github.com/bytedance/sonic/loader Go module: is it safe?

This file is part of a Go runtime loader that constructs internal runtime structures (moduledata, pcHeader, pclntab, findfunctab) at runtime. It directly writes into memory using unsafe.Pointer, calls mmap/mprotect (via rt package), and builds executable code segments. While this is a legitimate technique used by the ByteDance Sonic JIT loader, the pattern is inherently powerful and can be weaponized for code injection or bypassing security boundaries.

Creates fake moduledata and pcHeader with magic 0xfffffffa, and mutates moduleCache. This manipulates the Go runtime's function tables, which could be abused to hook or redirect calls, hide malicious code, or bypass security checks.

The code imports 'unsafe' and defines structs that mirror Go runtime internal moduledata and _func structures using unsafe.Pointer fields. While this is common for low-level runtime introspection libraries (e.g., for performance profiling or patching), direct manipulation of Go runtime internals via unsafe can lead to memory corruption or undefined behavior if misused.

The file defines a 'moduledata' struct that replicates internal Go runtime structures, including function metadata (pclntable, ftab, findfunctab) and pointers to runtime type information. Accessing or modifying these structures can be used to bypass security mechanisms, alter function behavior, or extract sensitive runtime information.

The code uses the unsafe package to directly manipulate internal Go runtime structures (moduledata, _func). This is not inherently malicious but indicates low-level runtime manipulation typical of instrumentation or hooking libraries. Such code could be abused for runtime patching, but no specific malicious behavior is present.

The package uses //go:linkname to directly link against the Go runtime's runtime.morestack_noctxt function. This is a powerful and fragile mechanism that bypasses normal Go safety checks and relies on internal runtime implementation details. While not inherently malicious, this technique is commonly used in memory-corruption/exploit-adjacent code and assembly-level manipulations, and it can be used to subvert expected runtime behavior.

The rbuf method can be used to create a slice from any pointer stored in a _Token. If an attacker can influence token creation or the u64 field, it could read arbitrary memory contents as runes, potentially leaking sensitive data from the process memory.

The Generate method creates a file at an arbitrary caller-supplied path and then chmods it to 0755 (executable). While this is the intended API for generating executables, writing executables anywhere on the filesystem and granting execute permissions can be abused if the path is attacker-controlled. This is a capability, not an inherent backdoor, but it should be noted.

The Format.Generate method produces native ELF/Mach-O binaries from raw code bytes with no validation or sandboxing. If this library is used with untrusted input, it could facilitate dropping malicious executables to disk.

The code uses unsafe.Pointer and reflect internals to directly reinterpret interface{} memory layouts (_GoEface, _GoType, _GoSlice). This bypasses Go's type safety and relies on undocumented internal runtime structures that may change between Go versions. While this pattern is commonly used in legitimate performance-sensitive libraries (e.g., CloudWeGo's iasm assembler), it can lead to memory corruption or crashes if misused, and could in theory be weaponized to read arbitrary memory via the toInt64() method which dereferences self.ptr based on vt.size without bounds validation.

The file uses unsafe.Pointer, //go:linkname to runtime internals (growslice, memclrNoHeapPointers), and manual slice header manipulation in expandmm. While typical for an assembler package, linkname usage bypasses Go's type safety and could break across Go versions or be abused if the package were compromised.

The functions in this file use the unsafe package to perform direct memory manipulation, casting between string, []byte, and raw pointers. This bypasses Go's memory safety guarantees and can lead to memory corruption, data races, or security vulnerabilities if misused. Functions like Mem2Str, Str2Mem, BytesFrom, IndexChar, and IndexByte are heavily dependent on exact memory layout assumptions and lack bounds checking.

The unsafe primitives provided by this file (e.g., direct pointer arithmetic in IndexChar and IndexByte, arbitrary slice creation from pointers in BytesFrom) could be leveraged by an attacker to read or write arbitrary memory if the caller passes untrusted or incorrectly computed arguments. While the functions themselves are not overtly malicious, they significantly lower the bar for exploiting memory-safety bugs elsewhere in the program.

The file heavily uses Go's unsafe package and directly manipulates internal runtime type representations (GoType, GoIface, GoEface, GoItab). This circumvents Go's type safety and is highly dependent on implementation details, making it fragile and potentially exploitable if types are mismanaged.

Functions like UnpackType, UnpackEface, and UnpackIface cast arbitrary interface{} or reflect.Type values to internal structures without validation. If used with unexpected types, this can lead to memory corruption or crashes.

The code provides direct access to raw pointers and type metadata (e.g., GoType, GoMapType, GoSlice). While the intent is performance optimization, a malicious actor could exploit these functions to read or write arbitrary memory if they control input types or interfaces.

The Bit method does no bounds checking on self.N or the pointer self.B, allowing out-of-bounds reads if i >= N or if the underlying memory is insufficient. Similarly, Get does not validate i against self.N before doing pointer arithmetic, potentially causing out-of-bounds access.

Multiple functions (Get, Bit, MarshalBinary, Build) use unsafe.Pointer and uintptr arithmetic to directly manipulate memory. In Go, improper use of unsafe.Pointer with uintptr (especially when converting back to unsafe.Pointer) can violate the unsafe.Pointer safety rules, leading to memory corruption or undefined behavior. While likely intentional for low-level runtime purposes, it is a security risk if inputs are not strictly validated.

The directive //go:linkname is used to link to runtime.mallocgc, bypassing Go's type safety and package encapsulation. This can break in future Go versions and allows direct calls to runtime internals, which is a potential security concern if misused.

In StackMapBuilder.Build, allocatedSize is computed as _StackMapSize + uintptr(nb) - 1. If nb is 0 or large, integer underflow/overflow could occur, leading to incorrect memory allocation. Additionally, BinaryLen multiplies BitmapBytes() * BitmapNums() without overflow checks, which could be exploited if the struct is populated with crafted values.

The Loader struct (with Name, File, Options) and NoPreempt option suggest this package is designed to dynamically load and patch a Go module at a binary level, potentially with async preemption disabled. Dynamic module/binary loading with preemption disabled can be used to hide execution from the Go runtime and routine profiling/debugging, which is a red flag for stealthy code injection if inputs are attacker-controlled.

The Function type is defined as unsafe.Pointer, which is used for direct memory manipulation. While this file itself does not perform malicious actions, this pattern is typical of low-level runtime patching/module loading code (as in ByteDance's Frugal/monkey-patching libraries) and can be abused to bypass Go's type safety, hook functions, and execute arbitrary in-memory code. It warrants scrutiny in the broader package context.

The code calls moduledataverify1 and registerModule to modify the Go runtime's module data structures at runtime. Legitimate packages rarely need to do this; such behavior is typical of malware or runtime exploitation frameworks.

The mmap function allocates anonymous private memory with read-write permissions, and mprotect subsequently changes that same memory region to read-execute (_RX = PROT_READ | PROT_EXEC). This is the classic pattern for a JIT or dynamic code loader that writes executable code into memory at runtime and then executes it. While this package (ByteDance loader) is a legitimate component used by projects like Sonic for runtime code generation, the same pattern is frequently used by malware to hide shellcode and payloads from static analysis. The allocation and execution are gated behind a 'loader' package but the functions are exported and could be invoked from any importing code.

mprotect marks pages as PROT_EXEC after they were writable, allowing dynamically-written bytes to be executed. No address range validation, no size bounds check, and no verification that the region was previously allocated by mmap before flipping it to executable. Combined with the fact that the caller controls 'p' (uintptr) and 'nb' (int), a caller could potentially mark arbitrary memory ranges executable.

The code heavily uses unsafe.Pointer, rt.BytesFrom, mmap, mprotect, and directly manipulates Go runtime metadata structures (moduledata, pclntab, functab, findfunctab). While this is legitimate for a low-level loader (bytedance/sonic), such operations are highly sensitive and could be abused to modify or hide code, bypass security checks, or create malicious runtime structures.

The makeModuledata function calls mmap to allocate executable memory, copies machine code into it, and calls mprotect to make it executable. This is a classic pattern for JIT/loader functionality but also for shellcode execution or runtime code injection if used maliciously.

The code constructs and modifies internal Go runtime structures such as pcHeader, moduledata, _func, and findfuncbucket. Tampering with these can alter function resolution, stack traces, and potentially hide malicious activity from runtime introspection.

The file uses unsafe.Pointer and atomic operations to directly modify Go runtime internal data structures (moduledata, lastmoduledatap). This is highly unusual for a normal package and indicates deep runtime manipulation, which could be used to hide or load modules in a non-standard way. While not overtly malicious, such techniques are typically reserved for the Go runtime itself or very specialized tools, and could be used to bypass security controls or load unauthorized code.

The registerModule and registerModuleLockFree functions link a new moduledata into the runtime's module list. This could allow dynamically loaded code to appear as a legitimate Go module, potentially evading detection by module verification tools. The build tag '!bytedance_tango' suggests this code is excluded in certain builds, indicating it is part of a customized runtime environment, which may be used for legitimate performance tuning but also carries risk if misused.

The file uses //go:linkname to access plugin.pluginsMu, an unexported internal runtime variable, which relies on unsupported linker behavior and can break or be abused across Go versions. While the code only registers a new module in the plugin list, this pattern can be used for undocumented runtime manipulation and is generally discouraged in public registry packages.

The file uses //go:linkname directives to access unexported runtime symbols (runtime.lastmoduledatap and runtime.moduledataverify1). This bypasses Go's encapsulation and can be used to manipulate runtime module data or disable verification, though no active malicious behavior is present in this file.