grpc 1.80.0 → 1.81.0

data/third_party/upb/upb/mem/internal/arena.h

@@ -12,6 +12,8 @@
 #include <stdint.h>
 #include <string.h>
 
+#include "upb/port/sanitizers.h"
+
 // Must be last.
 #include "upb/port/def.inc"
 
@@ -20,13 +22,21 @@
 //
 // We need this because the decoder inlines a upb_Arena for performance but
 // the full struct is not visible outside of arena.c. Yes, I know, it's awful.
-#define UPB_ARENA_SIZE_HACK (9 + UPB_TSAN_PUBLISH)
+#ifndef NDEBUG
+#define UPB_ARENA_BASE_SIZE_HACK 11
+#else
+#define UPB_ARENA_BASE_SIZE_HACK 10
+#endif
+
+#define UPB_ARENA_SIZE_HACK \
+  (UPB_ARENA_BASE_SIZE_HACK + (UPB_XSAN_STRUCT_SIZE * 2))
 
 // LINT.IfChange(upb_Arena)
 
 struct upb_Arena {
   char* UPB_ONLYBITS(ptr);
-  char* UPB_ONLYBITS(end);
+  const UPB_NODEREF char* UPB_ONLYBITS(end);
+  UPB_XSAN_MEMBER
 };
 
 // LINT.ThenChange(//depot/google3/third_party/upb/bits/typescript/arena.ts:upb_Arena)
@@ -44,102 +54,105 @@ UPB_INLINE size_t UPB_PRIVATE(_upb_ArenaHas)(const struct upb_Arena* a) {
   return (size_t)(a->UPB_ONLYBITS(end) - a->UPB_ONLYBITS(ptr));
 }
 
+UPB_INLINE size_t UPB_PRIVATE(_upb_Arena_AllocSpan)(size_t size) {
+  return UPB_ALIGN_MALLOC(size) + UPB_PRIVATE(kUpb_Asan_GuardSize);
+}
+
+UPB_INLINE bool UPB_PRIVATE(_upb_Arena_WasLastAllocFromCurrentBlock)(
+    const struct upb_Arena* a, void* ptr, size_t size) {
+  return UPB_PRIVATE(upb_Xsan_PtrEq)(
+      (char*)ptr + UPB_PRIVATE(_upb_Arena_AllocSpan)(size),
+      a->UPB_ONLYBITS(ptr));
+}
+
+UPB_INLINE bool UPB_PRIVATE(_upb_Arena_IsAligned)(const void* ptr) {
+  return (uintptr_t)ptr % UPB_MALLOC_ALIGN == 0;
+}
+
 UPB_API_INLINE void* upb_Arena_Malloc(struct upb_Arena* a, size_t size) {
-  UPB_TSAN_CHECK_WRITE(a->UPB_ONLYBITS(ptr));
-  void* UPB_PRIVATE(_upb_Arena_SlowMalloc)(struct upb_Arena * a, size_t size);
+  UPB_PRIVATE(upb_Xsan_AccessReadWrite)(UPB_XSAN(a));
+
+  size_t span = UPB_PRIVATE(_upb_Arena_AllocSpan)(size);
 
-  size = UPB_ALIGN_MALLOC(size);
-  const size_t span = size + UPB_ASAN_GUARD_SIZE;
   if (UPB_UNLIKELY(UPB_PRIVATE(_upb_ArenaHas)(a) < span)) {
+    void* UPB_PRIVATE(_upb_Arena_SlowMalloc)(struct upb_Arena * a, size_t size);
     return UPB_PRIVATE(_upb_Arena_SlowMalloc)(a, span);
   }
 
   // We have enough space to do a fast malloc.
   void* ret = a->UPB_ONLYBITS(ptr);
-  UPB_ASSERT(UPB_ALIGN_MALLOC((uintptr_t)ret) == (uintptr_t)ret);
-  UPB_ASSERT(UPB_ALIGN_MALLOC(size) == size);
-  UPB_UNPOISON_MEMORY_REGION(ret, size);
-
   a->UPB_ONLYBITS(ptr) += span;
+  UPB_ASSERT(UPB_PRIVATE(_upb_Arena_IsAligned)(ret));
+  UPB_ASSERT(UPB_PRIVATE(_upb_Arena_IsAligned)(a->UPB_ONLYBITS(ptr)));
 
-  return ret;
+  return UPB_PRIVATE(upb_Xsan_NewUnpoisonedRegion)(UPB_XSAN(a), ret, size);
 }
 
 UPB_API_INLINE void upb_Arena_ShrinkLast(struct upb_Arena* a, void* ptr,
                                          size_t oldsize, size_t size) {
-  UPB_TSAN_CHECK_WRITE(a->UPB_ONLYBITS(ptr));
   UPB_ASSERT(ptr);
   UPB_ASSERT(size <= oldsize);
-  size = UPB_ALIGN_MALLOC(size) + UPB_ASAN_GUARD_SIZE;
-  oldsize = UPB_ALIGN_MALLOC(oldsize) + UPB_ASAN_GUARD_SIZE;
-  if (size == oldsize) {
-    return;
-  }
-  char* arena_ptr = a->UPB_ONLYBITS(ptr);
-  // If it's the last alloc in the last block, we can resize.
-  if ((char*)ptr + oldsize == arena_ptr) {
-    a->UPB_ONLYBITS(ptr) = (char*)ptr + size;
+
+  UPB_PRIVATE(upb_Xsan_AccessReadWrite)(UPB_XSAN(a));
+  UPB_PRIVATE(upb_Xsan_ResizeUnpoisonedRegion)(ptr, oldsize, size);
+
+  if (UPB_PRIVATE(_upb_Arena_WasLastAllocFromCurrentBlock)(a, ptr, oldsize)) {
+    // We can reclaim some memory.
+    a->UPB_ONLYBITS(ptr) -= UPB_ALIGN_MALLOC(oldsize) - UPB_ALIGN_MALLOC(size);
   } else {
-    // If not, verify that it could have been a full-block alloc that did not
-    // replace the last block.
+    // We can't reclaim any memory, but we need to verify that `ptr` really
+    // does represent the most recent allocation.
 #ifndef NDEBUG
     bool _upb_Arena_WasLastAlloc(struct upb_Arena * a, void* ptr,
                                  size_t oldsize);
     UPB_ASSERT(_upb_Arena_WasLastAlloc(a, ptr, oldsize));
 #endif
   }
-  UPB_POISON_MEMORY_REGION((char*)ptr + (size - UPB_ASAN_GUARD_SIZE),
-                           oldsize - size);
 }
 
 UPB_API_INLINE bool upb_Arena_TryExtend(struct upb_Arena* a, void* ptr,
                                         size_t oldsize, size_t size) {
-  UPB_TSAN_CHECK_WRITE(a->UPB_ONLYBITS(ptr));
   UPB_ASSERT(ptr);
   UPB_ASSERT(size > oldsize);
-  size = UPB_ALIGN_MALLOC(size) + UPB_ASAN_GUARD_SIZE;
-  oldsize = UPB_ALIGN_MALLOC(oldsize) + UPB_ASAN_GUARD_SIZE;
-  if (size == oldsize) {
-    return true;
-  }
-  size_t extend = size - oldsize;
-  if ((char*)ptr + oldsize == a->UPB_ONLYBITS(ptr) &&
+
+  UPB_PRIVATE(upb_Xsan_AccessReadWrite)(UPB_XSAN(a));
+  size_t extend = UPB_ALIGN_MALLOC(size) - UPB_ALIGN_MALLOC(oldsize);
+
+  if (UPB_PRIVATE(_upb_Arena_WasLastAllocFromCurrentBlock)(a, ptr, oldsize) &&
       UPB_PRIVATE(_upb_ArenaHas)(a) >= extend) {
     a->UPB_ONLYBITS(ptr) += extend;
-    UPB_UNPOISON_MEMORY_REGION((char*)ptr + (oldsize - UPB_ASAN_GUARD_SIZE),
-                               extend);
+    UPB_PRIVATE(upb_Xsan_ResizeUnpoisonedRegion)(ptr, oldsize, size);
     return true;
   }
+
   return false;
 }
 
 UPB_API_INLINE void* upb_Arena_Realloc(struct upb_Arena* a, void* ptr,
                                        size_t oldsize, size_t size) {
-  UPB_TSAN_CHECK_WRITE(a->UPB_ONLYBITS(ptr));
-  if (ptr) {
-    if (size == oldsize) {
-      return ptr;
+  UPB_PRIVATE(upb_Xsan_AccessReadWrite)(UPB_XSAN(a));
+
+  void* ret;
+
+  if (ptr && (size <= oldsize || upb_Arena_TryExtend(a, ptr, oldsize, size))) {
+    // We can extend or shrink in place.
+    if (size <= oldsize &&
+        UPB_PRIVATE(_upb_Arena_WasLastAllocFromCurrentBlock)(a, ptr, oldsize)) {
+      upb_Arena_ShrinkLast(a, ptr, oldsize, size);
     }
-    if (size > oldsize) {
-      if (upb_Arena_TryExtend(a, ptr, oldsize, size)) return ptr;
-    } else {
-      if ((char*)ptr + (UPB_ALIGN_MALLOC(oldsize) + UPB_ASAN_GUARD_SIZE) ==
-          a->UPB_ONLYBITS(ptr)) {
-        upb_Arena_ShrinkLast(a, ptr, oldsize, size);
-      } else {
-        UPB_POISON_MEMORY_REGION((char*)ptr + size, oldsize - size);
-      }
-      return ptr;
+    ret = ptr;
+  } else {
+    // We need to copy into a new allocation.
+    ret = upb_Arena_Malloc(a, size);
+    if (ret && oldsize > 0) {
+      memcpy(ret, ptr, UPB_MIN(oldsize, size));
     }
   }
-  void* ret = upb_Arena_Malloc(a, size);
-
-  if (ret && oldsize > 0) {
-    memcpy(ret, ptr, UPB_MIN(oldsize, size));
-    UPB_POISON_MEMORY_REGION(ptr, oldsize);
-  }
 
-  return ret;
+  // We want to invalidate pointers to the old region if hwasan is enabled, so
+  // we poison and unpoison even if ptr == ret.
+  UPB_PRIVATE(upb_Xsan_PoisonRegion)(ptr, oldsize);
+  return UPB_PRIVATE(upb_Xsan_NewUnpoisonedRegion)(UPB_XSAN(a), ret, size);
 }
 
 #ifdef __cplusplus

data/third_party/upb/upb/message/accessors.h

@@ -215,6 +215,10 @@ UPB_API_INLINE bool upb_Message_SetExtension(upb_Message* msg,
                                              const upb_MiniTableExtension* e,
                                              const void* value, upb_Arena* a);
 
+UPB_API_INLINE bool upb_Message_SetExtensionMessage(
+    struct upb_Message* msg, const upb_MiniTableExtension* e,
+    struct upb_Message* value, upb_Arena* a);
+
 UPB_API_INLINE bool upb_Message_SetExtensionBool(
     struct upb_Message* msg, const upb_MiniTableExtension* e, bool value,
     upb_Arena* a);

data/third_party/upb/upb/message/array.h

@@ -32,6 +32,9 @@ UPB_API upb_Array* upb_Array_New(upb_Arena* a, upb_CType type);
 // Returns the number of elements in the array.
 UPB_API_INLINE size_t upb_Array_Size(const upb_Array* arr);
 
+// Returns the number of elements in the array.
+UPB_API_INLINE size_t upb_Array_Capacity(const upb_Array* arr);
+
 // Returns the given element, which must be within the array's current size.
 UPB_API upb_MessageValue upb_Array_Get(const upb_Array* arr, size_t i);
 

data/third_party/upb/upb/message/copy.c

@@ -288,7 +288,7 @@ upb_Message* _upb_Message_Copy(upb_Message* dst, const upb_Message* src,
       upb_StringView* unknown = upb_TaggedAuxPtr_UnknownData(tagged_ptr);
       // Make a copy into destination arena.
       if (!UPB_PRIVATE(_upb_Message_AddUnknown)(dst, unknown->data,
-                                                unknown->size, arena, false)) {
+                                                unknown->size, arena, NULL)) {
         return NULL;
       }
     }

data/third_party/upb/upb/message/internal/accessors.h

@@ -688,6 +688,16 @@ UPB_API_INLINE void upb_Message_SetClosedEnum(struct upb_Message* msg,
 
 // Extension Setters ///////////////////////////////////////////////////////////
 
+UPB_API_INLINE bool upb_Message_SetExtensionMessage(
+    struct upb_Message* msg, const upb_MiniTableExtension* e,
+    struct upb_Message* value, upb_Arena* a) {
+  UPB_ASSERT(value);
+  UPB_ASSUME(upb_MiniTableExtension_CType(e) == kUpb_CType_Message);
+  UPB_ASSUME(UPB_PRIVATE(_upb_MiniTableExtension_GetRep)(e) ==
+             UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte));
+  return upb_Message_SetExtension(msg, e, &value, a);
+}
+
 UPB_API_INLINE bool upb_Message_SetExtensionBool(
     struct upb_Message* msg, const upb_MiniTableExtension* e, bool value,
     upb_Arena* a) {

data/third_party/upb/upb/message/internal/array.h

@@ -73,14 +73,16 @@ UPB_API_INLINE void* upb_Array_MutableDataPtr(struct upb_Array* array) {
   return (void*)upb_Array_DataPtr(array);
 }
 
-UPB_INLINE struct upb_Array* UPB_PRIVATE(_upb_Array_New)(upb_Arena* arena,
-                                                         size_t init_capacity,
-                                                         int elem_size_lg2) {
+UPB_INLINE struct upb_Array* UPB_PRIVATE(_upb_Array_NewMaybeAllowSlow)(
+    upb_Arena* arena, size_t init_capacity, int elem_size_lg2,
+    bool allow_slow) {
   UPB_ASSERT(elem_size_lg2 != 1);
   UPB_ASSERT(elem_size_lg2 <= 4);
   const size_t array_size =
       UPB_ALIGN_UP(sizeof(struct upb_Array), UPB_MALLOC_ALIGN);
   const size_t bytes = array_size + (init_capacity << elem_size_lg2);
+  size_t span = UPB_PRIVATE(_upb_Arena_AllocSpan)(bytes);
+  if (!allow_slow && UPB_PRIVATE(_upb_ArenaHas)(arena) < span) return NULL;
   struct upb_Array* array = (struct upb_Array*)upb_Arena_Malloc(arena, bytes);
   if (!array) return NULL;
   UPB_PRIVATE(_upb_Array_SetTaggedPtr)
@@ -90,10 +92,35 @@ UPB_INLINE struct upb_Array* UPB_PRIVATE(_upb_Array_New)(upb_Arena* arena,
   return array;
 }
 
+UPB_INLINE struct upb_Array* UPB_PRIVATE(_upb_Array_New)(upb_Arena* arena,
+                                                         size_t init_capacity,
+                                                         int elem_size_lg2) {
+  return UPB_PRIVATE(_upb_Array_NewMaybeAllowSlow)(arena, init_capacity,
+                                                   elem_size_lg2, true);
+}
+
+UPB_INLINE struct upb_Array* UPB_PRIVATE(_upb_Array_TryFastNew)(
+    upb_Arena* arena, size_t init_capacity, int elem_size_lg2) {
+  return UPB_PRIVATE(_upb_Array_NewMaybeAllowSlow)(arena, init_capacity,
+                                                   elem_size_lg2, false);
+}
+
 // Resizes the capacity of the array to be at least min_size.
 bool UPB_PRIVATE(_upb_Array_Realloc)(struct upb_Array* array, size_t min_size,
                                      upb_Arena* arena);
 
+UPB_FORCEINLINE
+bool UPB_PRIVATE(_upb_Array_TryFastRealloc)(struct upb_Array* array,
+                                            size_t capacity, int elem_size_lg2,
+                                            upb_Arena* arena) {
+  size_t old_bytes = array->UPB_PRIVATE(capacity) << elem_size_lg2;
+  size_t new_bytes = capacity << elem_size_lg2;
+  UPB_ASSUME(new_bytes > old_bytes);
+  if (!upb_Arena_TryExtend(arena, array, old_bytes, new_bytes)) return false;
+  array->UPB_PRIVATE(capacity) = capacity;
+  return true;
+}
+
 UPB_API_INLINE bool upb_Array_Reserve(struct upb_Array* array, size_t size,
                                       upb_Arena* arena) {
   UPB_ASSERT(!upb_Array_IsFrozen(array));
@@ -130,6 +157,10 @@ UPB_API_INLINE size_t upb_Array_Size(const struct upb_Array* arr) {
   return arr->UPB_ONLYBITS(size);
 }
 
+UPB_API_INLINE size_t upb_Array_Capacity(const struct upb_Array* arr) {
+  return arr->UPB_PRIVATE(capacity);
+}
+
 // LINT.ThenChange(GoogleInternalName0)
 
 #ifdef __cplusplus

data/third_party/upb/upb/message/internal/message.h

@@ -24,6 +24,7 @@
 #include "upb/message/internal/extension.h"
 #include "upb/message/internal/types.h"
 #include "upb/mini_table/extension.h"
+#include "upb/mini_table/internal/message.h"
 #include "upb/mini_table/message.h"
 
 // Must be last.
@@ -124,11 +125,15 @@ UPB_API void upb_Message_SetNewMessageTraceHandler(
 // Inline version upb_Message_New(), for internal use.
 UPB_INLINE struct upb_Message* _upb_Message_New(const upb_MiniTable* m,
                                                 upb_Arena* a) {
+  UPB_PRIVATE(upb_MiniTable_CheckInvariants)(m);
 #ifdef UPB_TRACING_ENABLED
   upb_Message_LogNewMessage(m, a);
 #endif  // UPB_TRACING_ENABLED
 
-  const int size = m->UPB_PRIVATE(size);
+  const size_t size = m->UPB_PRIVATE(size);
+  // Message sizes are aligned up when constructing minitables; telling the
+  // compiler this avoids redoing alignment on the malloc fast path
+  UPB_ASSUME(size % kUpb_Message_Align == 0);
   struct upb_Message* msg = (struct upb_Message*)upb_Arena_Malloc(a, size);
   if (UPB_UNLIKELY(!msg)) return NULL;
   memset(msg, 0, size);
@@ -144,15 +149,21 @@ UPB_NOINLINE bool UPB_PRIVATE(_upb_Message_AddUnknownSlowPath)(
 
 // Adds unknown data (serialized protobuf data) to the given message. The data
 // must represent one or more complete and well formed proto fields.
-// If alias is set, will keep a view to the provided data; otherwise a copy is
-// made.
+//
+// If `alias_base` is NULL, the bytes from `data` will be copied into the
+// destination arena. Otherwise it must be a pointer to the beginning of the
+// buffer that `data` points into, which signals that the message must alias
+// the bytes instead of copying them. The value of `alias_base` is also used
+// to mark the boundary of the buffer, so that we do not inappropriately
+// coalesce two buffers that are separate objects but happen to be contiguous
+// in memory.
 UPB_INLINE bool UPB_PRIVATE(_upb_Message_AddUnknown)(struct upb_Message* msg,
                                                      const char* data,
                                                      size_t len,
                                                      upb_Arena* arena,
-                                                     bool alias) {
+                                                     const char* alias_base) {
   UPB_ASSERT(!upb_Message_IsFrozen(msg));
-  if (alias) {
+  if (alias_base) {
     // Aliasing parse of a message with sequential unknown fields is a simple
     // pointer bump, so inline it.
     upb_Message_Internal* in = UPB_PRIVATE(_upb_Message_GetInternal)(msg);
@@ -160,10 +171,13 @@ UPB_INLINE bool UPB_PRIVATE(_upb_Message_AddUnknown)(struct upb_Message* msg,
       upb_TaggedAuxPtr ptr = in->aux_data[in->size - 1];
       if (upb_TaggedAuxPtr_IsUnknown(ptr)) {
         upb_StringView* existing = upb_TaggedAuxPtr_UnknownData(ptr);
-        bool was_aliased = upb_TaggedAuxPtr_IsUnknownAliased(ptr);
         // Fast path if the field we're adding is immediately after the last
-        // added unknown field.
-        if (was_aliased && existing->data + existing->size == data) {
+        // added unknown field. However, we could be merging into an existing
+        // message with an allocation that just happens to be positioned
+        // immediately after the previous merged unknown field; this is
+        // considered out-of-bounds and thus UB. Ensure it's in-bounds by
+        // comparing with the original input pointer for our buffer.
+        if (data != alias_base && existing->data + existing->size == data) {
           existing->size += len;
           return true;
         }
@@ -171,7 +185,7 @@ UPB_INLINE bool UPB_PRIVATE(_upb_Message_AddUnknown)(struct upb_Message* msg,
     }
   }
   return UPB_PRIVATE(_upb_Message_AddUnknownSlowPath)(msg, data, len, arena,
-                                                      alias);
+                                                      alias_base != NULL);
 }
 
 // Adds unknown data (serialized protobuf data) to the given message.