void zend_mm_delete_chunk(zend_mm_heap *heap, zend_mm_
11391143
chunk->next->prev = chunk->prev;
11401144
chunk->prev->next = chunk->next;
11411145

1142-
ZEND_ASAN_POISON_MEMORY_REGION(chunk->next, sizeof(zend_mm_chunk));
1143-
ZEND_ASAN_POISON_MEMORY_REGION(chunk->prev, sizeof(zend_mm_chunk));
1146+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk->next, heap);
1147+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk->prev, heap);
11441148

11451149
heap->chunks_count--;
11461150
if (heap->chunks_count + heap->cached_chunks_count < heap->avg_chunks_count + 0.1
@@ -1189,7 +1193,7 @@ static zend_always_inline void zend_mm_free_pages_ex(zend_mm_heap *heap, zend_mm
11891193
chunk->free_tail = page_num;
11901194
}
11911195
bool should_free = free_chunk && chunk != heap->main_chunk && chunk->free_pages == ZEND_MM_PAGES - ZEND_MM_FIRST_PAGE;
1192-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1196+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
11931197
ZEND_ASAN_POISON_MEMORY_REGION(ZEND_MM_PAGE_ADDR(chunk, page_num), pages_count * ZEND_MM_PAGE_SIZE);
11941198

11951199
if (should_free) {
@@ -1381,7 +1385,8 @@ static zend_never_inline void *zend_mm_alloc_small_slow(zend_mm_heap *heap, uint
13811385
i++;
13821386
} while (i < bin_pages[bin_num]);
13831387
}
1384-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1388+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
1389+
ZEND_ASAN_UNPOISON_MEMORY_REGION(heap, sizeof(zend_mm_heap));
13851390

13861391
/* create a linked list of elements from 1 to last */
13871392
end = (zend_mm_free_slot*)((char*)bin + (bin_data_size[bin_num] * (bin_elements[bin_num] - 1)));
@@ -1480,7 +1485,7 @@ static zend_always_inline zend_mm_debug_info *zend_mm_get_debug_info(zend_mm_hea
14801485
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
14811486
info = chunk->map[page_num];
14821487
ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
1483-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1488+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
14841489
if (EXPECTED(info & ZEND_MM_IS_SRUN)) {
14851490
int bin_num = ZEND_MM_SRUN_BIN_NUM(info);
14861491
return (zend_mm_debug_info*)((char*)ptr + bin_data_size[bin_num] - ZEND_MM_ALIGNED_SIZE(sizeof(zend_mm_debug_info)));
@@ -1560,7 +1565,7 @@ static zend_always_inline void zend_mm_free_heap(zend_mm_heap *heap, void *ptr Z
15601565
zend_mm_page_info info = chunk->map[page_num];
15611566

15621567
ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
1563-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1568+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
15641569
if (EXPECTED(info & ZEND_MM_IS_SRUN)) {
15651570
zend_mm_free_small(heap, ptr, ZEND_MM_SRUN_BIN_NUM(info));
15661571
} else /* if (info & ZEND_MM_IS_LRUN) */ {
@@ -1592,7 +1597,7 @@ static size_t zend_mm_size(zend_mm_heap *heap, void *ptr ZEND_FILE_LINE_DC ZEND_
15921597
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
15931598
info = chunk->map[page_num];
15941599
ZEND_MM_CHECK(chunk->heap == heap, "zend_mm_heap corrupted");
1595-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1600+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
15961601
if (EXPECTED(info & ZEND_MM_IS_SRUN)) {
15971602
return bin_data_size[ZEND_MM_SRUN_BIN_NUM(info)];
15981603
} else /* if (info & ZEND_MM_IS_LARGE_RUN) */ {
@@ -1793,7 +1798,7 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
17931798
dbg->lineno = __zend_lineno;
17941799
dbg->orig_lineno = __zend_orig_lineno;
17951800
#endif
1796-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1801+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
17971802
return ret;
17981803
} while (0);
17991804

@@ -1811,7 +1816,7 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
18111816
dbg->lineno = __zend_lineno;
18121817
dbg->orig_lineno = __zend_orig_lineno;
18131818
#endif
1814-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1819+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
18151820
return ptr;
18161821
} else if (new_size < old_size) {
18171822
/* free tail pages */
@@ -1834,7 +1839,7 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
18341839
dbg->lineno = __zend_lineno;
18351840
dbg->orig_lineno = __zend_orig_lineno;
18361841
#endif
1837-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1842+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
18381843
return ptr;
18391844
} else /* if (new_size > old_size) */ {
18401845
int new_pages_count = (int)(new_size / ZEND_MM_PAGE_SIZE);
@@ -1863,7 +1868,7 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
18631868
dbg->lineno = __zend_lineno;
18641869
dbg->orig_lineno = __zend_orig_lineno;
18651870
#endif
1866-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1871+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
18671872
return ptr;
18681873
}
18691874
}
@@ -1872,7 +1877,7 @@ static zend_always_inline void *zend_mm_realloc_heap(zend_mm_heap *heap, void *p
18721877
#if ZEND_DEBUG
18731878
size = real_size;
18741879
#endif
1875-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
1880+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
18761881
}
18771882

18781883
copy_size = MIN(old_size, copy_size);
@@ -2117,7 +2122,7 @@ static zend_mm_heap *zend_mm_init(void)
21172122
#endif
21182123
heap->huge_list = NULL;
21192124
heap->pid = getpid();
2120-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2125+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
21212126
return heap;
21222127
}
21232128

@@ -2170,7 +2175,7 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
21702175
}
21712176
chunk->map[page_num] = ZEND_MM_SRUN_EX(i, free_counter);
21722177

2173-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2178+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
21742179
p = zend_mm_get_next_free_slot(heap, i, p);
21752180
}
21762181

@@ -2196,7 +2201,7 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
21962201
ZEND_MM_ASSERT(info & ZEND_MM_IS_SRUN);
21972202
ZEND_MM_ASSERT(!(info & ZEND_MM_IS_LRUN));
21982203
}
2199-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2204+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
22002205

22012206
ZEND_MM_ASSERT(ZEND_MM_SRUN_BIN_NUM(info) == i);
22022207
if (ZEND_MM_SRUN_FREE_COUNTER(info) == bin_elements[i]) {
@@ -2252,12 +2257,12 @@ ZEND_API size_t zend_mm_gc(zend_mm_heap *heap)
22522257
chunk = next_chunk;
22532258
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
22542259
} else {
2255-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2260+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
22562261
chunk = chunk->next;
22572262
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
22582263
}
22592264
} while (chunk != heap->main_chunk);
2260-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2265+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
22612266
ZEND_ASAN_POISON_MEMORY_REGION(heap, sizeof(zend_mm_heap));
22622267

22632268
printf("Done running gc\n");
@@ -2556,7 +2561,7 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
25562561
zend_mm_chunk *q = p->next;
25572562
memset(p, 0, sizeof(zend_mm_chunk));
25582563
p->next = q;
2559-
ZEND_ASAN_POISON_MEMORY_REGION(p, sizeof(zend_mm_chunk));
2564+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(p, heap);
25602565
p = q;
25612566
}
25622567

@@ -2596,7 +2601,7 @@ ZEND_API void zend_mm_shutdown(zend_mm_heap *heap, bool full, bool silent)
25962601
} else {
25972602
zend_mm_refresh_key(heap);
25982603
}
2599-
ZEND_ASAN_POISON_MEMORY_REGION(p, sizeof(zend_mm_chunk));
2604+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(p, heap);
26002605
}
26012606
ZEND_ASAN_POISON_MEMORY_REGION(heap, sizeof(zend_mm_heap));
26022607
}
@@ -2732,16 +2737,16 @@ ZEND_API bool is_zend_ptr(const void *ptr)
27322737
do {
27332738
if (ptr >= (void*)chunk
27342739
&& ptr < (void*)((char*)chunk + ZEND_MM_CHUNK_SIZE)) {
2735-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2740+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, AG(mm_heap));
27362741
ZEND_ASAN_POISON_MEMORY_REGION(AG(mm_heap), sizeof(zend_mm_heap));
27372742
return 1;
27382743
}
27392744
next = chunk->next;
2740-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2745+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, AG(mm_heap));
27412746
chunk = next;
27422747
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
27432748
} while (chunk != AG(mm_heap)->main_chunk);
2744-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2749+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, AG(mm_heap));
27452750
}
27462751

27472752
zend_mm_huge_list *block = AG(mm_heap)->huge_list;
@@ -2829,7 +2834,7 @@ ZEND_API void* ZEND_FASTCALL _emalloc_huge(size_t size)
28292834
ZEND_MM_CHECK(chunk->heap == AG(mm_heap), "zend_mm_heap corrupted"); \
28302835
ZEND_MM_ASSERT(chunk->map[page_num] & ZEND_MM_IS_SRUN); \
28312836
ZEND_MM_ASSERT(ZEND_MM_SRUN_BIN_NUM(chunk->map[page_num]) == _num); \
2832-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk)); \
2837+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, AG(mm_heap)); \
28332838
ZEND_ASAN_UNPOISON_MEMORY_REGION(AG(mm_heap), sizeof(zend_mm_heap)); \
28342839
zend_mm_free_small(AG(mm_heap), ptr, _num); \
28352840
ZEND_ASAN_POISON_MEMORY_REGION(AG(mm_heap), sizeof(zend_mm_heap)); \
@@ -2847,7 +2852,7 @@ ZEND_API void* ZEND_FASTCALL _emalloc_huge(size_t size)
28472852
zend_mm_chunk *chunk = (zend_mm_chunk*)ZEND_MM_ALIGNED_BASE(ptr, ZEND_MM_CHUNK_SIZE); \
28482853
ZEND_ASAN_UNPOISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk)); \
28492854
ZEND_MM_CHECK(chunk->heap == AG(mm_heap), "zend_mm_heap corrupted"); \
2850-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk)); \
2855+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, AG(mm_heap)); \
28512856
ZEND_ASAN_UNPOISON_MEMORY_REGION(AG(mm_heap), sizeof(zend_mm_heap)); \
28522857
zend_mm_free_small(AG(mm_heap), ptr, _num); \
28532858
ZEND_ASAN_POISON_MEMORY_REGION(AG(mm_heap), sizeof(zend_mm_heap)); \
@@ -2872,7 +2877,7 @@ ZEND_API void ZEND_FASTCALL _efree_large(void *ptr, size_t size)
28722877
ZEND_MM_CHECK(chunk->heap == AG(mm_heap) && ZEND_MM_ALIGNED_OFFSET(page_offset, ZEND_MM_PAGE_SIZE) == 0, "zend_mm_heap corrupted");
28732878
ZEND_MM_ASSERT(chunk->map[page_num] & ZEND_MM_IS_LRUN);
28742879
ZEND_MM_ASSERT(ZEND_MM_LRUN_PAGES(chunk->map[page_num]) == pages_count);
2875-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
2880+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, AG(mm_heap));
28762881

28772882
ZEND_ASAN_UNPOISON_MEMORY_REGION(AG(mm_heap), sizeof(zend_mm_heap));
28782883
zend_mm_free_large(AG(mm_heap), chunk, page_num, pages_count);
@@ -3495,7 +3500,7 @@ ZEND_API zend_mm_heap *zend_mm_startup_ex(const zend_mm_handlers *handlers, void
34953500
}
34963501
heap->storage = storage;
34973502
heap->pid = getpid();
3498-
ZEND_ASAN_POISON_MEMORY_REGION(chunk, sizeof(zend_mm_chunk));
3503+
ZEND_ASAN_POISON_CHUNK_HEADER_NOT_HEAP(chunk, heap);
34993504
return heap;
35003505
#else
35013506
return NULL;

0 commit comments

Comments
 (0)