Improve memory safety

This commit makes numerous refinements to cosmopolitan memory handling.

The default stack size has been reduced from 2mb to 128kb. A new macro
is now provided so you can easily reconfigure the stack size to be any
value you want. Work around the breaking change by adding to your main:

    STATIC_STACK_SIZE(0x00200000);  // 2mb stack

If you're not sure how much stack you need, then you can use:

    STATIC_YOINK("stack_usage_logging");

After which you can `sort -nr o/$MODE/stack.log`. Based on the unit test
suite, nothing in the Cosmopolitan repository (except for Python) needs
a stack size greater than 30kb. There are also new macros for detecting
the size and address of the stack at runtime, e.g. GetStackAddr(). We
also now support sigaltstack() so if you want to see nice looking crash
reports whenever a stack overflow happens, you can put this in main():

    ShowCrashReports();

Under `make MODE=dbg` and `make MODE=asan` the unit testing framework
will now automatically print backtraces of memory allocations when
things like memory leaks happen. Bugs are now fixed in ASAN global
variable overrun detection. The memtrack and asan runtimes also handle
edge cases now. The new tools helped to identify a few memory leaks,
which are fixed by this change.

This change should fix an issue reported in #288 with ARG_MAX limits.
Fixing this doubled the performance of MKDEPS.COM and AR.COM yet again.

libc/runtime/munmap.c

@@ -16,42 +16,100 @@
 │ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR             │
 │ PERFORMANCE OF THIS SOFTWARE.                                                │
 ╚─────────────────────────────────────────────────────────────────────────────*/
+#include "libc/bits/likely.h"
 #include "libc/calls/internal.h"
 #include "libc/calls/sysdebug.internal.h"
 #include "libc/dce.h"
+#include "libc/intrin/asan.internal.h"
 #include "libc/log/libfatal.internal.h"
 #include "libc/macros.internal.h"
 #include "libc/runtime/directmap.internal.h"
 #include "libc/runtime/memtrack.internal.h"
 #include "libc/runtime/runtime.h"
+#include "libc/str/str.h"
 #include "libc/sysv/errfuns.h"
 
-#define IP(X)        (intptr_t)(X)
-#define ALIGNED(p)   (!(IP(p) & (FRAMESIZE - 1)))
-#define CANONICAL(p) (-0x800000000000 <= IP(p) && IP(p) <= 0x7fffffffffff)
+#define IP(X)      (intptr_t)(X)
+#define SMALL(n)   ((n) <= 0xffffffffffff)
+#define ALIGNED(p) (!(IP(p) & (FRAMESIZE - 1)))
+#define LEGAL(p)   (-0x800000000000 <= IP(p) && IP(p) <= 0x7fffffffffff)
+#define ADDR(x)    ((int64_t)((uint64_t)(x) << 32) >> 16)
+#define SHADE(x)   (((intptr_t)(x) >> 3) + 0x7fff8000)
+#define FRAME(x)   ((int)((intptr_t)(x) >> 16))
 
 /**
  * Releases memory pages.
  *
- * This function may be used to punch holes in existing mappings, but your
- * mileage may vary on Windows.
+ * This function may be used to punch holes in existing mappings, but
+ * your mileage may vary on Windows.
  *
- * @param addr is a pointer within any memory mapped region the process
+ * @param p is a pointer within any memory mapped region the process
  *     has permission to control, such as address ranges returned by
  *     mmap(), the program image itself, etc.
- * @param size is the amount of memory to unmap, which needs to be a
+ * @param n is the number of bytes to be unmapped, and needs to be a
  *     multiple of FRAMESIZE for anonymous mappings, because windows
  *     and for files size needs to be perfect to the byte bc openbsd
  * @return 0 on success, or -1 w/ errno
  */
-noasan int munmap(void *addr, size_t size) {
+noasan int munmap(void *v, size_t n) {
+  /* asan runtime depends on this function */
   int rc;
-  /* TODO(jart): are we unmapping shadows? */
-  SYSDEBUG("munmap(0x%x, 0x%x)", addr, size);
-  if (!ALIGNED(addr) || !CANONICAL(addr) || !size) return einval();
-  if (UntrackMemoryIntervals(addr, size) == -1) return -1;
-  if (IsWindows()) return 0;
-  if (IsMetal()) sys_munmap_metal(addr, size);
-  SYSDEBUG("sys_munmap(0x%x, 0x%x)", addr, size);
-  return sys_munmap(addr, size);
+  char poison, *p = v;
+  intptr_t a, b, x, y;
+  if (UNLIKELY(!n)) {
+    SYSDEBUG("munmap(0x%p, 0x%x) %s (n=0)", p, n);
+    return einval();
+  }
+  if (UNLIKELY(!SMALL(n))) {
+    SYSDEBUG("munmap(0x%p, 0x%x) EINVAL (n isn't 48-bit)", p, n);
+    return einval();
+  }
+  if (UNLIKELY(!LEGAL(p))) {
+    SYSDEBUG("munmap(0x%p, 0x%x) EINVAL (p isn't 48-bit)", p, n);
+    return einval();
+  }
+  if (UNLIKELY(!LEGAL(p + (n - 1)))) {
+    SYSDEBUG("munmap(0x%p, 0x%x) EINVAL (p+(n-1) isn't 48-bit)", p, n);
+    return einval();
+  }
+  if (UNLIKELY(!ALIGNED(p))) {
+    SYSDEBUG("munmap(0x%p, 0x%x) EINVAL (p isn't 64kb aligned)", p, n);
+    return einval();
+  }
+  if (!IsMemtracked(FRAME(p), FRAME(p + (n - 1)))) {
+    SYSDEBUG("munmap(0x%p, 0x%x) EFAULT (interval not tracked)", p, n);
+    return efault();
+  }
+  SYSDEBUG("munmap(0x%p, 0x%x)", p, n);
+  if (UntrackMemoryIntervals(p, n) != -1) {
+    if (!IsWindows()) {
+      rc = sys_munmap(p, n);
+      if (rc != -1) {
+        if (IsAsan() && !OverlapsShadowSpace(p, n)) {
+          a = SHADE(p);
+          b = a + (n >> 3);
+          if (IsMemtracked(FRAME(a), FRAME(b - 1))) {
+            x = ROUNDUP(a, FRAMESIZE);
+            y = ROUNDDOWN(b, FRAMESIZE);
+            if (x < y) {
+              /* delete shadowspace if unmapping ≥512kb */
+              __repstosb((void *)a, kAsanUnmapped, x - a);
+              munmap((void *)x, y - x);
+              __repstosb((void *)y, kAsanUnmapped, b - y);
+            } else {
+              /* otherwise just poison and assume reuse */
+              __repstosb((void *)a, kAsanUnmapped, b - a);
+            }
+          } else {
+            SYSDEBUG("unshadow(0x%x, 0x%x) EFAULT", a, b - a);
+          }
+        }
+      }
+      return rc;
+    } else {
+      return 0; /* UntrackMemoryIntervals does it for NT */
+    }
+  } else {
+    return -1;
+  }
 }