Kernel+LibC: Make page fault crashes a bit more readable.

We'll now try to detect crashes that were due to dereferencing nullptr,
uninitialized malloc() memory, or recently free()'d memory.
It's not perfect but I think it's pretty good. :^)

Also added some color to the most important parts of the crash log,
and added some more modes to /bin/crash for exercising this code.

Fixes #243.

AK/Types.h

@@ -53,3 +53,13 @@ constexpr unsigned GB = KB * KB * KB;
 namespace std {
 typedef decltype(nullptr) nullptr_t;
 }
+
+static constexpr dword explode_byte(byte b)
+{
+    return b << 24 | b << 16 | b << 8 | b;
+}
+
+static_assert(explode_byte(0xff) == 0xffffffff);
+static_assert(explode_byte(0x80) == 0x80808080);
+static_assert(explode_byte(0x7f) == 0x7f7f7f7f);
+static_assert(explode_byte(0) == 0);

Kernel/Arch/i386/CPU.cpp

@@ -7,6 +7,7 @@
 #include <Kernel/Arch/i386/CPU.h>
 #include <Kernel/KSyms.h>
 #include <Kernel/VM/MemoryManager.h>
+#include <LibC/mallocdefs.h>
 
 //#define PAGE_FAULT_DEBUG
 
@@ -254,9 +255,9 @@ void exception_14_handler(RegisterDumpWithExceptionCode& regs)
 {
     ASSERT(current);
 
-    dword faultAddress;
+    dword fault_address;
     asm("movl %%cr2, %%eax"
-        : "=a"(faultAddress));
+        : "=a"(fault_address));
 
     dword fault_page_directory;
     asm("movl %%cr3, %%eax"
@@ -270,22 +271,33 @@ void exception_14_handler(RegisterDumpWithExceptionCode& regs)
         regs.exception_code & 1 ? "PV" : "NP",
         fault_page_directory,
         regs.exception_code & 2 ? "write" : "read",
-        faultAddress);
+        fault_address);
 #endif
 
 #ifdef PAGE_FAULT_DEBUG
     dump(regs);
 #endif
 
-    auto response = MM.handle_page_fault(PageFault(regs.exception_code, VirtualAddress(faultAddress)));
+    auto response = MM.handle_page_fault(PageFault(regs.exception_code, VirtualAddress(fault_address)));
 
     if (response == PageFaultResponse::ShouldCrash) {
-        kprintf("%s(%u:%u) unrecoverable page fault, %s vaddr=%p\n",
+        dbgprintf("\033[31;1m%s(%u:%u) Unrecoverable page fault, %s address %p\033[0m\n",
             current->process().name().characters(),
             current->pid(),
             current->tid(),
-            regs.exception_code & 2 ? "write" : "read",
-            faultAddress);
+            regs.exception_code & 2 ? "write to" : "read from",
+            fault_address);
+
+        dword malloc_scrub_pattern = explode_byte(MALLOC_SCRUB_BYTE);
+        dword free_scrub_pattern = explode_byte(FREE_SCRUB_BYTE);
+        if ((fault_address & 0xffff0000) == (malloc_scrub_pattern & 0xffff0000)) {
+            dbgprintf("\033[33;1mNote: Address %p looks like it may be uninitialized malloc() memory\033[0m\n", fault_address);
+        } else if ((fault_address & 0xffff0000) == (free_scrub_pattern & 0xffff0000)) {
+            dbgprintf("\033[33;1mNote: Address %p looks like it may be recently free()'d memory\033[0m\n", fault_address);
+        } else if (fault_address < 4096) {
+            dbgprintf("\033[33;1mNote: Address %p looks like a possible nullptr dereference\033[0m\n", fault_address);
+        }
+
         dump(regs);
         current->process().crash(SIGSEGV, regs.eip);
     } else if (response == PageFaultResponse::Continue) {

LibC/malloc.cpp

@@ -2,6 +2,7 @@
 #include <AK/InlineLinkedList.h>
 #include <AK/Vector.h>
 #include <assert.h>
+#include <mallocdefs.h>
 #include <serenity.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -12,8 +13,6 @@
 //#define MALLOC_DEBUG
 #define RECYCLE_BIG_ALLOCATIONS
 
-#define MALLOC_SCRUB_BYTE 0x85
-#define FREE_SCRUB_BYTE 0x82
 #define MAGIC_PAGE_HEADER 0x42657274
 #define MAGIC_BIGALLOC_HEADER 0x42697267
 #define PAGE_ROUND_UP(x) ((((size_t)(x)) + PAGE_SIZE - 1) & (~(PAGE_SIZE - 1)))

LibC/mallocdefs.h

@@ -0,0 +1,5 @@
+#pragma once
+
+#define MALLOC_SCRUB_BYTE 0xdc
+#define FREE_SCRUB_BYTE 0xed
+

Userland/crash.cpp

@@ -4,17 +4,22 @@
 
 static void print_usage_and_exit()
 {
-    printf("usage: crash -[sdia]\n");
+    printf("usage: crash -[sdiamfMF]\n");
     exit(0);
 }
 
+#pragma GCC optimize("O0")
 int main(int argc, char** argv)
 {
     enum Mode {
         SegmentationViolation,
         DivisionByZero,
         IllegalInstruction,
-        Abort
+        Abort,
+        WriteToUninitializedMallocMemory,
+        WriteToFreedMemory,
+        ReadFromUninitializedMallocMemory,
+        ReadFromFreedMemory,
     };
     Mode mode = SegmentationViolation;
 
@@ -29,6 +34,14 @@ int main(int argc, char** argv)
         mode = IllegalInstruction;
     else if (String(argv[1]) == "-a")
         mode = Abort;
+    else if (String(argv[1]) == "-m")
+        mode = ReadFromUninitializedMallocMemory;
+    else if (String(argv[1]) == "-f")
+        mode = ReadFromFreedMemory;
+    else if (String(argv[1]) == "-M")
+        mode = WriteToUninitializedMallocMemory;
+    else if (String(argv[1]) == "-F")
+        mode = WriteToFreedMemory;
     else
         print_usage_and_exit();
 
@@ -55,6 +68,32 @@ int main(int argc, char** argv)
         ASSERT_NOT_REACHED();
     }
 
+    if (mode == ReadFromUninitializedMallocMemory) {
+        auto* uninitialized_memory = (volatile dword**)malloc(1024);
+        volatile auto x = uninitialized_memory[0][0];
+        ASSERT_NOT_REACHED();
+    }
+
+    if (mode == ReadFromFreedMemory) {
+        auto* uninitialized_memory = (volatile dword**)malloc(1024);
+        free(uninitialized_memory);
+        volatile auto x = uninitialized_memory[4][0];
+        ASSERT_NOT_REACHED();
+    }
+
+    if (mode == WriteToUninitializedMallocMemory) {
+        auto* uninitialized_memory = (volatile dword**)malloc(1024);
+        uninitialized_memory[4][0] = 1;
+        ASSERT_NOT_REACHED();
+    }
+
+    if (mode == WriteToFreedMemory) {
+        auto* uninitialized_memory = (volatile dword**)malloc(1024);
+        free(uninitialized_memory);
+        uninitialized_memory[4][0] = 1;
+        ASSERT_NOT_REACHED();
+    }
+
     ASSERT_NOT_REACHED();
     return 0;
 }