[wasm] Allow execution while modifying code space

The --wasm-write-protect-code-memory flag previously enforced W^X, that
is the WebAssembly code space was either writable or executable, but
never both at the same time. With compilation in background threads
concurrent to execution in the main thread, this simple scheme is no
longer viable because the same memory page can indeed be written to and
executed at the same time. Hence, this flag is currently broken and
disabled and the code space is always writable AND executable.

As a first step towards more security, we at least want to
write-protect the code space (when not required writable by compilation
threads) but at the same time keep it always executable (because of
concurrent execution in the main thread). That is, we no longer switch
between RX and RW (W^X), but rather between RX and RWX
(write-protection only).

This CL starts to change from W^X (which was broken) to
write-protection only when enabling --wasm-write-protect-code-memory.
This is the first of two CLs, where the followup CL will fix the
feature, and this CL merely prepares and cleans up the code. In
particular, this CL changes the permissions from RW to RWX (due to
concurrent execution) and renames `WasmCodeAllocator::SetExecutable()`
to `WasmCodeAllocator::SetWritable()` (and similarly named callers) to
be consistent with that change. Since the code space is now always
executable, this CL also removes now unneeded calls to
`SetExecutable(true)` in tests.

R=clemensb@chromium.org
CC=​​jkummerow@chromium.org

Bug: v8:11663
Change-Id: I2065eed6770215892b81daefbddf74a349e783cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835237Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Daniel Lehmann <dlehmann@google.com>
Cr-Commit-Position: refs/heads/master@{#74041}

src/wasm/wasm-code-manager.cc

@@ -685,15 +685,23 @@ Vector<byte> WasmCodeAllocator::AllocateForCodeInRegion(
   return {reinterpret_cast<byte*>(code_space.begin()), code_space.size()};
 }
 
-bool WasmCodeAllocator::SetExecutable(bool executable) {
-  if (is_executable_ == executable) return true;
-  TRACE_HEAP("Setting module %p as executable: %d.\n", this, executable);
+// TODO(dlehmann): Do not return the success as a bool, but instead fail hard.
+// That is, pull the CHECK from {NativeModuleModificationScope} in here and
+// return void.
+bool WasmCodeAllocator::SetWritable(bool writable) {
+  if (is_writable_ == writable) return true;
+  TRACE_HEAP("Setting module %p as writable: %d.\n", this, writable);
 
+  if (FLAG_wasm_write_protect_code_memory) {
     v8::PageAllocator* page_allocator = GetPlatformPageAllocator();
 
-  if (FLAG_wasm_write_protect_code_memory) {
+    // Due to concurrent compilation and execution, we always need the execute
+    // permission, however during codegen we additionally need to write.
+    // Hence this does not actually achieve write-xor-execute, but merely
+    // "always-execute" with "no-write-eventually".
     PageAllocator::Permission permission =
-        executable ? PageAllocator::kReadExecute : PageAllocator::kReadWrite;
+        writable ? PageAllocator::kReadWriteExecute
+                 : PageAllocator::kReadExecute;
 #if V8_OS_WIN
     // On windows, we need to switch permissions per separate virtual memory
     // reservation.
@@ -706,8 +714,8 @@ bool WasmCodeAllocator::SetExecutable(bool executable) {
                           permission)) {
         return false;
       }
-      TRACE_HEAP("Set %p:%p to executable:%d\n", vmem.address(), vmem.end(),
-                 executable);
+      TRACE_HEAP("Set %p:%p to writable:%d\n", vmem.address(), vmem.end(),
+                 writable);
     }
 #else   // V8_OS_WIN
     size_t commit_page_size = page_allocator->CommitPageSize();
@@ -719,12 +727,12 @@ bool WasmCodeAllocator::SetExecutable(bool executable) {
                           permission)) {
         return false;
       }
-      TRACE_HEAP("Set 0x%" PRIxPTR ":0x%" PRIxPTR " to executable:%d\n",
-                 region.begin(), region.end(), executable);
+      TRACE_HEAP("Set 0x%" PRIxPTR ":0x%" PRIxPTR " to writable:%d\n",
+                 region.begin(), region.end(), writable);
     }
 #endif  // V8_OS_WIN
   }
-  is_executable_ = executable;
+  is_writable_ = writable;
   return true;
 }
 
@@ -1691,11 +1699,23 @@ void WasmCodeManager::Commit(base::AddressRegion region) {
       break;
     }
   }
-  PageAllocator::Permission permission = FLAG_wasm_write_protect_code_memory
-                                             ? PageAllocator::kReadWrite
-                                             : PageAllocator::kReadWriteExecute;
-
-  TRACE_HEAP("Setting rw permissions for 0x%" PRIxPTR ":0x%" PRIxPTR "\n",
+  // Even when we employ W^X with FLAG_wasm_write_protect_code_memory == true,
+  // code pages need to be initially allocated with RWX permission because of
+  // concurrent compilation/execution. For this reason there is no distinction
+  // here based on FLAG_wasm_write_protect_code_memory.
+  // TODO(dlehmann): This allocates initially as writable and executable, and
+  // as such is not safe-by-default. In particular, if
+  // {WasmCodeAllocator::SetWritable(false)} is never called afterwards (e.g.,
+  // because no {NativeModuleModificationScope} is created), the writable
+  // permission is never withdrawn.
+  // One potential fix is to allocate initially with kReadExecute only, which
+  // forces all compilation threads to add the missing
+  // {NativeModuleModificationScope}s before modification; and/or adding
+  // DCHECKs that {NativeModuleModificationScope} is open when calling this
+  // method.
+  PageAllocator::Permission permission = PageAllocator::kReadWriteExecute;
+
+  TRACE_HEAP("Setting rwx permissions for 0x%" PRIxPTR ":0x%" PRIxPTR "\n",
              region.begin(), region.end());
 
   if (!SetPermissions(GetPlatformPageAllocator(), region.begin(), region.size(),
@@ -2185,7 +2205,7 @@ NativeModuleModificationScope::NativeModuleModificationScope(
     : native_module_(native_module) {
   if (FLAG_wasm_write_protect_code_memory && native_module_ &&
       (native_module_->modification_scope_depth_++) == 0) {
-    bool success = native_module_->SetExecutable(false);
+    bool success = native_module_->SetWritable(true);
     CHECK(success);
   }
 }
@@ -2193,7 +2213,7 @@ NativeModuleModificationScope::NativeModuleModificationScope(
 NativeModuleModificationScope::~NativeModuleModificationScope() {
   if (FLAG_wasm_write_protect_code_memory && native_module_ &&
       (native_module_->modification_scope_depth_--) == 1) {
-    bool success = native_module_->SetExecutable(true);
+    bool success = native_module_->SetWritable(false);
     CHECK(success);
   }
 }

src/wasm/wasm-code-manager.h

@@ -424,10 +424,10 @@ class WasmCodeAllocator {
   Vector<byte> AllocateForCodeInRegion(NativeModule*, size_t size,
                                        base::AddressRegion);
 
-  // Sets permissions of all owned code space to executable, or read-write (if
-  // {executable} is false). Returns true on success.
+  // Sets permissions of all owned code space to read-write or read-only (if
+  // {writable} is false). Returns true on success.
   // Hold the {NativeModule}'s {allocation_mutex_} when calling this method.
-  V8_EXPORT_PRIVATE bool SetExecutable(bool executable);
+  V8_EXPORT_PRIVATE bool SetWritable(bool writable);
 
   // Free memory pages of all given code objects. Used for wasm code GC.
   // Hold the {NativeModule}'s {allocation_mutex_} when calling this method.
@@ -466,7 +466,7 @@ class WasmCodeAllocator {
   std::atomic<size_t> generated_code_size_{0};
   std::atomic<size_t> freed_code_size_{0};
 
-  bool is_executable_ = false;
+  bool is_writable_ = false;
 
   std::shared_ptr<Counters> async_counters_;
 };
@@ -575,9 +575,9 @@ class V8_EXPORT_PRIVATE NativeModule final {
   // to a function index.
   uint32_t GetFunctionIndexFromJumpTableSlot(Address slot_address) const;
 
-  bool SetExecutable(bool executable) {
+  bool SetWritable(bool writable) {
     base::MutexGuard guard{&allocation_mutex_};
-    return code_allocator_.SetExecutable(executable);
+    return code_allocator_.SetWritable(writable);
   }
 
   // For cctests, where we build both WasmModule and the runtime objects

test/cctest/wasm/test-c-wasm-entry.cc

@@ -60,7 +60,6 @@ class CWasmEntryArgTester {
     WriteToBuffer(&packer, args...);
     Address wasm_call_target = wasm_code_->instruction_start();
     Handle<Object> object_ref = runner_.builder().instance_object();
-    wasm_code_->native_module()->SetExecutable(true);
     Execution::CallWasm(isolate_, c_wasm_entry_, wasm_call_target, object_ref,
                         packer.argv());
     CHECK(!isolate_->has_pending_exception());

test/cctest/wasm/wasm-run-utils.cc

@@ -164,7 +164,6 @@ void TestingModuleBuilder::FreezeSignatureMapAndInitializeWrapperCache() {
 Handle<JSFunction> TestingModuleBuilder::WrapCode(uint32_t index) {
   CHECK(!interpreter_);
   FreezeSignatureMapAndInitializeWrapperCache();
-  SetExecutable();
   return WasmInstanceObject::GetOrCreateWasmExternalFunction(
       isolate_, instance_object(), index);
 }

test/cctest/wasm/wasm-run-utils.h

@@ -231,8 +231,6 @@ class TestingModuleBuilder {
     return reinterpret_cast<Address>(globals_data_);
   }
 
-  void SetExecutable() { native_module_->SetExecutable(true); }
-
   void SetTieredDown() {
     native_module_->SetTieringState(kTieredDown);
     execution_tier_ = TestExecutionTier::kLiftoff;
@@ -583,7 +581,6 @@ class WasmRunner : public WasmRunnerBase {
 
     wrapper_.SetInnerCode(builder_.GetFunctionCode(main_fn_index_));
     wrapper_.SetInstance(builder_.instance_object());
-    builder_.SetExecutable();
     Handle<Code> wrapper_code = wrapper_.GetWrapperCode();
     compiler::CodeRunner<int32_t> runner(CcTest::InitIsolateOnce(),
                                          wrapper_code, wrapper_.signature());