mirror/mariadb
1
0
Fork 0
mirror of https://github.com/MariaDB/server.git synced 2025-01-15 19:42:28 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

MDEV-20377 post-fix: Introduce MEM_MAKE_ADDRESSABLE

Browse source 
In AddressSanitizer, we only want memory poisoning to happen
in connection with custom memory allocation or freeing.

The primary use of MEM_UNDEFINED is for declaring memory uninitialized
in Valgrind or MemorySanitizer. We do not want MEM_UNDEFINED to
have the unwanted side effect that AddressSanitizer would no longer
be able to complain about accessing unallocated memory.

MEM_UNDEFINED(): Define as no-op for AddressSanitizer.

MEM_MAKE_ADDRESSABLE(): Define as MEM_UNDEFINED() or
ASAN_UNPOISON_MEMORY_REGION().

MEM_CHECK_ADDRESSABLE(): Wrap also __asan_region_is_poisoned().
This commit is contained in:
Marko Mäkelä 2020-07-02 16:52:13 +03:00 committed by Monty
parent 65f831d17c
commit b6ec1e8bbf
18 changed files with 35 additions and 87 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
include/my_valgrind.h
View file

@ -28,6 +28,7 @@
# include <sanitizer/msan_interface.h>
# define HAVE_valgrind
# define MEM_UNDEFINED(a,len) __msan_allocated_memory(a,len)
# define MEM_MAKE_ADDRESSABLE(a,len) MEM_UNDEFINED(a,len)
# define MEM_MAKE_DEFINED(a,len) __msan_unpoison(a,len)
# define MEM_NOACCESS(a,len) ((void) 0)
# define MEM_CHECK_ADDRESSABLE(a,len) ((void) 0)
@ -38,6 +39,7 @@
#elif defined(HAVE_VALGRIND_MEMCHECK_H) && defined(HAVE_valgrind)
# include <valgrind/memcheck.h>
# define MEM_UNDEFINED(a,len) VALGRIND_MAKE_MEM_UNDEFINED(a,len)
# define MEM_MAKE_ADDRESSABLE(a,len) MEM_UNDEFINED(a,len)
# define MEM_MAKE_DEFINED(a,len) VALGRIND_MAKE_MEM_DEFINED(a,len)
# define MEM_NOACCESS(a,len) VALGRIND_MAKE_MEM_NOACCESS(a,len)
# define MEM_CHECK_ADDRESSABLE(a,len) VALGRIND_CHECK_MEM_IS_ADDRESSABLE(a,len)
@ -49,16 +51,19 @@
# include <sanitizer/asan_interface.h>
/* How to do manual poisoning:
https://github.com/google/sanitizers/wiki/AddressSanitizerManualPoisoning */
# define MEM_UNDEFINED(a,len) ASAN_UNPOISON_MEMORY_REGION(a,len)
# define MEM_UNDEFINED(a,len) ((void) 0)
# define MEM_MAKE_ADDRESSABLE(a,len) ASAN_UNPOISON_MEMORY_REGION(a,len)
# define MEM_MAKE_DEFINED(a,len) ((void) 0)
# define MEM_NOACCESS(a,len) ASAN_POISON_MEMORY_REGION(a,len)
# define MEM_CHECK_ADDRESSABLE(a,len) ((void) 0)
# define MEM_CHECK_ADDRESSABLE(a,len) \
assert(!__asan_region_is_poisoned((void*) a,len))
# define MEM_CHECK_DEFINED(a,len) ((void) 0)
# define MEM_GET_VBITS(a,b,len) ((void) 0)
# define MEM_SET_VBITS(a,b,len) ((void) 0)
# define REDZONE_SIZE 8
#else
# define MEM_UNDEFINED(a,len) ((void) (a), (void) (len))
# define MEM_UNDEFINED(a,len) ((void) 0)
# define MEM_MAKE_ADDRESSABLE(a,len) ((void) 0)
# define MEM_MAKE_DEFINED(a,len) ((void) 0)
# define MEM_NOACCESS(a,len) ((void) 0)
# define MEM_CHECK_ADDRESSABLE(a,len) ((void) 0)
@ -74,24 +79,22 @@ https://github.com/google/sanitizers/wiki/AddressSanitizerManualPoisoning */
#define IF_VALGRIND(A,B) B
#endif
#ifdef TRASH_FREED_MEMORY
/*
TRASH_FILL() has to call MEM_UNDEFINED() to cancel any effect of TRASH_FREE().
_TRASH_FILL() has to call MEM_MAKE_ADDRESSABLE() to cancel any effect of
TRASH_FREE().
This can happen in the case one does
TRASH_ALLOC(A,B) ; TRASH_FREE(A,B) ; TRASH_ALLOC(A,B)
to reuse the same memory in an internal memory allocator like MEM_ROOT.
For my_malloc() and safemalloc() the extra MEM_UNDEFINED is bit of an
overkill.
TRASH_FILL() is an internal function and should not be used externally.
_TRASH_FILL() is an internal function and should not be used externally.
*/
#define TRASH_FILL(A,B,C) do { const size_t trash_tmp= (B); MEM_UNDEFINED(A, trash_tmp); memset(A, C, trash_tmp); } while (0)
#define _TRASH_FILL(A,B,C) do { const size_t trash_tmp= (B); MEM_MAKE_ADDRESSABLE(A, trash_tmp); memset(A, C, trash_tmp); } while (0)
#else
#define TRASH_FILL(A,B,C) do { MEM_UNDEFINED((A), (B)); } while (0)
#define _TRASH_FILL(A,B,C) do { MEM_UNDEFINED((A), (B)); } while (0)
#endif
/** Note that some memory became allocated or uninitialized. */
#define TRASH_ALLOC(A,B) do { TRASH_FILL(A,B,0xA5); MEM_UNDEFINED(A,B); } while(0)
/** Note that some memory became allocated and/or uninitialized. */
#define TRASH_ALLOC(A,B) do { _TRASH_FILL(A,B,0xA5); MEM_MAKE_ADDRESSABLE(A,B); } while(0)
/** Note that some memory became freed. (Prohibit further access to it.) */
#define TRASH_FREE(A,B) do { TRASH_FILL(A,B,0x8F); MEM_NOACCESS(A,B); } while(0)
#define TRASH_FREE(A,B) do { _TRASH_FILL(A,B,0x8F); MEM_NOACCESS(A,B); } while(0)
#endif /* MY_VALGRIND_INCLUDED */

2
mysys/my_alloc.c
View file

@ -212,7 +212,7 @@ void *alloc_root(MEM_ROOT *mem_root, size_t length)
uchar* point;
reg1 USED_MEM *next= 0;
reg2 USED_MEM **prev;
size_t original_length = length;
size_t original_length __attribute__((unused)) = length;
DBUG_ENTER("alloc_root");
DBUG_PRINT("enter",("root: %p name: %s", mem_root, mem_root->name));
DBUG_ASSERT(alloc_root_inited(mem_root));

1
sql/table.cc
View file

@ -1644,6 +1644,7 @@ int TABLE_SHARE::init_from_binary_frm_image(THD *thd, bool write,
share->rec_buff_length= rec_buff_length;
if (!(record= (uchar *) alloc_root(&share->mem_root, rec_buff_length)))
goto err; /* purecov: inspected */
/* Mark bytes after record as not accessable to catch overrun bugs */
MEM_NOACCESS(record + share->reclength, rec_buff_length - share->reclength);
share->default_values= record;
memcpy(record, frm_image + record_offset, share->reclength);

2
storage/innobase/btr/btr0cur.cc
View file

@ -1179,12 +1179,10 @@ btr_cur_search_to_nth_level_func(
ut_ad(!(index->type & DICT_FTS));
ut_ad(index->page != FIL_NULL);
#ifdef HAVE_valgrind
MEM_UNDEFINED(&cursor->up_match, sizeof cursor->up_match);
MEM_UNDEFINED(&cursor->up_bytes, sizeof cursor->up_bytes);
MEM_UNDEFINED(&cursor->low_match, sizeof cursor->low_match);
MEM_UNDEFINED(&cursor->low_bytes, sizeof cursor->low_bytes);
#endif /* HAVE_valgrind */
#ifdef UNIV_DEBUG
cursor->up_match = ULINT_UNDEFINED;
cursor->low_match = ULINT_UNDEFINED;

2
storage/innobase/buf/buf0buddy.cc
View file

@ -393,9 +393,7 @@ buf_buddy_block_free(
HASH_DELETE(buf_page_t, hash, buf_pool->zip_hash, fold, bpage);
ut_d(memset(buf, 0, srv_page_size));
#ifdef HAVE_valgrind
MEM_UNDEFINED(buf, srv_page_size);
#endif /* HAVE_valgrind */
block = (buf_block_t*) bpage;
buf_page_mutex_enter(block);

8
storage/innobase/buf/buf0lru.cc
View file

@ -806,7 +806,7 @@ buf_LRU_get_free_only(
assert_block_ahi_empty(block);
buf_block_set_state(block, BUF_BLOCK_READY_FOR_USE);
MEM_UNDEFINED(block->frame, srv_page_size);
MEM_MAKE_ADDRESSABLE(block->frame, srv_page_size);
ut_ad(buf_pool_from_block(block) == buf_pool);
@ -1609,13 +1609,9 @@ func_exit:
order to avoid bogus Valgrind or MSAN warnings.*/
buf_block_t* block = reinterpret_cast<buf_block_t*>(bpage);
#ifdef HAVE_valgrind
MEM_MAKE_DEFINED(block->frame, srv_page_size);
#endif /* HAVE_valgrind */
btr_search_drop_page_hash_index(block);
#ifdef HAVE_valgrind
MEM_UNDEFINED(block->frame, srv_page_size);
#endif /* HAVE_valgrind */
buf_pool_mutex_enter(buf_pool);
@ -1660,9 +1656,7 @@ buf_LRU_block_free_non_file_page(
buf_block_set_state(block, BUF_BLOCK_NOT_USED);
#ifdef HAVE_valgrind
MEM_UNDEFINED(block->frame, srv_page_size);
#endif /* HAVE_valgrind */
/* Wipe page_no and space_id */
memset(block->frame + FIL_PAGE_OFFSET, 0xfe, 4);
memset(block->frame + FIL_PAGE_ARCH_LOG_NO_OR_SPACE_ID, 0xfe, 4);

4
storage/innobase/handler/ha_innodb.cc
View file

@ -7334,9 +7334,7 @@ build_template_field(
ut_ad(clust_index->table == index->table);
templ = prebuilt->mysql_template + prebuilt->n_template++;
#ifdef HAVE_valgrind
MEM_UNDEFINED(templ, sizeof *templ);
#endif /* HAVE_valgrind */
templ->is_virtual = !field->stored_in_db();
if (!templ->is_virtual) {
@ -8454,9 +8452,7 @@ calc_row_difference(
/* The field has changed */
ufield = uvect->fields + n_changed;
#ifdef HAVE_valgrind
MEM_UNDEFINED(ufield, sizeof *ufield);
#endif /* HAVE_valgrind */
/* Let us use a dummy dfield to make the conversion
from the MySQL column format to the InnoDB format */

2
storage/innobase/include/mem0mem.ic
View file

@ -203,7 +203,7 @@ mem_heap_alloc(
mem_block_set_free(block, free + MEM_SPACE_NEEDED(n));
buf = buf + REDZONE_SIZE;
MEM_UNDEFINED(buf, n - REDZONE_SIZE);
MEM_MAKE_ADDRESSABLE(buf, n - REDZONE_SIZE);
return(buf);
}

14
storage/innobase/include/ut0pool.h
View file

@ -89,13 +89,12 @@ struct Pool {
ut_ad(elem->m_pool == this);
#ifdef __SANITIZE_ADDRESS__
/* Unpoison the memory for AddressSanitizer */
MEM_UNDEFINED(&elem->m_type, sizeof elem->m_type);
MEM_MAKE_ADDRESSABLE(&elem->m_type,
sizeof elem->m_type);
#endif
#ifdef HAVE_valgrind
/* Declare the contents as initialized for Valgrind;
/* Declare the contents initialized;
we checked this in mem_free(). */
MEM_MAKE_DEFINED(&elem->m_type, sizeof elem->m_type);
#endif
Factory::destroy(&elem->m_type);
}
@ -134,14 +133,13 @@ struct Pool {
if (elem) {
# ifdef __SANITIZE_ADDRESS__
/* Unpoison the memory for AddressSanitizer */
MEM_UNDEFINED(&elem->m_type, sizeof elem->m_type);
MEM_MAKE_ADDRESSABLE(&elem->m_type,
sizeof elem->m_type);
# endif
# ifdef HAVE_valgrind
/* Declare the memory initialized for Valgrind.
/* Declare the memory initialized.
The trx_t that are released to the pool are
actually initialized; we checked that by
MEM_CHECK_DEFINED() in mem_free() below. */
# endif
MEM_MAKE_DEFINED(&elem->m_type, sizeof elem->m_type);
}
#endif

2
storage/innobase/os/os0proc.cc
View file

@ -162,7 +162,7 @@ os_mem_free_large(
// And we must unpoison it by ourself as specified in documentation
// for __asan_poison_memory_region() in sanitizer/asan_interface.h
// munmap() doesn't do it for us automatically.
MEM_UNDEFINED(ptr, size);
MEM_MAKE_ADDRESSABLE(ptr, size);
#endif /* __SANITIZE_ADDRESS__ */
#ifdef HAVE_LINUX_LARGE_PAGES

4
storage/innobase/page/page0zip.cc
View file

@ -1577,11 +1577,11 @@ err_exit:
ut_ad(buf + c_stream.total_out == c_stream.next_out);
ut_ad((ulint) (storage - c_stream.next_out) >= c_stream.avail_out);
#ifdef HAVE_valgrind
#if defined HAVE_valgrind && !__has_feature(memory_sanitizer)
/* Valgrind believes that zlib does not initialize some bits
in the last 7 or 8 bytes of the stream. Make Valgrind happy. */
MEM_MAKE_DEFINED(buf, c_stream.total_out);
#endif /* HAVE_valgrind */
#endif /* HAVE_valgrind && !memory_sanitizer */
/* Zero out the area reserved for the modification log.
Space for the end marker of the modification log is not

2
storage/innobase/row/row0ins.cc
View file

@ -1243,10 +1243,8 @@ row_ins_foreign_check_on_constraint(
update->info_bits = 0;
update->n_fields = foreign->n_fields;
#ifdef HAVE_valgrind
MEM_UNDEFINED(update->fields,
update->n_fields * sizeof *update->fields);
#endif /* HAVE_valgrind */
bool affects_fulltext = false;

18
storage/innobase/row/row0log.cc
View file

@ -372,9 +372,7 @@ row_log_online_op(
goto err_exit;
}
#ifdef HAVE_valgrind
MEM_UNDEFINED(log->tail.buf, sizeof log->tail.buf);
#endif /* HAVE_valgrind */
ut_ad(log->tail.bytes < srv_sort_buf_size);
avail_size = srv_sort_buf_size - log->tail.bytes;
@ -459,10 +457,8 @@ write_failed:
index->type |= DICT_CORRUPT;
}
#ifdef HAVE_valgrind
MEM_UNDEFINED(log->tail.block, srv_sort_buf_size);
MEM_UNDEFINED(buf, srv_sort_buf_size);
#endif /* HAVE_valgrind */
memcpy(log->tail.block, log->tail.buf + avail_size,
mrec_size - avail_size);
@ -472,9 +468,7 @@ write_failed:
ut_ad(b == log->tail.block + log->tail.bytes);
}
#ifdef HAVE_valgrind
MEM_UNDEFINED(log->tail.buf, sizeof log->tail.buf);
#endif /* HAVE_valgrind */
err_exit:
mutex_exit(&log->mutex);
}
@ -506,9 +500,7 @@ row_log_table_open(
{
mutex_enter(&log->mutex);
#ifdef HAVE_valgrind
MEM_UNDEFINED(log->tail.buf, sizeof log->tail.buf);
#endif /* HAVE_valgrind */
if (log->error != DB_SUCCESS) {
err_exit:
@ -600,10 +592,9 @@ row_log_table_close_func(
write_failed:
log->error = DB_ONLINE_LOG_TOO_BIG;
}
#ifdef HAVE_valgrind
MEM_UNDEFINED(log->tail.block, srv_sort_buf_size);
MEM_UNDEFINED(buf, srv_sort_buf_size);
#endif /* HAVE_valgrind */
memcpy(log->tail.block, log->tail.buf + avail, size - avail);
log->tail.bytes = size - avail;
} else {
@ -612,9 +603,7 @@ write_failed:
}
log->tail.total += size;
#ifdef HAVE_valgrind
MEM_UNDEFINED(log->tail.buf, sizeof log->tail.buf);
#endif /* HAVE_valgrind */
err_exit:
mutex_exit(&log->mutex);
@ -2785,9 +2774,7 @@ row_log_table_apply_ops(
ut_ad(new_trx_id_col > 0);
ut_ad(new_trx_id_col != ULINT_UNDEFINED);
#ifdef HAVE_valgrind
MEM_UNDEFINED(&mrec_end, sizeof mrec_end);
#endif /* HAVE_valgrind */
offsets = static_cast<rec_offs*>(ut_malloc_nokey(i * sizeof *offsets));
rec_offs_set_n_alloc(offsets, i);
@ -3696,9 +3683,8 @@ row_log_apply_ops(
ut_ad(!index->is_committed());
ut_ad(rw_lock_own(dict_index_get_lock(index), RW_LOCK_X));
ut_ad(index->online_log);
#ifdef HAVE_valgrind
MEM_UNDEFINED(&mrec_end, sizeof mrec_end);
#endif /* HAVE_valgrind */
offsets = static_cast<rec_offs*>(ut_malloc_nokey(i * sizeof *offsets));
rec_offs_set_n_alloc(offsets, i);

10
storage/innobase/row/row0merge.cc
View file

@ -1424,9 +1424,7 @@ row_merge_write_rec(
return(NULL);
}
#ifdef HAVE_valgrind
MEM_UNDEFINED(&block[0], srv_sort_buf_size);
#endif /* HAVE_valgrind */
/* Copy the rest. */
b = &block[0];
@ -1477,9 +1475,7 @@ row_merge_write_eof(
DBUG_RETURN(NULL);
}
#ifdef HAVE_valgrind
MEM_UNDEFINED(&block[0], srv_sort_buf_size);
#endif
DBUG_RETURN(&block[0]);
}
@ -2680,10 +2676,8 @@ write_buffers:
break;
}
#ifdef HAVE_valgrind
MEM_UNDEFINED(
&block[0], srv_sort_buf_size);
#endif /* HAVE_valgrind */
}
}
merge_buf[i] = row_merge_buf_empty(buf);
@ -3203,9 +3197,7 @@ row_merge(
foffs0 = 0;
foffs1 = ihalf;
#ifdef HAVE_valgrind
MEM_UNDEFINED(run_offset, *num_run * sizeof *run_offset);
#endif /* HAVE_valgrind */
for (; foffs0 < ihalf && foffs1 < file->offset; foffs0++, foffs1++) {
@ -3286,9 +3278,7 @@ row_merge(
*tmpfd = file->fd;
*file = of;
#ifdef HAVE_valgrind
MEM_UNDEFINED(&block[0], 3 * srv_sort_buf_size);
#endif /* HAVE_valgrind */
return(DB_SUCCESS);
}

10
storage/innobase/row/row0sel.cc
View file

@ -982,11 +982,9 @@ row_sel_get_clust_rec(
switch (err) {
case DB_SUCCESS:
case DB_SUCCESS_LOCKED_REC:
#ifdef HAVE_valgrind
/* Declare the variable uninitialized.
It should be set to DB_SUCCESS at func_exit. */
MEM_UNDEFINED(&err, sizeof err);
#endif /* HAVE_valgrind */
break;
default:
goto err_exit;
@ -2742,9 +2740,7 @@ row_sel_field_store_in_mysql_format_func(
ut_ad(len != UNIV_SQL_NULL);
MEM_CHECK_DEFINED(data, len);
MEM_CHECK_ADDRESSABLE(dest, templ->mysql_col_len);
#ifdef HAVE_valgrind
MEM_UNDEFINED(dest, templ->mysql_col_len);
#endif /* HAVE_valgrind */
switch (templ->type) {
const byte* field_end;
@ -3653,9 +3649,7 @@ row_sel_copy_cached_field_for_mysql(
row_mysql_read_true_varchar(
&len, cache, templ->mysql_length_bytes);
len += templ->mysql_length_bytes;
#ifdef HAVE_valgrind
MEM_UNDEFINED(buf, templ->mysql_col_len);
#endif /* HAVE_valgrind */
} else {
len = templ->mysql_col_len;
}
@ -3724,9 +3718,7 @@ row_sel_dequeue_cached_row_for_mysql(
/* The record is long. Copy it field by field, in case
there are some long VARCHAR column of which only a
small length is being used. */
#ifdef HAVE_valgrind
MEM_UNDEFINED(buf, prebuilt->mysql_prefix_len);
#endif /* HAVE_valgrind */
/* First copy the NULL bits. */
ut_memcpy(buf, cached_rec, prebuilt->null_bitmap_len);
@ -3810,10 +3802,8 @@ row_sel_fetch_last_buf(
}
ut_ad(prebuilt->fetch_cache_first == 0);
#ifdef HAVE_valgrind
MEM_UNDEFINED(prebuilt->fetch_cache[prebuilt->n_fetch_cached],
prebuilt->mysql_row_len);
#endif /* HAVE_valgrind */
return(prebuilt->fetch_cache[prebuilt->n_fetch_cached]);
}

2
storage/innobase/row/row0upd.cc
View file

@ -1869,9 +1869,7 @@ row_upd_changes_ord_field_binary_func(
/* Silence a compiler warning without
silencing a Valgrind error. */
dfield_len = 0;
#ifdef HAVE_valgrind
MEM_UNDEFINED(&dfield_len, sizeof dfield_len);
#endif /* HAVE_valgrind */
/* See if the column is stored externally. */
buf = row_ext_lookup(ext, col_no, &dfield_len);

2
storage/innobase/sync/sync0arr.cc
View file

@ -976,7 +976,7 @@ sync_array_print_long_waits_low(
return(false);
}
#ifdef HAVE_valgrind
#if defined HAVE_valgrind && !__has_feature(memory_sanitizer)
/* Increase the timeouts if running under valgrind because it executes
extremely slowly. HAVE_valgrind does not necessary mean that
we are running under valgrind but we have no better way to tell.

8
storage/innobase/trx/trx0trx.cc
View file

@ -453,12 +453,11 @@ void trx_free(trx_t*& trx)
#ifdef __SANITIZE_ADDRESS__
/* Unpoison the memory for innodb_monitor_set_option;
it is operating also on the freed transaction objects. */
MEM_UNDEFINED(&trx->mutex, sizeof trx->mutex);
MEM_MAKE_ADDRESSABLE(&trx->mutex, sizeof trx->mutex);
/* For innobase_kill_connection() */
MEM_UNDEFINED(&trx->state, sizeof trx->state);
MEM_UNDEFINED(&trx->mysql_thd, sizeof trx->mysql_thd);
MEM_MAKE_ADDRESSABLE(&trx->state, sizeof trx->state);
MEM_MAKE_ADDRESSABLE(&trx->mysql_thd, sizeof trx->mysql_thd);
#endif
#ifdef HAVE_valgrind
/* Unpoison the memory for innodb_monitor_set_option;
it is operating also on the freed transaction objects.
We checked that these were initialized in
@ -467,7 +466,6 @@ void trx_free(trx_t*& trx)
/* For innobase_kill_connection() */
MEM_MAKE_DEFINED(&trx->state, sizeof trx->state);
MEM_MAKE_DEFINED(&trx->mysql_thd, sizeof trx->mysql_thd);
#endif
trx = NULL;
}