Skip to content

[embedded] Resolve ptrauth crashes by signing HeapObjects's isa pointers in embedded Swift #71076

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jan 23, 2024
Merged

[embedded] Resolve ptrauth crashes by signing HeapObjects's isa pointers in embedded Swift #71076

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions stdlib/public/SwiftShims/swift/shims/EmbeddedShims.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,16 +43,29 @@ extern "C" {

typedef void SWIFT_CC_swift (*HeapObjectDestroyer)(SWIFT_CONTEXT void *object);

static inline void _swift_embedded_invoke_heap_object_destroy(void *object) {
void *metadata = *(void **)object;
typedef struct EmbeddedHeapObject {
#if __has_feature(ptrauth_calls)
void * __ptrauth(2, 1, 0x6ae1) metadata;
#else
void *metadata;
#endif
} EmbeddedHeapObject;

static inline void
_swift_embedded_invoke_heap_object_destroy(void *object) {
void *metadata = ((EmbeddedHeapObject *)object)->metadata;
void **destroy_location = &((void **)metadata)[1];
#if __has_feature(ptrauth_calls)
(*(HeapObjectDestroyer __ptrauth(0,1,0xbbbf) *)destroy_location)(object);
(*(HeapObjectDestroyer __ptrauth(0, 1, 0xbbbf) *)destroy_location)(object);
#else
(*(HeapObjectDestroyer *)destroy_location)(object);
#endif
}

static inline void _swift_embedded_set_heap_object_metadata_pointer(void *object, void *metadata) {
((EmbeddedHeapObject *)object)->metadata = metadata;
}

#ifdef __cplusplus
} // extern "C"
#endif
Expand Down
13 changes: 8 additions & 5 deletions stdlib/public/core/EmbeddedRuntime.swift
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,15 @@ public struct ClassMetadata {

// There is no way to express the actual calling convention on the heap desroy
// function (swiftcc with 'self') currently, so let's use UnsafeRawPointer
// and a helper function in C (_swift_runtime_invoke_heap_object_destroy).
// and a helper function in C (_swift_embedded_invoke_heap_object_destroy).
var destroy: UnsafeRawPointer
}

public struct HeapObject {
var metadata: UnsafeMutablePointer<ClassMetadata>
// There is no way to express the custom ptrauth signature on the metadata
// field, so let's use UnsafeRawPointer and a helper function in C instead
// (_swift_embedded_set_heap_object_metadata_pointer).
var metadata: UnsafeRawPointer

// TODO: This is just an initial support for strong refcounting only. We need
// to think about supporting (or banning) weak and/or unowned references.
Expand Down Expand Up @@ -82,7 +85,7 @@ public func swift_slowDealloc(_ ptr: UnsafeMutableRawPointer, _ size: Int, _ ali
public func swift_allocObject(metadata: UnsafeMutablePointer<ClassMetadata>, requiredSize: Int, requiredAlignmentMask: Int) -> UnsafeMutablePointer<HeapObject> {
let p = swift_slowAlloc(requiredSize, requiredAlignmentMask)!
let object = p.assumingMemoryBound(to: HeapObject.self)
object.pointee.metadata = metadata
_swift_embedded_set_heap_object_metadata_pointer(object, metadata)
object.pointee.refcount = 1
return object
}
Expand All @@ -103,14 +106,14 @@ public func swift_deallocClassInstance(object: UnsafeMutablePointer<HeapObject>,

@_silgen_name("swift_initStaticObject")
public func swift_initStaticObject(metadata: UnsafeMutablePointer<ClassMetadata>, object: UnsafeMutablePointer<HeapObject>) -> UnsafeMutablePointer<HeapObject> {
object.pointee.metadata = metadata
_swift_embedded_set_heap_object_metadata_pointer(object, metadata)
object.pointee.refcount = HeapObject.immortalRefCount
return object
}

@_silgen_name("swift_initStackObject")
public func swift_initStackObject(metadata: UnsafeMutablePointer<ClassMetadata>, object: UnsafeMutablePointer<HeapObject>) -> UnsafeMutablePointer<HeapObject> {
object.pointee.metadata = metadata
_swift_embedded_set_heap_object_metadata_pointer(object, metadata)
object.pointee.refcount = 1 | HeapObject.doNotFreeBit
return object
}
Expand Down