asan_rtl.cc revision 788e1d704436065beb514fdde86070f61d0394ed
1//===-- asan_rtl.cc ---------------------------------------------*- C++ -*-===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Main file of the ASan run-time library. 13//===----------------------------------------------------------------------===// 14#include "asan_allocator.h" 15#include "asan_interceptors.h" 16#include "asan_interface.h" 17#include "asan_internal.h" 18#include "asan_lock.h" 19#include "asan_mapping.h" 20#include "asan_procmaps.h" 21#include "asan_stack.h" 22#include "asan_stats.h" 23#include "asan_thread.h" 24#include "asan_thread_registry.h" 25 26namespace __asan { 27 28// -------------------------- Flags ------------------------- {{{1 29static const size_t kMallocContextSize = 30; 30static int FLAG_atexit; 31 32size_t FLAG_redzone; // power of two, >= 32 33size_t FLAG_quarantine_size; 34int FLAG_demangle; 35bool FLAG_symbolize; 36int FLAG_v; 37int FLAG_debug; 38bool FLAG_poison_shadow; 39int FLAG_report_globals; 40size_t FLAG_malloc_context_size = kMallocContextSize; 41uintptr_t FLAG_large_malloc; 42bool FLAG_handle_segv; 43bool FLAG_replace_str; 44bool FLAG_replace_intrin; 45bool FLAG_replace_cfallocator; // Used on Mac only. 46size_t FLAG_max_malloc_fill_size = 0; 47bool FLAG_use_fake_stack; 48int FLAG_exitcode = EXIT_FAILURE; 49bool FLAG_allow_user_poisoning; 50int FLAG_sleep_before_dying; 51 52// -------------------------- Globals --------------------- {{{1 53int asan_inited; 54bool asan_init_is_running; 55static void (*death_callback)(void); 56 57// -------------------------- Misc ---------------- {{{1 58void ShowStatsAndAbort() { 59 __asan_print_accumulated_stats(); 60 AsanDie(); 61} 62 63static void PrintBytes(const char *before, uintptr_t *a) { 64 uint8_t *bytes = (uint8_t*)a; 65 size_t byte_num = (__WORDSIZE) / 8; 66 Printf("%s%p:", before, (uintptr_t)a); 67 for (size_t i = 0; i < byte_num; i++) { 68 Printf(" %lx%lx", bytes[i] >> 4, bytes[i] & 15); 69 } 70 Printf("\n"); 71} 72 73size_t ReadFileToBuffer(const char *file_name, char **buff, 74 size_t *buff_size, size_t max_len) { 75 const size_t kMinFileLen = kPageSize; 76 size_t read_len = 0; 77 *buff = 0; 78 *buff_size = 0; 79 // The files we usually open are not seekable, so try different buffer sizes. 80 for (size_t size = kMinFileLen; size <= max_len; size *= 2) { 81 int fd = AsanOpenReadonly(file_name); 82 if (fd < 0) return -1; 83 AsanUnmapOrDie(*buff, *buff_size); 84 *buff = (char*)AsanMmapSomewhereOrDie(size, __FUNCTION__); 85 *buff_size = size; 86 // Read up to one page at a time. 87 read_len = 0; 88 bool reached_eof = false; 89 while (read_len + kPageSize <= size) { 90 size_t just_read = AsanRead(fd, *buff + read_len, kPageSize); 91 if (just_read == 0) { 92 reached_eof = true; 93 break; 94 } 95 read_len += just_read; 96 } 97 AsanClose(fd); 98 if (reached_eof) // We've read the whole file. 99 break; 100 } 101 return read_len; 102} 103 104void AsanDie() { 105 static int num_calls = 0; 106 if (AtomicInc(&num_calls) > 1) return; // Don't die twice. 107 if (FLAG_sleep_before_dying) { 108 Report("Sleeping for %d second(s)\n", FLAG_sleep_before_dying); 109 SleepForSeconds(FLAG_sleep_before_dying); 110 } 111 if (death_callback) 112 death_callback(); 113 Exit(FLAG_exitcode); 114} 115 116// ---------------------- mmap -------------------- {{{1 117void OutOfMemoryMessageAndDie(const char *mem_type, size_t size) { 118 Report("ERROR: AddressSanitizer failed to allocate " 119 "0x%lx (%ld) bytes of %s\n", 120 size, size, mem_type); 121 PRINT_CURRENT_STACK(); 122 ShowStatsAndAbort(); 123} 124 125// Reserve memory range [beg, end]. 126static void ReserveShadowMemoryRange(uintptr_t beg, uintptr_t end) { 127 CHECK((beg % kPageSize) == 0); 128 CHECK(((end + 1) % kPageSize) == 0); 129 size_t size = end - beg + 1; 130 void *res = AsanMmapFixedNoReserve(beg, size); 131 CHECK(res == (void*)beg && "ReserveShadowMemoryRange failed"); 132} 133 134// ---------------------- LowLevelAllocator ------------- {{{1 135void *LowLevelAllocator::Allocate(size_t size) { 136 CHECK((size & (size - 1)) == 0 && "size must be a power of two"); 137 if (allocated_end_ - allocated_current_ < size) { 138 size_t size_to_allocate = Max(size, kPageSize); 139 allocated_current_ = 140 (char*)AsanMmapSomewhereOrDie(size_to_allocate, __FUNCTION__); 141 allocated_end_ = allocated_current_ + size_to_allocate; 142 PoisonShadow((uintptr_t)allocated_current_, size_to_allocate, 143 kAsanInternalHeapMagic); 144 } 145 CHECK(allocated_end_ - allocated_current_ >= size); 146 void *res = allocated_current_; 147 allocated_current_ += size; 148 return res; 149} 150 151// ---------------------- DescribeAddress -------------------- {{{1 152static bool DescribeStackAddress(uintptr_t addr, uintptr_t access_size) { 153 AsanThread *t = asanThreadRegistry().FindThreadByStackAddress(addr); 154 if (!t) return false; 155 const intptr_t kBufSize = 4095; 156 char buf[kBufSize]; 157 uintptr_t offset = 0; 158 const char *frame_descr = t->GetFrameNameByAddr(addr, &offset); 159 // This string is created by the compiler and has the following form: 160 // "FunctioName n alloc_1 alloc_2 ... alloc_n" 161 // where alloc_i looks like "offset size len ObjectName ". 162 CHECK(frame_descr); 163 // Report the function name and the offset. 164 const char *name_end = internal_strchr(frame_descr, ' '); 165 CHECK(name_end); 166 buf[0] = 0; 167 internal_strncat(buf, frame_descr, 168 Min(kBufSize, 169 static_cast<intptr_t>(name_end - frame_descr))); 170 Printf("Address %p is located at offset %ld " 171 "in frame <%s> of T%d's stack:\n", 172 addr, offset, buf, t->tid()); 173 // Report the number of stack objects. 174 char *p; 175 size_t n_objects = strtol(name_end, &p, 10); 176 CHECK(n_objects > 0); 177 Printf(" This frame has %ld object(s):\n", n_objects); 178 // Report all objects in this frame. 179 for (size_t i = 0; i < n_objects; i++) { 180 size_t beg, size; 181 intptr_t len; 182 beg = strtol(p, &p, 10); 183 size = strtol(p, &p, 10); 184 len = strtol(p, &p, 10); 185 if (beg <= 0 || size <= 0 || len < 0 || *p != ' ') { 186 Printf("AddressSanitizer can't parse the stack frame descriptor: |%s|\n", 187 frame_descr); 188 break; 189 } 190 p++; 191 buf[0] = 0; 192 internal_strncat(buf, p, Min(kBufSize, len)); 193 p += len; 194 Printf(" [%ld, %ld) '%s'\n", beg, beg + size, buf); 195 } 196 Printf("HINT: this may be a false positive if your program uses " 197 "some custom stack unwind mechanism\n" 198 " (longjmp and C++ exceptions *are* supported)\n"); 199 t->summary()->Announce(); 200 return true; 201} 202 203static NOINLINE void DescribeAddress(uintptr_t addr, uintptr_t access_size) { 204 // Check if this is a global. 205 if (DescribeAddrIfGlobal(addr)) 206 return; 207 208 if (DescribeStackAddress(addr, access_size)) 209 return; 210 211 // finally, check if this is a heap. 212 DescribeHeapAddress(addr, access_size); 213} 214 215// -------------------------- Run-time entry ------------------- {{{1 216// exported functions 217#define ASAN_REPORT_ERROR(type, is_write, size) \ 218NOINLINE ASAN_INTERFACE_ATTRIBUTE \ 219extern "C" void __asan_report_ ## type ## size(uintptr_t addr); \ 220extern "C" void __asan_report_ ## type ## size(uintptr_t addr) { \ 221 GET_BP_PC_SP; \ 222 __asan_report_error(pc, bp, sp, addr, is_write, size); \ 223} 224 225ASAN_REPORT_ERROR(load, false, 1) 226ASAN_REPORT_ERROR(load, false, 2) 227ASAN_REPORT_ERROR(load, false, 4) 228ASAN_REPORT_ERROR(load, false, 8) 229ASAN_REPORT_ERROR(load, false, 16) 230ASAN_REPORT_ERROR(store, true, 1) 231ASAN_REPORT_ERROR(store, true, 2) 232ASAN_REPORT_ERROR(store, true, 4) 233ASAN_REPORT_ERROR(store, true, 8) 234ASAN_REPORT_ERROR(store, true, 16) 235 236// Force the linker to keep the symbols for various ASan interface functions. 237// We want to keep those in the executable in order to let the instrumented 238// dynamic libraries access the symbol even if it is not used by the executable 239// itself. This should help if the build system is removing dead code at link 240// time. 241static void force_interface_symbols() { 242 volatile int fake_condition = 0; // prevent dead condition elimination. 243 if (fake_condition) { 244 __asan_report_load1(NULL); 245 __asan_report_load2(NULL); 246 __asan_report_load4(NULL); 247 __asan_report_load8(NULL); 248 __asan_report_load16(NULL); 249 __asan_report_store1(NULL); 250 __asan_report_store2(NULL); 251 __asan_report_store4(NULL); 252 __asan_report_store8(NULL); 253 __asan_report_store16(NULL); 254 __asan_register_global(0, 0, NULL); 255 __asan_register_globals(NULL, 0); 256 __asan_unregister_globals(NULL, 0); 257 } 258} 259 260// -------------------------- Init ------------------- {{{1 261#if defined(_WIN32) 262// atoll is not defined on Windows. 263int64_t atoll(const char *str) { 264 UNIMPLEMENTED(); 265 return -1; 266} 267#endif 268 269static int64_t IntFlagValue(const char *flags, const char *flag, 270 int64_t default_val) { 271 if (!flags) return default_val; 272 const char *str = internal_strstr(flags, flag); 273 if (!str) return default_val; 274 return atoll(str + internal_strlen(flag)); 275} 276 277static void asan_atexit() { 278 Printf("AddressSanitizer exit stats:\n"); 279 __asan_print_accumulated_stats(); 280} 281 282void CheckFailed(const char *cond, const char *file, int line) { 283 Report("CHECK failed: %s at %s:%d\n", cond, file, line); 284 PRINT_CURRENT_STACK(); 285 ShowStatsAndAbort(); 286} 287 288} // namespace __asan 289 290// ---------------------- Interface ---------------- {{{1 291using namespace __asan; // NOLINT 292 293int __asan_set_error_exit_code(int exit_code) { 294 int old = FLAG_exitcode; 295 FLAG_exitcode = exit_code; 296 return old; 297} 298 299void __asan_handle_no_return() { 300 int local_stack; 301 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 302 CHECK(curr_thread); 303 uintptr_t top = curr_thread->stack_top(); 304 uintptr_t bottom = ((uintptr_t)&local_stack - kPageSize) & ~(kPageSize-1); 305 PoisonShadow(bottom, top - bottom, 0); 306} 307 308void __asan_set_death_callback(void (*callback)(void)) { 309 death_callback = callback; 310} 311 312void __asan_report_error(uintptr_t pc, uintptr_t bp, uintptr_t sp, 313 uintptr_t addr, bool is_write, size_t access_size) { 314 // Do not print more than one report, otherwise they will mix up. 315 static int num_calls = 0; 316 if (AtomicInc(&num_calls) > 1) return; 317 318 Printf("=================================================================\n"); 319 const char *bug_descr = "unknown-crash"; 320 if (AddrIsInMem(addr)) { 321 uint8_t *shadow_addr = (uint8_t*)MemToShadow(addr); 322 // If we are accessing 16 bytes, look at the second shadow byte. 323 if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY) 324 shadow_addr++; 325 // If we are in the partial right redzone, look at the next shadow byte. 326 if (*shadow_addr > 0 && *shadow_addr < 128) 327 shadow_addr++; 328 switch (*shadow_addr) { 329 case kAsanHeapLeftRedzoneMagic: 330 case kAsanHeapRightRedzoneMagic: 331 bug_descr = "heap-buffer-overflow"; 332 break; 333 case kAsanHeapFreeMagic: 334 bug_descr = "heap-use-after-free"; 335 break; 336 case kAsanStackLeftRedzoneMagic: 337 bug_descr = "stack-buffer-underflow"; 338 break; 339 case kAsanStackMidRedzoneMagic: 340 case kAsanStackRightRedzoneMagic: 341 case kAsanStackPartialRedzoneMagic: 342 bug_descr = "stack-buffer-overflow"; 343 break; 344 case kAsanStackAfterReturnMagic: 345 bug_descr = "stack-use-after-return"; 346 break; 347 case kAsanUserPoisonedMemoryMagic: 348 bug_descr = "use-after-poison"; 349 break; 350 case kAsanGlobalRedzoneMagic: 351 bug_descr = "global-buffer-overflow"; 352 break; 353 } 354 } 355 356 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 357 int curr_tid = asanThreadRegistry().GetCurrentTidOrMinusOne(); 358 359 if (curr_thread) { 360 // We started reporting an error message. Stop using the fake stack 361 // in case we will call an instrumented function from a symbolizer. 362 curr_thread->fake_stack().StopUsingFakeStack(); 363 } 364 365 Report("ERROR: AddressSanitizer %s on address " 366 "%p at pc 0x%lx bp 0x%lx sp 0x%lx\n", 367 bug_descr, addr, pc, bp, sp); 368 369 Printf("%s of size %d at %p thread T%d\n", 370 access_size ? (is_write ? "WRITE" : "READ") : "ACCESS", 371 access_size, addr, curr_tid); 372 373 if (FLAG_debug) { 374 PrintBytes("PC: ", (uintptr_t*)pc); 375 } 376 377 GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, pc, bp); 378 stack.PrintStack(); 379 380 CHECK(AddrIsInMem(addr)); 381 382 DescribeAddress(addr, access_size); 383 384 uintptr_t shadow_addr = MemToShadow(addr); 385 Report("ABORTING\n"); 386 __asan_print_accumulated_stats(); 387 Printf("Shadow byte and word:\n"); 388 Printf(" %p: %x\n", shadow_addr, *(unsigned char*)shadow_addr); 389 uintptr_t aligned_shadow = shadow_addr & ~(kWordSize - 1); 390 PrintBytes(" ", (uintptr_t*)(aligned_shadow)); 391 Printf("More shadow bytes:\n"); 392 PrintBytes(" ", (uintptr_t*)(aligned_shadow-4*kWordSize)); 393 PrintBytes(" ", (uintptr_t*)(aligned_shadow-3*kWordSize)); 394 PrintBytes(" ", (uintptr_t*)(aligned_shadow-2*kWordSize)); 395 PrintBytes(" ", (uintptr_t*)(aligned_shadow-1*kWordSize)); 396 PrintBytes("=>", (uintptr_t*)(aligned_shadow+0*kWordSize)); 397 PrintBytes(" ", (uintptr_t*)(aligned_shadow+1*kWordSize)); 398 PrintBytes(" ", (uintptr_t*)(aligned_shadow+2*kWordSize)); 399 PrintBytes(" ", (uintptr_t*)(aligned_shadow+3*kWordSize)); 400 PrintBytes(" ", (uintptr_t*)(aligned_shadow+4*kWordSize)); 401 AsanDie(); 402} 403 404void __asan_init() { 405 if (asan_inited) return; 406 asan_init_is_running = true; 407 408 // Make sure we are not statically linked. 409 AsanDoesNotSupportStaticLinkage(); 410 411 // flags 412 const char *options = AsanGetEnv("ASAN_OPTIONS"); 413 FLAG_malloc_context_size = 414 IntFlagValue(options, "malloc_context_size=", kMallocContextSize); 415 CHECK(FLAG_malloc_context_size <= kMallocContextSize); 416 417 FLAG_max_malloc_fill_size = 418 IntFlagValue(options, "max_malloc_fill_size=", 0); 419 420 FLAG_v = IntFlagValue(options, "verbosity=", 0); 421 422#if ASAN_LOW_MEMORY == 1 423 FLAG_quarantine_size = 424 IntFlagValue(options, "quarantine_size=", 1UL << 24); // 16M 425 FLAG_redzone = IntFlagValue(options, "redzone=", 64); 426#else 427 FLAG_quarantine_size = 428 IntFlagValue(options, "quarantine_size=", 1UL << 28); // 256M 429 FLAG_redzone = IntFlagValue(options, "redzone=", 128); 430#endif 431 CHECK(FLAG_redzone >= 32); 432 CHECK((FLAG_redzone & (FLAG_redzone - 1)) == 0); 433 434 FLAG_atexit = IntFlagValue(options, "atexit=", 0); 435 FLAG_poison_shadow = IntFlagValue(options, "poison_shadow=", 1); 436 FLAG_report_globals = IntFlagValue(options, "report_globals=", 1); 437 FLAG_handle_segv = IntFlagValue(options, "handle_segv=", ASAN_NEEDS_SEGV); 438 FLAG_symbolize = IntFlagValue(options, "symbolize=", 1); 439 FLAG_demangle = IntFlagValue(options, "demangle=", 1); 440 FLAG_debug = IntFlagValue(options, "debug=", 0); 441 FLAG_replace_cfallocator = IntFlagValue(options, "replace_cfallocator=", 1); 442 FLAG_replace_str = IntFlagValue(options, "replace_str=", 1); 443 FLAG_replace_intrin = IntFlagValue(options, "replace_intrin=", 1); 444 FLAG_use_fake_stack = IntFlagValue(options, "use_fake_stack=", 1); 445 FLAG_exitcode = IntFlagValue(options, "exitcode=", EXIT_FAILURE); 446 FLAG_allow_user_poisoning = IntFlagValue(options, 447 "allow_user_poisoning=", 1); 448 FLAG_sleep_before_dying = IntFlagValue(options, "sleep_before_dying=", 0); 449 450 if (FLAG_atexit) { 451 atexit(asan_atexit); 452 } 453 454 // interceptors 455 InitializeAsanInterceptors(); 456 457 ReplaceSystemMalloc(); 458 InstallSignalHandlers(); 459 460 if (FLAG_v) { 461 Printf("|| `[%p, %p]` || HighMem ||\n", kHighMemBeg, kHighMemEnd); 462 Printf("|| `[%p, %p]` || HighShadow ||\n", 463 kHighShadowBeg, kHighShadowEnd); 464 Printf("|| `[%p, %p]` || ShadowGap ||\n", 465 kShadowGapBeg, kShadowGapEnd); 466 Printf("|| `[%p, %p]` || LowShadow ||\n", 467 kLowShadowBeg, kLowShadowEnd); 468 Printf("|| `[%p, %p]` || LowMem ||\n", kLowMemBeg, kLowMemEnd); 469 Printf("MemToShadow(shadow): %p %p %p %p\n", 470 MEM_TO_SHADOW(kLowShadowBeg), 471 MEM_TO_SHADOW(kLowShadowEnd), 472 MEM_TO_SHADOW(kHighShadowBeg), 473 MEM_TO_SHADOW(kHighShadowEnd)); 474 Printf("red_zone=%ld\n", FLAG_redzone); 475 Printf("malloc_context_size=%ld\n", (int)FLAG_malloc_context_size); 476 477 Printf("SHADOW_SCALE: %lx\n", SHADOW_SCALE); 478 Printf("SHADOW_GRANULARITY: %lx\n", SHADOW_GRANULARITY); 479 Printf("SHADOW_OFFSET: %lx\n", SHADOW_OFFSET); 480 CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7); 481 } 482 483 if (__WORDSIZE == 64) { 484 // Disable core dumper -- it makes little sense to dump 16T+ core. 485 AsanDisableCoreDumper(); 486 } 487 488 if (AsanShadowRangeIsAvailable()) { 489 if (kLowShadowBeg != kLowShadowEnd) { 490 // mmap the low shadow plus at least one page. 491 ReserveShadowMemoryRange(kLowShadowBeg - kMmapGranularity, kLowShadowEnd); 492 } 493 // mmap the high shadow. 494 ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd); 495 // protect the gap 496 void *prot = AsanMprotect(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1); 497 CHECK(prot == (void*)kShadowGapBeg); 498 } else { 499 Report("Shadow memory range interleaves with an existing memory mapping. " 500 "ASan cannot proceed correctly. ABORTING.\n"); 501 AsanDie(); 502 } 503 504 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited 505 // should be set to 1 prior to initializing the threads. 506 asan_inited = 1; 507 asan_init_is_running = false; 508 509 asanThreadRegistry().Init(); 510 asanThreadRegistry().GetMain()->ThreadStart(); 511 force_interface_symbols(); // no-op. 512 513 if (FLAG_v) { 514 Report("AddressSanitizer Init done\n"); 515 } 516} 517 518#if defined(ASAN_USE_PREINIT_ARRAY) 519// On Linux, we force __asan_init to be called before anyone else 520// by placing it into .preinit_array section. 521// FIXME: do we have anything like this on Mac? 522__attribute__((section(".preinit_array"))) 523 typeof(__asan_init) *__asan_preinit =__asan_init; 524#endif 525