TCMalloc: support userland ASLR on Linux

base/security_unittest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include <fcntl.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/stat.h>
+#include <sys/types.h>
 
 #include <algorithm>
 #include <limits>
 
 #include "base/logging.h"
 #include "base/memory/scoped_ptr.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using std::nothrow;
 using std::numeric_limits;
@@ skipping 167 matching lines @@
   {
     scoped_ptr<char> array_pointer(
         static_cast<char*>(calloc(kArraySize2, kArraySize)));
     // We need the call to HideValueFromCompiler(): we have seen LLVM
     // optimize away the call to calloc() entirely and assume
     // the pointer to not be NULL.
     EXPECT_TRUE(HideValueFromCompiler(array_pointer.get()) == NULL);
   }
 }
 
+#if (defined(OS_LINUX) || defined(OS_CHROMEOS)) && defined(__x86_64__)
+// Useful for debugging.
+void PrintProcSelfMaps() {
+  int fd = open("/proc/self/maps", O_RDONLY);
+  ASSERT_GE(fd, 0);
+  char buffer[1<<13];
+  int ret;
+  ret = read(fd, buffer, sizeof(buffer) - 1);
+  ASSERT_GT(ret, 0);
+  buffer[ret - 1] = 0;
+  fprintf(stdout, "%s\n", buffer);

[Marius, 2013/01/29 06:45:21]

close(fd)?

[jln (very slow on Chromium), 2013/01/29 07:02:16]

Arg. Thanks. Done.

+}
+
+// Check if TCMalloc uses an underlying random memory allocator.
+TEST(SecurityTest, ALLOC_TEST(RandomMemoryAllocations)) {
+  if (IsTcMallocBypassed())
+    return;
+  // Two successive calls to mmap() have roughly one chance out of 2^7 to be

[Marius, 2013/01/29 06:45:21]

With the 0x6f mask, there's only 6 bits of random there, no?

[jln (very slow on Chromium), 2013/01/29 07:02:16]

This had been patched in a previous revision already :)

+  // detected as having the same order. With 32 allocations, we see ~16 that
+  // trigger a call to mmap, so the chances of this test flaking is roughly
+  // 2^-(7*15), i.e. virtually impossible.
+  const int kAllocNumber = 32;
+  bool is_contiguous = true;
+  // Make kAllocNumber successive allocations of growing size and compare the
+  // successive pointers to detect adjacent mappings. We grow the size because
+  // TCMalloc can sometimes over-allocate.
+  scoped_ptr<char, base::FreeDeleter> ptr[kAllocNumber];
+  for (int i = 0; i < kAllocNumber; ++i) {
+    // Grow the Malloc size slightly sub-exponentially.
+    const size_t kMallocSize = 1 << (12 + (i>>1));
+    ptr[i].reset(static_cast<char*>(malloc(kMallocSize)));
+    ASSERT_TRUE(ptr[i] != NULL);
+    if (i > 0) {
+      // Without mmap randomization, the two high order nibbles
+      // of a 47 bits userland address address will be identical.
+      const size_t kHighOrderMask = 0xff0000000000;
+      bool pointer_have_same_high_order =
+          (reinterpret_cast<size_t>(ptr[i].get()) & kHighOrderMask) ==
+          (reinterpret_cast<size_t>(ptr[i - 1].get()) & kHighOrderMask);
+      if (!pointer_have_same_high_order) {
+        // PrintProcSelfMaps();
+        is_contiguous = false;
+        break;
+      }
+    }
+  }
+  ASSERT_FALSE(is_contiguous);
+}
+
+#endif  // (defined(OS_LINUX) || defined(OS_CHROMEOS)) && defined(__x86_64__)
+
 }  // namespace