diff options
| -rw-r--r-- | libdislocator/Makefile | 4 | ||||
| -rw-r--r-- | libdislocator/README.dislocator.md | 2 | ||||
| -rw-r--r-- | libdislocator/libdislocator.so.c | 47 |
3 files changed, 49 insertions, 4 deletions
diff --git a/libdislocator/Makefile b/libdislocator/Makefile index 05ba26b3..216d2862 100644 --- a/libdislocator/Makefile +++ b/libdislocator/Makefile @@ -21,6 +21,10 @@ VERSION = $(shell grep '^\#define VERSION ' ../config.h | cut -d '"' -f2) CFLAGS ?= -O3 -funroll-loops -I ../include/ CFLAGS += -Wall -D_FORTIFY_SOURCE=2 -g -Wno-pointer-sign +ifdef USEHUGEPAGE + CFLAGS += -DUSEHUGEPAGE +endif + all: libdislocator.so libdislocator.so: libdislocator.so.c ../config.h diff --git a/libdislocator/README.dislocator.md b/libdislocator/README.dislocator.md index 5d5a1464..77626901 100644 --- a/libdislocator/README.dislocator.md +++ b/libdislocator/README.dislocator.md @@ -25,6 +25,8 @@ heap-related security bugs in several ways: - It checks for calloc() overflows and can cause soft or hard failures of alloc requests past a configurable memory limit (AFL_LD_LIMIT_MB, AFL_LD_HARD_FAIL). + - Optionally, in platforms supporting it, huge pages can be used by passing + USEHUGEPAGE=1 to make. Basically, it is inspired by some of the non-default options available for the OpenBSD allocator - see malloc.conf(5) on that platform for reference. It is diff --git a/libdislocator/libdislocator.so.c b/libdislocator/libdislocator.so.c index 106b44f4..0268cc52 100644 --- a/libdislocator/libdislocator.so.c +++ b/libdislocator/libdislocator.so.c @@ -26,6 +26,10 @@ #include <errno.h> #include <sys/mman.h> +#ifdef __APPLE__ +#include <mach/vm_statistics.h> +#endif + #include "config.h" #include "types.h" @@ -37,6 +41,8 @@ #define MAP_ANONYMOUS MAP_ANON #endif /* !MAP_ANONYMOUS */ +#define SUPER_PAGE_SIZE 1<<21 + /* Error / message handling: */ #define DEBUGF(_x...) \ @@ -105,6 +111,8 @@ static __thread u32 call_depth; /* To avoid recursion via fprintf() */ static void* __dislocator_alloc(size_t len) { void* ret; + size_t tlen; + int flags, fd, sp; if (total_mem + len > max_mem || total_mem + len < total_mem) { @@ -116,11 +124,42 @@ static void* __dislocator_alloc(size_t len) { } + tlen = (1 + PG_COUNT(len + 8)) * PAGE_SIZE; + flags = MAP_PRIVATE | MAP_ANONYMOUS; + fd = -1; +#if defined(USEHUGEPAGE) + sp = (len >= SUPER_PAGE_SIZE && !(len % SUPER_PAGE_SIZE)); + +#if defined(__APPLE__) + if (sp) fd = VM_FLAGS_SUPERPAGE_SIZE_2MB; +#elif defined(__linux__) + if (sp) flags |= MAP_HUGETLB; +#elif defined(__FreeBSD__) + if (sp) flags |= MAP_ALIGNED_SUPER; +#endif +#else + (void)sp; +#endif + /* We will also store buffer length and a canary below the actual buffer, so let's add 8 bytes for that. */ - ret = mmap(NULL, (1 + PG_COUNT(len + 8)) * PAGE_SIZE, PROT_READ | PROT_WRITE, - MAP_PRIVATE | MAP_ANONYMOUS, -1, 0); + ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE, + flags, fd, 0); +#if defined(USEHUGEPAGE) + /* We try one more time with regular call */ + if (ret == MAP_FAILED) { +#if defined(__APPLE__) + fd = -1; +#elif defined(__linux__) + flags &= -MAP_HUGETLB; +#elif defined(__FreeBSD__) + flags &= -MAP_ALIGNED_SUPER; +#endif + ret = mmap(NULL, tlen, PROT_READ | PROT_WRITE, + flags, fd, 0); + } +#endif if (ret == MAP_FAILED) { @@ -315,11 +354,11 @@ void *aligned_alloc(size_t align, size_t len) { __attribute__((constructor)) void __dislocator_init(void) { - u8* tmp = getenv("AFL_LD_LIMIT_MB"); + u8* tmp = (u8 *)getenv("AFL_LD_LIMIT_MB"); if (tmp) { - max_mem = atoi(tmp) * 1024 * 1024; + max_mem = atoi((char *)tmp) * 1024 * 1024; if (!max_mem) FATAL("Bad value for AFL_LD_LIMIT_MB"); } |