1
    2
    3
    4
    5
    6
    7
    8
    9
   10
   11
   12
   13
   14
   15
   16
   17
   18
   19
   20
   21
   22
   23
   24
   25
   26
   27
   28
   29
   30
   31
   32
   33
   34
   35
   36
   37
   38
   39
   40
   41
   42
   43
   44
   45
   46
   47
   48
   49
   50
   51
   52
   53
   54
   55
   56
   57
   58
   59
   60
   61
   62
   63
   64
   65
   66
   67
   68
   69
   70
   71
   72
   73
   74
   75
   76
   77
   78
   79
   80
   81
   82
   83
   84
   85
   86
   87
   88
   89
   90
   91
   92
   93
   94
   95
   96
   97
   98
   99
  100
  101
  102
  103
  104
  105
  106
  107
  108
  109
  110
  111
  112
  113
  114
  115
  116
  117
  118
  119
  120
  121
  122
  123


base / memory / raw_ptr_asan_bound_arg_tracker.h [blame]

// Copyright 2022 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef BASE_MEMORY_RAW_PTR_ASAN_BOUND_ARG_TRACKER_H_
#define BASE_MEMORY_RAW_PTR_ASAN_BOUND_ARG_TRACKER_H_

#include "partition_alloc/buildflags.h"

#if PA_BUILDFLAG(USE_ASAN_BACKUP_REF_PTR)
#include <cstddef>
#include <cstdint>
#include <memory>
#include <vector>

#include "base/base_export.h"
#include "base/memory/raw_ptr.h"
#include "third_party/abseil-cpp/absl/container/inlined_vector.h"

namespace base {
namespace internal {
template <typename, typename, typename>
struct Invoker;

template <typename T, typename UnretainedTrait, RawPtrTraits PtrTraits>
class UnretainedWrapper;

template <typename T, typename UnretainedTrait, RawPtrTraits PtrTraits>
class UnretainedRefWrapper;
}  // namespace internal

// Tracks the lifetimes of bound pointer arguments during callback invocation.
//
// Example:
//   T* unsafe_ptr = new T();
//   PostTask(base::BindOnce(&T::DoSomething, base::Unretained(unsafe_ptr)));
//   delete unsafe_ptr;
//
// When the callback executes, the callee has no access to the raw_ptr<T> inside
// base::Unretained, so it is not possible for it to be invalidated until the
// callback finishes execution; so there is always at least one live raw_ptr<T>
// pointing to `this` for the duration of the call to T::DoSomething.
//
// This class is responsible for tracking and checking which allocations are
// currently protected in this way, and it is only intended to be used inside
// the Bind implementation. This should not be used directly.
class BASE_EXPORT RawPtrAsanBoundArgTracker {
 public:
  static constexpr size_t kInlineArgsCount = 3;
  using ProtectedArgsVector = absl::InlinedVector<uintptr_t, kInlineArgsCount>;

  // Check whether ptr is an address inside an allocation pointed to by one of
  // the currently protected callback arguments. If it is, then this function
  // returns the base address of that allocation, otherwise it returns 0.
  static uintptr_t GetProtectedArgPtr(uintptr_t ptr);

 private:
  template <typename, typename, typename>
  friend struct internal::Invoker;

  void Add(uintptr_t pointer);

  RawPtrAsanBoundArgTracker();
  ~RawPtrAsanBoundArgTracker();

  // Base case for any type that isn't base::Unretained, we do nothing.
  template <typename T>
  void AddArg(const T& arg) {}

  // No specialization for raw_ptr<T> directly, since bound raw_ptr<T>
  // arguments are stored in UnretainedWrapper.

  // When argument is base::Unretained, add the argument to the set of
  // arguments protected in this scope.
  template <typename T, typename UnretainedTrait, RawPtrTraits PtrTraits>
  void AddArg(
      const internal::UnretainedWrapper<T, UnretainedTrait, PtrTraits>& arg) {
    if constexpr (raw_ptr_traits::IsSupportedType<T>::value) {
      auto inner = arg.get();
      // The argument may unwrap into a raw_ptr or a T* depending if it is
      // allowed to dangle.
      if constexpr (IsRawPtr<decltype(inner)>) {
        Add(reinterpret_cast<uintptr_t>(inner.get()));
      } else {
        Add(reinterpret_cast<uintptr_t>(inner));
      }
    }
  }

  // When argument is a reference type that's supported by raw_ptr, add the
  // argument to the set of arguments protected in this scope.
  template <typename T, typename UnretainedTrait, RawPtrTraits PtrTraits>
  void AddArg(
      const internal::UnretainedRefWrapper<T, UnretainedTrait, PtrTraits>&
          arg) {
    if constexpr (raw_ptr_traits::IsSupportedType<T>::value) {
      Add(reinterpret_cast<uintptr_t>(&arg.get()));
    }
  }

  template <typename... Args>
  void AddArgs(Args&&... args) {
    if (enabled_) {
      (AddArg(std::forward<Args>(args)), ...);
    }
  }

  // Cache whether or not BRP-ASan is running when we enter the argument
  // tracking scope so that we ensure that our actions on leaving the scope are
  // consistent even if the runtime flags are changed.
  bool enabled_;

  // We save the previously bound arguments, so that we can restore them when
  // this callback returns. This helps with coverage while avoiding false
  // positives due to nested run loops/callback re-entrancy.
  raw_ptr<ProtectedArgsVector> prev_protected_args_;
  ProtectedArgsVector protected_args_;
};

}  // namespace base

#endif  // PA_BUILDFLAG(USE_ASAN_BACKUP_REF_PTR)
#endif  // BASE_MEMORY_RAW_PTR_ASAN_BOUND_ARG_TRACKER_H_