Skip to content

[DevSAN] Fix issue where shadow value may be overwritten #20958

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
zhaomaosu wants to merge 1 commit into
base: sycl
Choose a base branch
from
Draft

[DevSAN] Fix issue where shadow value may be overwritten #20958

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions libdevice/sanitizer/asan_rtl.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -485,7 +485,7 @@ void ReportAccessError(uptr poisoned_addr, uint32_t as, bool is_recover,
// Check Error Type
auto *shadow_address =
(__SYCL_GLOBAL__ s8 *)MemToShadow(poisoned_addr, as, debug);
int shadow_value = *shadow_address;
s8 shadow_value = *shadow_address;
if (shadow_value > 0) {
shadow_value = *(shadow_address + 1);
}
Expand Down Expand Up @@ -531,7 +531,7 @@ void ReportMisalignError(uptr addr, uint32_t as, bool is_recover,
while (*shadow >= 0) {
++shadow;
}
int shadow_value = *shadow;
s8 shadow_value = *shadow;

SaveReport(ErrorType::MISALIGNED, GetMemoryTypeByShadowValue(shadow_value),
is_recover, debug);
Expand Down Expand Up @@ -564,7 +564,7 @@ inline int IsAddressPoisoned(uptr a, uint32_t as, size_t size,
const DebugInfo *debug) {
auto *shadow_address = (__SYCL_GLOBAL__ s8 *)MemToShadow(a, as, debug);
if (shadow_address) {
auto shadow_value = *shadow_address;
s8 shadow_value = *shadow_address;
if (shadow_value) {
if (size == ASAN_SHADOW_GRANULARITY)
return true;
Expand Down
37 changes: 22 additions & 15 deletions unified-runtime/source/loader/layers/sanitizer/asan/asan_interceptor.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
#include "sanitizer_common/sanitizer_options.hpp"
#include "sanitizer_common/sanitizer_stacktrace.hpp"
#include "sanitizer_common/sanitizer_utils.hpp"
#include <numeric>

namespace ur_sanitizer_layer {
namespace asan {
Expand Down Expand Up @@ -353,22 +354,22 @@ AsanInterceptor::enqueueAllocInfo(std::shared_ptr<DeviceInfo> &DeviceInfo,
ur_queue_handle_t Queue,
std::shared_ptr<AllocInfo> &AI) {
if (AI->IsReleased) {
int ShadowByte;
const int8_t *ShadowByte;
switch (AI->Type) {
case AllocType::HOST_USM:
ShadowByte = kUsmHostDeallocatedMagic;
ShadowByte = &kUsmHostDeallocatedMagic;
break;
case AllocType::DEVICE_USM:
ShadowByte = kUsmDeviceDeallocatedMagic;
ShadowByte = &kUsmDeviceDeallocatedMagic;
break;
case AllocType::SHARED_USM:
ShadowByte = kUsmSharedDeallocatedMagic;
ShadowByte = &kUsmSharedDeallocatedMagic;
break;
case AllocType::MEM_BUFFER:
ShadowByte = kMemBufferDeallocatedMagic;
ShadowByte = &kMemBufferDeallocatedMagic;
break;
default:
ShadowByte = 0xff;
ShadowByte = &kUnknownMagic;
assert(false && "Unknow AllocInfo Type");
}
UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(Queue, AI->AllocBegin,
Expand All @@ -377,39 +378,45 @@ AsanInterceptor::enqueueAllocInfo(std::shared_ptr<DeviceInfo> &DeviceInfo,
}

// Init zero
static const int8_t Zero = 0;
UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(Queue, AI->AllocBegin,
AI->AllocSize, 0));
AI->AllocSize, &Zero));

uptr TailBegin = RoundUpTo(AI->UserEnd, ASAN_SHADOW_GRANULARITY);
uptr TailEnd = AI->AllocBegin + AI->AllocSize;

// User tail
if (TailBegin != AI->UserEnd) {
static const std::array<int8_t, 16> TailMagic = [] {
std::array<int8_t, 16> a{};
std::iota(a.begin(), a.end(), 0);
return a;
}();
auto Value =
AI->UserEnd - RoundDownTo(AI->UserEnd, ASAN_SHADOW_GRANULARITY);
UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(Queue, AI->UserEnd, 1,
static_cast<u8>(Value)));
&TailMagic[Value]));
}

int ShadowByte;
const int8_t *ShadowByte;
switch (AI->Type) {
case AllocType::HOST_USM:
ShadowByte = kUsmHostRedzoneMagic;
ShadowByte = &kUsmHostRedzoneMagic;
break;
case AllocType::DEVICE_USM:
ShadowByte = kUsmDeviceRedzoneMagic;
ShadowByte = &kUsmDeviceRedzoneMagic;
break;
case AllocType::SHARED_USM:
ShadowByte = kUsmSharedRedzoneMagic;
ShadowByte = &kUsmSharedRedzoneMagic;
break;
case AllocType::MEM_BUFFER:
ShadowByte = kMemBufferRedzoneMagic;
ShadowByte = &kMemBufferRedzoneMagic;
break;
case AllocType::DEVICE_GLOBAL:
ShadowByte = kDeviceGlobalRedzoneMagic;
ShadowByte = &kDeviceGlobalRedzoneMagic;
break;
default:
ShadowByte = 0xff;
ShadowByte = &kUnknownMagic;
assert(false && "Unknow AllocInfo Type");
}

Expand Down
31 changes: 17 additions & 14 deletions unified-runtime/source/loader/layers/sanitizer/asan/asan_libdevice.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,24 +88,27 @@ constexpr uint64_t ASAN_PRIVATE_SIZE = 0xffffffULL + 1;

// These magic values are written to shadow for better error
// reporting.
constexpr int kUsmDeviceRedzoneMagic = (char)0x81;
constexpr int kUsmHostRedzoneMagic = (char)0x82;
constexpr int kUsmSharedRedzoneMagic = (char)0x83;
constexpr int kMemBufferRedzoneMagic = (char)0x84;
constexpr int kDeviceGlobalRedzoneMagic = (char)0x85;
constexpr int kNullPointerRedzoneMagic = (char)0x86;
constexpr int8_t kUsmDeviceRedzoneMagic = (int8_t)0x81;
constexpr int8_t kUsmHostRedzoneMagic = (int8_t)0x82;
constexpr int8_t kUsmSharedRedzoneMagic = (int8_t)0x83;
constexpr int8_t kMemBufferRedzoneMagic = (int8_t)0x84;
constexpr int8_t kDeviceGlobalRedzoneMagic = (int8_t)0x85;
constexpr int8_t kNullPointerRedzoneMagic = (int8_t)0x86;

constexpr int kUsmDeviceDeallocatedMagic = (char)0x91;
constexpr int kUsmHostDeallocatedMagic = (char)0x92;
constexpr int kUsmSharedDeallocatedMagic = (char)0x93;
constexpr int kMemBufferDeallocatedMagic = (char)0x93;
constexpr int8_t kUsmDeviceDeallocatedMagic = (int8_t)0x91;
constexpr int8_t kUsmHostDeallocatedMagic = (int8_t)0x92;
constexpr int8_t kUsmSharedDeallocatedMagic = (int8_t)0x93;
constexpr int8_t kMemBufferDeallocatedMagic = (int8_t)0x93;

constexpr int kSharedLocalRedzoneMagic = (char)0xa1;
constexpr int8_t kSharedLocalRedzoneMagic = (int8_t)0xa1;

// Same with host ASan stack
const int kPrivateLeftRedzoneMagic = (char)0xf1;
const int kPrivateMidRedzoneMagic = (char)0xf2;
const int kPrivateRightRedzoneMagic = (char)0xf3;
const int8_t kPrivateLeftRedzoneMagic = (int8_t)0xf1;
const int8_t kPrivateMidRedzoneMagic = (int8_t)0xf2;
const int8_t kPrivateRightRedzoneMagic = (int8_t)0xf3;

// Unknown shadow value
constexpr int8_t kUnknownMagic = (int8_t)0xff;

constexpr auto kSPIR_AsanDeviceGlobalMetadata = "__AsanDeviceGlobalMetadata";
constexpr auto kSPIR_AsanSpirKernelMetadata = "__AsanKernelMetadata";
Expand Down
27 changes: 14 additions & 13 deletions unified-runtime/source/loader/layers/sanitizer/asan/asan_shadow.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ ur_result_t ShadowMemoryCPU::Setup() {
// For CPU, we use a typical page size of 4K bytes.
constexpr size_t NullptrRedzoneSize = 4096;
auto URes =
EnqueuePoisonShadow({}, 0, NullptrRedzoneSize, kNullPointerRedzoneMagic);
EnqueuePoisonShadow({}, 0, NullptrRedzoneSize, &kNullPointerRedzoneMagic);
if (URes != UR_RESULT_SUCCESS) {
UR_LOG_L(getContext()->logger, ERR,
"EnqueuePoisonShadow(NullPointerRZ): {}", URes);
Expand All @@ -74,7 +74,8 @@ uptr ShadowMemoryCPU::MemToShadow(uptr Ptr) {
}

ur_result_t ShadowMemoryCPU::EnqueuePoisonShadow(ur_queue_handle_t, uptr Ptr,
uptr Size, u8 Value) {
uptr Size,
const int8_t *Value) {
if (Size == 0) {
return UR_RESULT_SUCCESS;
}
Expand All @@ -85,8 +86,8 @@ ur_result_t ShadowMemoryCPU::EnqueuePoisonShadow(ur_queue_handle_t, uptr Ptr,
UR_LOG_L(getContext()->logger, DEBUG,
"EnqueuePoisonShadow(addr={}, count={}, value={})",
(void *)ShadowBegin, ShadowEnd - ShadowBegin + 1,
(void *)(size_t)Value);
memset((void *)ShadowBegin, Value, ShadowEnd - ShadowBegin + 1);
(void *)(size_t)*Value);
memset((void *)ShadowBegin, *Value, ShadowEnd - ShadowBegin + 1);

return UR_RESULT_SUCCESS;
}
Expand Down Expand Up @@ -118,7 +119,7 @@ ur_result_t ShadowMemoryGPU::Setup() {
<< ASAN_SHADOW_SCALE;
ManagedQueue Queue(Context, Device);
Result = EnqueuePoisonShadow(Queue, 0, NullptrRedzoneSize,
kNullPointerRedzoneMagic);
&kNullPointerRedzoneMagic);
if (Result != UR_RESULT_SUCCESS) {
UR_LOG_L(getContext()->logger, ERR,
"EnqueuePoisonShadow(NullPointerRZ): {}", Result);
Expand Down Expand Up @@ -168,7 +169,7 @@ ur_result_t ShadowMemoryGPU::Destory() {

ur_result_t ShadowMemoryGPU::EnqueuePoisonShadow(ur_queue_handle_t Queue,
uptr Ptr, uptr Size,
u8 Value) {
const int8_t *Value) {
if (Size == 0) {
return UR_RESULT_SUCCESS;
}
Expand All @@ -180,7 +181,7 @@ ur_result_t ShadowMemoryGPU::EnqueuePoisonShadow(ur_queue_handle_t Queue,
UR_LOG_L(getContext()->logger, DEBUG,
"EnqueuePoisonShadow(addr={}, count={}, value={})",
(void *)ShadowBegin, ShadowEnd - ShadowBegin + 1,
(void *)(size_t)Value);
(void *)(size_t)*Value);

// Make sure the shadow memory is mapped to physical memory
{
Expand Down Expand Up @@ -216,7 +217,7 @@ ur_result_t ShadowMemoryGPU::EnqueuePoisonShadow(ur_queue_handle_t Queue,
(void *)MappedPtr, (void *)(MappedPtr + PageSize - 1));

// Initialize to zero
URes = EnqueueUSMSet(Queue, (void *)MappedPtr, (char)0, PageSize);
URes = EnqueueUSMSetZero(Queue, (void *)MappedPtr, PageSize);
if (URes != UR_RESULT_SUCCESS) {
UR_LOG_L(getContext()->logger, ERR, "EnqueueUSMBlockingSet(): {}",
URes);
Expand All @@ -240,7 +241,7 @@ ur_result_t ShadowMemoryGPU::EnqueuePoisonShadow(ur_queue_handle_t Queue,
UR_LOG_L(getContext()->logger, ERR,
"EnqueuePoisonShadow(addr={}, count={}, value={}): {}",
(void *)ShadowBegin, ShadowEnd - ShadowBegin + 1,
(void *)(size_t)Value, URes);
(void *)(size_t)*Value, URes);
return URes;
}

Expand Down Expand Up @@ -271,8 +272,8 @@ ur_result_t ShadowMemoryGPU::AllocLocalShadow(ur_queue_handle_t Queue,
(void **)&LocalShadowOffset));

// Initialize shadow memory
ur_result_t URes = EnqueueUSMSet(Queue, (void *)LocalShadowOffset, (char)0,
RequiredShadowSize);
ur_result_t URes =
EnqueueUSMSetZero(Queue, (void *)LocalShadowOffset, RequiredShadowSize);
if (URes != UR_RESULT_SUCCESS) {
UR_CALL(getContext()->urDdiTable.USM.pfnFree(Context,
(void *)LocalShadowOffset));
Expand Down Expand Up @@ -341,8 +342,8 @@ ur_result_t ShadowMemoryGPU::AllocPrivateShadow(ur_queue_handle_t Queue,
Context, Device, nullptr, nullptr, NewPrivateShadowSize,
(void **)&PrivateShadowOffset));
LastPrivateShadowAllocedSize = NewPrivateShadowSize;
UR_CALL_THROWS(EnqueueUSMSet(Queue, (void *)PrivateShadowOffset, (char)0,
NewPrivateShadowSize));
UR_CALL_THROWS(EnqueueUSMSetZero(Queue, (void *)PrivateShadowOffset,
NewPrivateShadowSize));
ContextInfo->Stats.UpdateShadowMalloced(NewPrivateShadowSize);
}

Expand Down
6 changes: 3 additions & 3 deletions unified-runtime/source/loader/layers/sanitizer/asan/asan_shadow.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ struct ShadowMemory {
virtual uptr MemToShadow(uptr Ptr) = 0;

virtual ur_result_t EnqueuePoisonShadow(ur_queue_handle_t Queue, uptr Ptr,
uptr Size, u8 Value) = 0;
uptr Size, const int8_t *Value) = 0;

virtual size_t GetShadowSize() = 0;

Expand Down Expand Up @@ -80,7 +80,7 @@ struct ShadowMemoryCPU final : public ShadowMemory {
uptr MemToShadow(uptr Ptr) override;

ur_result_t EnqueuePoisonShadow(ur_queue_handle_t Queue, uptr Ptr, uptr Size,
u8 Value) override;
const int8_t *Value) override;

size_t GetShadowSize() override { return 0x80000000000ULL; }

Expand All @@ -106,7 +106,7 @@ struct ShadowMemoryGPU : public ShadowMemory {

ur_result_t Destory() override;
ur_result_t EnqueuePoisonShadow(ur_queue_handle_t Queue, uptr Ptr, uptr Size,
u8 Value) override final;
const int8_t *Value) override final;

ur_result_t AllocLocalShadow(ur_queue_handle_t Queue, uint32_t NumWG,
uptr &Begin, uptr &End) override final;
Expand Down
12 changes: 6 additions & 6 deletions unified-runtime/source/loader/layers/sanitizer/msan/msan_ddi.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -652,8 +652,8 @@ ur_result_t urMemBufferCreate(
// Update shadow memory
std::shared_ptr<DeviceInfo> DeviceInfo =
getMsanInterceptor()->getDeviceInfo(hDevice);
UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(InternalQueue,
(uptr)Handle, size, 0));
UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(
InternalQueue, (uptr)Handle, size, &kMemInitializedMagic));
}
}

Expand Down Expand Up @@ -1552,8 +1552,8 @@ ur_result_t urEnqueueUSMFill(
uptr MemShadow = DeviceInfo->Shadow->MemToShadow((uptr)pMem);

ur_event_handle_t Event = nullptr;
UR_CALL(EnqueueUSMSet(hQueue, (void *)MemShadow, (char)0, size, 0, nullptr,
&Event));
UR_CALL(
EnqueueUSMSetZero(hQueue, (void *)MemShadow, size, 0, nullptr, &Event));
Events.push_back(Event);
}

Expand Down Expand Up @@ -1645,8 +1645,8 @@ ur_result_t urEnqueueUSMMemcpy(
{
const auto DstShadow = DstDI->Shadow->MemToShadow((uptr)pDst);
ur_event_handle_t Event = nullptr;
UR_CALL(EnqueueUSMSet(hQueue, (void *)DstShadow, (char)0, size, 0,
nullptr, &Event));
UR_CALL(EnqueueUSMSetZero(hQueue, (void *)DstShadow, size, 0, nullptr,
&Event));
Events.push_back(Event);
}
}
Expand Down
15 changes: 8 additions & 7 deletions unified-runtime/source/loader/layers/sanitizer/msan/msan_interceptor.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,12 +107,14 @@ ur_result_t MsanInterceptor::allocateMemory(ur_context_handle_t Context,

// Update shadow memory
auto EnqueuePoison = [&](const std::vector<ur_device_handle_t> &Devices) {
u8 Value = DontCheckHostOrSharedUSM ? 0 : 0xff;
for (ur_device_handle_t Device : Devices) {
ManagedQueue Queue(Context, Device);
std::shared_ptr<DeviceInfo> DI = getDeviceInfo(Device);
DI->Shadow->EnqueuePoisonShadowWithOrigin(Queue, (uptr)Allocated, Size,
Value, HeapOrigin.rawId());
DontCheckHostOrSharedUSM
? &kMemInitializedMagic
: &kMemUninitializedMagic,
HeapOrigin.rawId());
}
};
if (Device) { // shared/device USM
Expand Down Expand Up @@ -310,8 +312,8 @@ MsanInterceptor::registerDeviceGlobals(ur_program_handle_t Program) {
MsanShadowMemoryPVC::IsDeviceUSM(GVInfo.Addr)) ||
(DeviceInfo->Type == DeviceType::GPU_DG2 &&
MsanShadowMemoryDG2::IsDeviceUSM(GVInfo.Addr))) {
UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(Queue, GVInfo.Addr,
GVInfo.Size, 0));
UR_CALL(DeviceInfo->Shadow->EnqueuePoisonShadow(
Queue, GVInfo.Addr, GVInfo.Size, &kMemInitializedMagic));
ContextInfo->CleanShadowSize =
std::max(ContextInfo->CleanShadowSize, GVInfo.Size);
}
Expand Down Expand Up @@ -502,9 +504,8 @@ ur_result_t MsanInterceptor::prepareLaunch(
ContextInfo->Handle, DeviceInfo->Handle, nullptr, nullptr,
ContextInfo->CleanShadowSize,
(void **)&LaunchInfo.Data.Host.CleanShadow));
UR_CALL(EnqueueUSMSet(Queue, (void *)LaunchInfo.Data.Host.CleanShadow,
(char)0, ContextInfo->CleanShadowSize, 0, nullptr,
nullptr));
UR_CALL(EnqueueUSMSetZero(Queue, (void *)LaunchInfo.Data.Host.CleanShadow,
ContextInfo->CleanShadowSize));

if (LaunchInfo.LocalWorkSize.empty()) {
LaunchInfo.LocalWorkSize.resize(LaunchInfo.WorkDim);
Expand Down
3 changes: 3 additions & 0 deletions unified-runtime/source/loader/layers/sanitizer/msan/msan_libdevice.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -78,6 +78,9 @@ struct MsanRuntimeData {
// variable have changed
constexpr std::size_t MSAN_PRIVATE_SIZE = 0xffffffULL + 1;

constexpr uint8_t kMemInitializedMagic = 0;
constexpr uint8_t kMemUninitializedMagic = 0xff;

constexpr auto kSPIR_MsanDeviceGlobalMetadata = "__MsanDeviceGlobalMetadata";
constexpr auto kSPIR_MsanSpirKernelMetadata = "__MsanKernelMetadata";

Expand Down
2 changes: 1 addition & 1 deletion unified-runtime/source/loader/layers/sanitizer/msan/msan_origin.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ namespace msan {

class Origin {
public:
uint32_t rawId() const { return raw_id_; }
const uint32_t *rawId() const { return &raw_id_; }

bool isHeapOrigin() const {
return isDeviceUSMOrigin() || isHostUSMOrigin() || isSharedUSMOrigin() ||
Expand Down
Loading
Loading