Commit ca5a4ed9 authored by Michael Achenbach's avatar Michael Achenbach Committed by Commit Bot

Revert "[zone] Teach ASan about the zone segment pool"

This reverts commit b2f8280e.

Reason for revert:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/25509

Original change's description:
> [zone] Teach ASan about the zone segment pool
> 
> This adds proper poisoning/unpoisoning to segments put into the segment
> pool of an accounting allocator, and also marks a segment uninitialized
> when returning it from the pool. This gives ASan a better chance at
> catching use-after-free and others.
> 
> Drive-by: Fix type check in ASAN_POISON_MEMORY_REGION
> 
> R=​mstarzinger@chromium.org
> 
> Change-Id: Iadbdd7c0a0c80da8e7b9bb8f3399209715436073
> Reviewed-on: https://chromium-review.googlesource.com/c/1489086
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59932}

TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: Iacf322d04822382ea8e1f5abe1d5e72758adc399
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1493055Reviewed-by: 's avatarMichael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59934}
parent cce33f37
...@@ -17,7 +17,9 @@ ...@@ -17,7 +17,9 @@
#else // !V8_USE_ADDRESS_SANITIZER #else // !V8_USE_ADDRESS_SANITIZER
#define ASAN_POISON_MEMORY_REGION(start, size) \ #define ASAN_POISON_MEMORY_REGION(start, size) \
static_assert(std::is_pointer<decltype(start)>::value && \ static_assert( \
(std::is_pointer<decltype(start)>::value || \
std::is_same<v8::internal::Address, decltype(start)>::value) && \
std::is_convertible<decltype(size), size_t>::value, \ std::is_convertible<decltype(size), size_t>::value, \
"static type violation") "static type violation")
#define ASAN_UNPOISON_MEMORY_REGION(start, size) \ #define ASAN_UNPOISON_MEMORY_REGION(start, size) \
......
...@@ -11,8 +11,6 @@ ...@@ -11,8 +11,6 @@
#endif #endif
#include "src/allocation.h" #include "src/allocation.h"
#include "src/asan.h"
#include "src/msan.h"
namespace v8 { namespace v8 {
namespace internal { namespace internal {
...@@ -126,24 +124,23 @@ Segment* AccountingAllocator::GetSegmentFromPool(size_t requested_size) { ...@@ -126,24 +124,23 @@ Segment* AccountingAllocator::GetSegmentFromPool(size_t requested_size) {
power -= kMinSegmentSizePower; power -= kMinSegmentSizePower;
Segment* segment; Segment* segment;
{ {
base::MutexGuard lock_guard(&unused_segments_mutex_); base::MutexGuard lock_guard(&unused_segments_mutex_);
segment = unused_segments_heads_[power]; segment = unused_segments_heads_[power];
if (segment == nullptr) return nullptr;
if (segment != nullptr) {
unused_segments_heads_[power] = segment->next(); unused_segments_heads_[power] = segment->next();
segment->set_next(nullptr); segment->set_next(nullptr);
unused_segments_sizes_[power]--; unused_segments_sizes_[power]--;
current_pool_size_.fetch_sub(segment->size(), std::memory_order_relaxed);
}
} }
current_pool_size_.fetch_sub(segment->size(), std::memory_order_relaxed); if (segment) {
ASAN_UNPOISON_MEMORY_REGION(reinterpret_cast<void*>(segment->start()),
segment->size());
MSAN_ALLOCATED_UNINITIALIZED_MEMORY(segment->start(), segment->size());
DCHECK_GE(segment->size(), requested_size); DCHECK_GE(segment->size(), requested_size);
}
return segment; return segment;
} }
...@@ -170,15 +167,10 @@ bool AccountingAllocator::AddSegmentToPool(Segment* segment) { ...@@ -170,15 +167,10 @@ bool AccountingAllocator::AddSegmentToPool(Segment* segment) {
segment->set_next(unused_segments_heads_[power]); segment->set_next(unused_segments_heads_[power]);
unused_segments_heads_[power] = segment; unused_segments_heads_[power] = segment;
current_pool_size_.fetch_add(size, std::memory_order_relaxed);
unused_segments_sizes_[power]++; unused_segments_sizes_[power]++;
// Poisoning needs to happen while still holding the mutex to guarantee that
// it happens before the segment is taken from the pool again.
ASAN_POISON_MEMORY_REGION(reinterpret_cast<void*>(segment->start()),
segment->size());
} }
current_pool_size_.fetch_add(size, std::memory_order_relaxed);
return true; return true;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment