asan_rtl.cc revision 1e172b4bdec57329bf904f063a29f99cddf2d85f
1//===-- asan_rtl.cc ---------------------------------------------*- C++ -*-===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Main file of the ASan run-time library. 13//===----------------------------------------------------------------------===// 14#include "asan_allocator.h" 15#include "asan_interceptors.h" 16#include "asan_interface.h" 17#include "asan_internal.h" 18#include "asan_lock.h" 19#ifdef __APPLE__ 20#include "asan_mac.h" 21#endif 22#include "asan_mapping.h" 23#include "asan_stack.h" 24#include "asan_stats.h" 25#include "asan_thread.h" 26#include "asan_thread_registry.h" 27 28#include <algorithm> 29#include <map> 30#include <dlfcn.h> 31#include <execinfo.h> 32#include <fcntl.h> 33#include <pthread.h> 34#include <signal.h> 35#include <stdarg.h> 36#include <stdint.h> 37#include <stdio.h> 38#include <stdlib.h> 39#include <string.h> 40#include <sys/mman.h> 41#include <sys/stat.h> 42#include <sys/types.h> 43#include <sys/ucontext.h> 44#include <sys/time.h> 45#include <sys/resource.h> 46#include <unistd.h> 47// must not include <setjmp.h> on Linux 48 49#ifndef ASAN_NEEDS_SEGV 50# define ASAN_NEEDS_SEGV 1 51#endif 52 53namespace __asan { 54 55// -------------------------- Flags ------------------------- {{{1 56static const size_t kMallocContextSize = 30; 57static int FLAG_atexit; 58bool FLAG_fast_unwind = true; 59 60size_t FLAG_redzone; // power of two, >= 32 61bool FLAG_mt; // set to 0 if you have only one thread. 62size_t FLAG_quarantine_size; 63int FLAG_demangle; 64bool FLAG_symbolize; 65int FLAG_v; 66int FLAG_debug; 67bool FLAG_poison_shadow; 68int FLAG_report_globals; 69size_t FLAG_malloc_context_size = kMallocContextSize; 70uintptr_t FLAG_large_malloc; 71bool FLAG_lazy_shadow; 72bool FLAG_handle_segv; 73bool FLAG_handle_sigill; 74bool FLAG_replace_str; 75bool FLAG_replace_intrin; 76bool FLAG_replace_cfallocator; // Used on Mac only. 77bool FLAG_stats; 78size_t FLAG_max_malloc_fill_size = 0; 79bool FLAG_use_fake_stack; 80int FLAG_exitcode = EXIT_FAILURE; 81bool FLAG_allow_user_poisoning; 82 83// -------------------------- Globals --------------------- {{{1 84int asan_inited; 85bool asan_init_is_running; 86 87// -------------------------- Interceptors ---------------- {{{1 88typedef int (*sigaction_f)(int signum, const struct sigaction *act, 89 struct sigaction *oldact); 90typedef sig_t (*signal_f)(int signum, sig_t handler); 91typedef void (*longjmp_f)(void *env, int val); 92typedef longjmp_f _longjmp_f; 93typedef longjmp_f siglongjmp_f; 94typedef void (*__cxa_throw_f)(void *, void *, void *); 95typedef int (*pthread_create_f)(pthread_t *thread, const pthread_attr_t *attr, 96 void *(*start_routine) (void *), void *arg); 97#ifdef __APPLE__ 98dispatch_async_f_f real_dispatch_async_f; 99dispatch_sync_f_f real_dispatch_sync_f; 100dispatch_after_f_f real_dispatch_after_f; 101dispatch_barrier_async_f_f real_dispatch_barrier_async_f; 102dispatch_group_async_f_f real_dispatch_group_async_f; 103pthread_workqueue_additem_np_f real_pthread_workqueue_additem_np; 104#endif 105 106sigaction_f real_sigaction; 107signal_f real_signal; 108longjmp_f real_longjmp; 109_longjmp_f real__longjmp; 110siglongjmp_f real_siglongjmp; 111__cxa_throw_f real___cxa_throw; 112pthread_create_f real_pthread_create; 113 114// -------------------------- Misc ---------------- {{{1 115void ShowStatsAndAbort() { 116 __asan_print_accumulated_stats(); 117 ASAN_DIE; 118} 119 120static void PrintBytes(const char *before, uintptr_t *a) { 121 uint8_t *bytes = (uint8_t*)a; 122 size_t byte_num = (__WORDSIZE) / 8; 123 Printf("%s%p:", before, (uintptr_t)a); 124 for (size_t i = 0; i < byte_num; i++) { 125 Printf(" %lx%lx", bytes[i] >> 4, bytes[i] & 15); 126 } 127 Printf("\n"); 128} 129 130// ---------------------- Thread ------------------------- {{{1 131static void *asan_thread_start(void *arg) { 132 AsanThread *t= (AsanThread*)arg; 133 asanThreadRegistry().SetCurrent(t); 134 return t->ThreadStart(); 135} 136 137// ---------------------- mmap -------------------- {{{1 138static void OutOfMemoryMessage(const char *mem_type, size_t size) { 139 Report("ERROR: AddressSanitizer failed to allocate " 140 "0x%lx (%ld) bytes of %s\n", 141 size, size, mem_type); 142} 143 144static char *mmap_pages(size_t start_page, size_t n_pages, const char *mem_type, 145 bool abort_on_failure = true) { 146 void *res = asan_mmap((void*)start_page, kPageSize * n_pages, 147 PROT_READ | PROT_WRITE, 148 MAP_PRIVATE | MAP_ANON | MAP_FIXED | MAP_NORESERVE, 0, 0); 149 // Printf("%p => %p\n", (void*)start_page, res); 150 char *ch = (char*)res; 151 if (res == (void*)-1L && abort_on_failure) { 152 OutOfMemoryMessage(mem_type, n_pages * kPageSize); 153 ShowStatsAndAbort(); 154 } 155 CHECK(res == (void*)start_page || res == (void*)-1L); 156 return ch; 157} 158 159// mmap range [beg, end] 160static char *mmap_range(uintptr_t beg, uintptr_t end, const char *mem_type) { 161 CHECK((beg % kPageSize) == 0); 162 CHECK(((end + 1) % kPageSize) == 0); 163 // Printf("mmap_range %p %p %ld\n", beg, end, (end - beg) / kPageSize); 164 return mmap_pages(beg, (end - beg + 1) / kPageSize, mem_type); 165} 166 167// protect range [beg, end] 168static void protect_range(uintptr_t beg, uintptr_t end) { 169 CHECK((beg % kPageSize) == 0); 170 CHECK(((end+1) % kPageSize) == 0); 171 // Printf("protect_range %p %p %ld\n", beg, end, (end - beg) / kPageSize); 172 void *res = asan_mmap((void*)beg, end - beg + 1, 173 PROT_NONE, 174 MAP_PRIVATE | MAP_ANON | MAP_FIXED | MAP_NORESERVE, 0, 0); 175 CHECK(res == (void*)beg); 176} 177 178// ---------------------- DescribeAddress -------------------- {{{1 179static bool DescribeStackAddress(uintptr_t addr, uintptr_t access_size) { 180 AsanThread *t = asanThreadRegistry().FindThreadByStackAddress(addr); 181 if (!t) return false; 182 const intptr_t kBufSize = 4095; 183 char buf[kBufSize]; 184 uintptr_t offset = 0; 185 const char *frame_descr = t->GetFrameNameByAddr(addr, &offset); 186 // This string is created by the compiler and has the following form: 187 // "FunctioName n alloc_1 alloc_2 ... alloc_n" 188 // where alloc_i looks like "offset size len ObjectName ". 189 CHECK(frame_descr); 190 // Report the function name and the offset. 191 const char *name_end = real_strchr(frame_descr, ' '); 192 CHECK(name_end); 193 buf[0] = 0; 194 strncat(buf, frame_descr, 195 std::min(kBufSize, static_cast<intptr_t>(name_end - frame_descr))); 196 Printf("Address %p is located at offset %ld " 197 "in frame <%s> of T%d's stack:\n", 198 addr, offset, buf, t->tid()); 199 // Report the number of stack objects. 200 char *p; 201 size_t n_objects = strtol(name_end, &p, 10); 202 CHECK(n_objects > 0); 203 Printf(" This frame has %ld object(s):\n", n_objects); 204 // Report all objects in this frame. 205 for (size_t i = 0; i < n_objects; i++) { 206 size_t beg, size; 207 intptr_t len; 208 beg = strtol(p, &p, 10); 209 size = strtol(p, &p, 10); 210 len = strtol(p, &p, 10); 211 if (beg <= 0 || size <= 0 || len < 0 || *p != ' ') { 212 Printf("AddressSanitizer can't parse the stack frame descriptor: |%s|\n", 213 frame_descr); 214 break; 215 } 216 p++; 217 buf[0] = 0; 218 strncat(buf, p, std::min(kBufSize, len)); 219 p += len; 220 Printf(" [%ld, %ld) '%s'\n", beg, beg + size, buf); 221 } 222 Printf("HINT: this may be a false positive if your program uses " 223 "some custom stack unwind mechanism\n" 224 " (longjmp and C++ exceptions *are* supported)\n"); 225 t->summary()->Announce(); 226 return true; 227} 228 229__attribute__((noinline)) 230static void DescribeAddress(uintptr_t addr, uintptr_t access_size) { 231 // Check if this is a global. 232 if (DescribeAddrIfGlobal(addr)) 233 return; 234 235 if (DescribeStackAddress(addr, access_size)) 236 return; 237 238 // finally, check if this is a heap. 239 DescribeHeapAddress(addr, access_size); 240} 241 242// -------------------------- Run-time entry ------------------- {{{1 243void GetPcSpBpAx(void *context, 244 uintptr_t *pc, uintptr_t *sp, uintptr_t *bp, uintptr_t *ax) { 245 ucontext_t *ucontext = (ucontext_t*)context; 246#ifdef __APPLE__ 247# if __WORDSIZE == 64 248 *pc = ucontext->uc_mcontext->__ss.__rip; 249 *bp = ucontext->uc_mcontext->__ss.__rbp; 250 *sp = ucontext->uc_mcontext->__ss.__rsp; 251 *ax = ucontext->uc_mcontext->__ss.__rax; 252# else 253 *pc = ucontext->uc_mcontext->__ss.__eip; 254 *bp = ucontext->uc_mcontext->__ss.__ebp; 255 *sp = ucontext->uc_mcontext->__ss.__esp; 256 *ax = ucontext->uc_mcontext->__ss.__eax; 257# endif // __WORDSIZE 258#else // assume linux 259# if defined(__arm__) 260 *pc = ucontext->uc_mcontext.arm_pc; 261 *bp = ucontext->uc_mcontext.arm_fp; 262 *sp = ucontext->uc_mcontext.arm_sp; 263 *ax = ucontext->uc_mcontext.arm_r0; 264# elif __WORDSIZE == 64 265 *pc = ucontext->uc_mcontext.gregs[REG_RIP]; 266 *bp = ucontext->uc_mcontext.gregs[REG_RBP]; 267 *sp = ucontext->uc_mcontext.gregs[REG_RSP]; 268 *ax = ucontext->uc_mcontext.gregs[REG_RAX]; 269# else 270 *pc = ucontext->uc_mcontext.gregs[REG_EIP]; 271 *bp = ucontext->uc_mcontext.gregs[REG_EBP]; 272 *sp = ucontext->uc_mcontext.gregs[REG_ESP]; 273 *ax = ucontext->uc_mcontext.gregs[REG_EAX]; 274# endif // __WORDSIZE 275#endif 276} 277 278static void ASAN_OnSIGSEGV(int, siginfo_t *siginfo, void *context) { 279 uintptr_t addr = (uintptr_t)siginfo->si_addr; 280 if (AddrIsInShadow(addr) && FLAG_lazy_shadow) { 281 // We traped on access to a shadow address. Just map a large chunk around 282 // this address. 283 const uintptr_t chunk_size = kPageSize << 10; // 4M 284 uintptr_t chunk = addr & ~(chunk_size - 1); 285 asan_mmap((void*)chunk, chunk_size, 286 PROT_READ | PROT_WRITE, 287 MAP_PRIVATE | MAP_ANON | MAP_FIXED, 0, 0); 288 return; 289 } 290 // Write the first message using the bullet-proof write. 291 if (13 != asan_write(2, "ASAN:SIGSEGV\n", 13)) ASAN_DIE; 292 uintptr_t pc, sp, bp, ax; 293 GetPcSpBpAx(context, &pc, &sp, &bp, &ax); 294 Report("ERROR: AddressSanitizer crashed on unknown address %p" 295 " (pc %p sp %p bp %p ax %p T%d)\n", 296 addr, pc, sp, bp, ax, 297 asanThreadRegistry().GetCurrentTidOrMinusOne()); 298 Printf("AddressSanitizer can not provide additional info. ABORTING\n"); 299 GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, false, pc, bp); 300 stack.PrintStack(); 301 ShowStatsAndAbort(); 302} 303 304static void ASAN_OnSIGILL(int, siginfo_t *siginfo, void *context) { 305 // Write the first message using the bullet-proof write. 306 if (12 != asan_write(2, "ASAN:SIGILL\n", 12)) ASAN_DIE; 307 uintptr_t pc, sp, bp, ax; 308 GetPcSpBpAx(context, &pc, &sp, &bp, &ax); 309 310 uintptr_t addr = ax; 311 312 uint8_t *insn = (uint8_t*)pc; 313 CHECK(insn[0] == 0x0f && insn[1] == 0x0b); // ud2 314 unsigned access_size_and_type = insn[2] - 0x50; 315 CHECK(access_size_and_type < 16); 316 bool is_write = access_size_and_type & 8; 317 int access_size = 1 << (access_size_and_type & 7); 318 __asan_report_error(pc, bp, sp, addr, is_write, access_size); 319} 320 321// exported functions 322#define ASAN_REPORT_ERROR(type, is_write, size) \ 323extern "C" void __asan_report_ ## type ## size(uintptr_t addr) \ 324 __attribute__((visibility("default"))); \ 325extern "C" void __asan_report_ ## type ## size(uintptr_t addr) { \ 326 GET_BP_PC_SP; \ 327 __asan_report_error(pc, bp, sp, addr, is_write, size); \ 328} 329 330ASAN_REPORT_ERROR(load, false, 1) 331ASAN_REPORT_ERROR(load, false, 2) 332ASAN_REPORT_ERROR(load, false, 4) 333ASAN_REPORT_ERROR(load, false, 8) 334ASAN_REPORT_ERROR(load, false, 16) 335ASAN_REPORT_ERROR(store, true, 1) 336ASAN_REPORT_ERROR(store, true, 2) 337ASAN_REPORT_ERROR(store, true, 4) 338ASAN_REPORT_ERROR(store, true, 8) 339ASAN_REPORT_ERROR(store, true, 16) 340 341// Force the linker to keep the symbols for various ASan interface functions. 342// We want to keep those in the executable in order to let the instrumented 343// dynamic libraries access the symbol even if it is not used by the executable 344// itself. This should help if the build system is removing dead code at link 345// time. 346extern "C" 347void __asan_force_interface_symbols() { 348 volatile int fake_condition = 0; // prevent dead condition elimination. 349 if (fake_condition) { 350 __asan_report_load1(NULL); 351 __asan_report_load2(NULL); 352 __asan_report_load4(NULL); 353 __asan_report_load8(NULL); 354 __asan_report_load16(NULL); 355 __asan_report_store1(NULL); 356 __asan_report_store2(NULL); 357 __asan_report_store4(NULL); 358 __asan_report_store8(NULL); 359 __asan_report_store16(NULL); 360 __asan_register_global(0, 0, NULL); 361 __asan_register_globals(NULL, 0); 362 } 363} 364 365// -------------------------- Init ------------------- {{{1 366static int64_t IntFlagValue(const char *flags, const char *flag, 367 int64_t default_val) { 368 if (!flags) return default_val; 369 const char *str = strstr(flags, flag); 370 if (!str) return default_val; 371 return atoll(str + internal_strlen(flag)); 372} 373 374static void asan_atexit() { 375 Printf("AddressSanitizer exit stats:\n"); 376 __asan_print_accumulated_stats(); 377} 378 379void CheckFailed(const char *cond, const char *file, int line) { 380 Report("CHECK failed: %s at %s:%d, pthread_self=%p\n", 381 cond, file, line, pthread_self()); 382 PRINT_CURRENT_STACK(); 383 ShowStatsAndAbort(); 384} 385 386} // namespace __asan 387 388// -------------------------- Interceptors ------------------- {{{1 389using namespace __asan; // NOLINT 390 391#define OPERATOR_NEW_BODY \ 392 GET_STACK_TRACE_HERE_FOR_MALLOC;\ 393 return asan_memalign(0, size, &stack); 394 395void *operator new(size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; } 396void *operator new[](size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; } 397void *operator new(size_t size, std::nothrow_t const&) throw() 398{ OPERATOR_NEW_BODY; } 399void *operator new[](size_t size, std::nothrow_t const&) throw() 400{ OPERATOR_NEW_BODY; } 401 402#define OPERATOR_DELETE_BODY \ 403 GET_STACK_TRACE_HERE_FOR_FREE(ptr);\ 404 asan_free(ptr, &stack); 405 406void operator delete(void *ptr) throw() { OPERATOR_DELETE_BODY; } 407void operator delete[](void *ptr) throw() { OPERATOR_DELETE_BODY; } 408void operator delete(void *ptr, std::nothrow_t const&) throw() 409{ OPERATOR_DELETE_BODY; } 410void operator delete[](void *ptr, std::nothrow_t const&) throw() 411{ OPERATOR_DELETE_BODY;} 412 413extern "C" 414#ifndef __APPLE__ 415__attribute__((visibility("default"))) 416#endif 417int WRAP(pthread_create)(pthread_t *thread, const pthread_attr_t *attr, 418 void *(*start_routine) (void *), void *arg) { 419 GET_STACK_TRACE_HERE(kStackTraceMax, /*fast_unwind*/false); 420 AsanThread *t = (AsanThread*)asan_malloc(sizeof(AsanThread), &stack); 421 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 422 CHECK(curr_thread || asanThreadRegistry().IsCurrentThreadDying()); 423 new(t) AsanThread(asanThreadRegistry().GetCurrentTidOrMinusOne(), 424 start_routine, arg, &stack); 425 return real_pthread_create(thread, attr, asan_thread_start, t); 426} 427 428static bool MySignal(int signum) { 429 if (FLAG_handle_sigill && signum == SIGILL) return true; 430 if (FLAG_handle_segv && signum == SIGSEGV) return true; 431#ifdef __APPLE__ 432 if (FLAG_handle_segv && signum == SIGBUS) return true; 433#endif 434 return false; 435} 436 437static void MaybeInstallSigaction(int signum, 438 void (*handler)(int, siginfo_t *, void *)) { 439 if (!MySignal(signum)) 440 return; 441 struct sigaction sigact; 442 real_memset(&sigact, 0, sizeof(sigact)); 443 sigact.sa_sigaction = handler; 444 sigact.sa_flags = SA_SIGINFO; 445 CHECK(0 == real_sigaction(signum, &sigact, 0)); 446} 447 448extern "C" 449sig_t WRAP(signal)(int signum, sig_t handler) { 450 if (!MySignal(signum)) { 451 return real_signal(signum, handler); 452 } 453 return NULL; 454} 455 456extern "C" 457int WRAP(sigaction)(int signum, const struct sigaction *act, 458 struct sigaction *oldact) { 459 if (!MySignal(signum)) { 460 return real_sigaction(signum, act, oldact); 461 } 462 return 0; 463} 464 465 466static void UnpoisonStackFromHereToTop() { 467 int local_stack; 468 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 469 CHECK(curr_thread); 470 uintptr_t top = curr_thread->stack_top(); 471 uintptr_t bottom = ((uintptr_t)&local_stack - kPageSize) & ~(kPageSize-1); 472 uintptr_t top_shadow = MemToShadow(top); 473 uintptr_t bot_shadow = MemToShadow(bottom); 474 real_memset((void*)bot_shadow, 0, top_shadow - bot_shadow); 475} 476 477extern "C" void WRAP(longjmp)(void *env, int val) { 478 UnpoisonStackFromHereToTop(); 479 real_longjmp(env, val); 480} 481 482extern "C" void WRAP(_longjmp)(void *env, int val) { 483 UnpoisonStackFromHereToTop(); 484 real__longjmp(env, val); 485} 486 487extern "C" void WRAP(siglongjmp)(void *env, int val) { 488 UnpoisonStackFromHereToTop(); 489 real_siglongjmp(env, val); 490} 491 492extern "C" void __cxa_throw(void *a, void *b, void *c); 493 494#if ASAN_HAS_EXCEPTIONS 495extern "C" void WRAP(__cxa_throw)(void *a, void *b, void *c) { 496 UnpoisonStackFromHereToTop(); 497 real___cxa_throw(a, b, c); 498} 499#endif 500 501extern "C" { 502// intercept mlock and friends. 503// Since asan maps 16T of RAM, mlock is completely unfriendly to asan. 504// All functions return 0 (success). 505static void MlockIsUnsupported() { 506 static bool printed = 0; 507 if (printed) return; 508 printed = true; 509 Printf("INFO: AddressSanitizer ignores mlock/mlockall/munlock/munlockall\n"); 510} 511int mlock(const void *addr, size_t len) { 512 MlockIsUnsupported(); 513 return 0; 514} 515int munlock(const void *addr, size_t len) { 516 MlockIsUnsupported(); 517 return 0; 518} 519int mlockall(int flags) { 520 MlockIsUnsupported(); 521 return 0; 522} 523int munlockall(void) { 524 MlockIsUnsupported(); 525 return 0; 526} 527} // extern "C" 528 529// ---------------------- Interface ---------------- {{{1 530int __asan_set_error_exit_code(int exit_code) { 531 int old = FLAG_exitcode; 532 FLAG_exitcode = exit_code; 533 return old; 534} 535 536void __asan_report_error(uintptr_t pc, uintptr_t bp, uintptr_t sp, 537 uintptr_t addr, bool is_write, size_t access_size) { 538 // Do not print more than one report, otherwise they will mix up. 539 static int num_calls = 0; 540 if (AtomicInc(&num_calls) > 1) return; 541 542 Printf("=================================================================\n"); 543 const char *bug_descr = "unknown-crash"; 544 if (AddrIsInMem(addr)) { 545 uint8_t *shadow_addr = (uint8_t*)MemToShadow(addr); 546 uint8_t shadow_byte = shadow_addr[0]; 547 if (shadow_byte > 0 && shadow_byte < 128) { 548 // we are in the partial right redzone, look at the next shadow byte. 549 shadow_byte = shadow_addr[1]; 550 } 551 switch (shadow_byte) { 552 case kAsanHeapLeftRedzoneMagic: 553 case kAsanHeapRightRedzoneMagic: 554 bug_descr = "heap-buffer-overflow"; 555 break; 556 case kAsanHeapFreeMagic: 557 bug_descr = "heap-use-after-free"; 558 break; 559 case kAsanStackLeftRedzoneMagic: 560 bug_descr = "stack-buffer-underflow"; 561 break; 562 case kAsanStackMidRedzoneMagic: 563 case kAsanStackRightRedzoneMagic: 564 case kAsanStackPartialRedzoneMagic: 565 bug_descr = "stack-buffer-overflow"; 566 break; 567 case kAsanStackAfterReturnMagic: 568 bug_descr = "stack-use-after-return"; 569 break; 570 case kAsanUserPoisonedMemoryMagic: 571 bug_descr = "use-after-poison"; 572 break; 573 case kAsanGlobalRedzoneMagic: 574 bug_descr = "global-buffer-overflow"; 575 break; 576 } 577 } 578 579 Report("ERROR: AddressSanitizer %s on address " 580 "%p at pc 0x%lx bp 0x%lx sp 0x%lx\n", 581 bug_descr, addr, pc, bp, sp); 582 583 Printf("%s of size %d at %p thread T%d\n", 584 access_size ? (is_write ? "WRITE" : "READ") : "ACCESS", 585 access_size, addr, asanThreadRegistry().GetCurrentTidOrMinusOne()); 586 587 if (FLAG_debug) { 588 PrintBytes("PC: ", (uintptr_t*)pc); 589 } 590 591 GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, 592 false, // FLAG_fast_unwind, 593 pc, bp); 594 stack.PrintStack(); 595 596 CHECK(AddrIsInMem(addr)); 597 598 DescribeAddress(addr, access_size); 599 600 uintptr_t shadow_addr = MemToShadow(addr); 601 Report("ABORTING\n"); 602 __asan_print_accumulated_stats(); 603 Printf("Shadow byte and word:\n"); 604 Printf(" %p: %x\n", shadow_addr, *(unsigned char*)shadow_addr); 605 uintptr_t aligned_shadow = shadow_addr & ~(kWordSize - 1); 606 PrintBytes(" ", (uintptr_t*)(aligned_shadow)); 607 Printf("More shadow bytes:\n"); 608 PrintBytes(" ", (uintptr_t*)(aligned_shadow-4*kWordSize)); 609 PrintBytes(" ", (uintptr_t*)(aligned_shadow-3*kWordSize)); 610 PrintBytes(" ", (uintptr_t*)(aligned_shadow-2*kWordSize)); 611 PrintBytes(" ", (uintptr_t*)(aligned_shadow-1*kWordSize)); 612 PrintBytes("=>", (uintptr_t*)(aligned_shadow+0*kWordSize)); 613 PrintBytes(" ", (uintptr_t*)(aligned_shadow+1*kWordSize)); 614 PrintBytes(" ", (uintptr_t*)(aligned_shadow+2*kWordSize)); 615 PrintBytes(" ", (uintptr_t*)(aligned_shadow+3*kWordSize)); 616 PrintBytes(" ", (uintptr_t*)(aligned_shadow+4*kWordSize)); 617 ASAN_DIE; 618} 619 620void __asan_init() { 621 if (asan_inited) return; 622 asan_init_is_running = true; 623 624 // Make sure we are not statically linked. 625 AsanDoesNotSupportStaticLinkage(); 626 627 // flags 628 const char *options = getenv("ASAN_OPTIONS"); 629 FLAG_malloc_context_size = 630 IntFlagValue(options, "malloc_context_size=", kMallocContextSize); 631 CHECK(FLAG_malloc_context_size <= kMallocContextSize); 632 633 FLAG_max_malloc_fill_size = 634 IntFlagValue(options, "max_malloc_fill_size=", 0); 635 636 FLAG_v = IntFlagValue(options, "verbosity=", 0); 637 638 FLAG_redzone = IntFlagValue(options, "redzone=", 128); 639 CHECK(FLAG_redzone >= 32); 640 CHECK((FLAG_redzone & (FLAG_redzone - 1)) == 0); 641 642 FLAG_atexit = IntFlagValue(options, "atexit=", 0); 643 FLAG_poison_shadow = IntFlagValue(options, "poison_shadow=", 1); 644 FLAG_report_globals = IntFlagValue(options, "report_globals=", 1); 645 FLAG_lazy_shadow = IntFlagValue(options, "lazy_shadow=", 0); 646 FLAG_handle_segv = IntFlagValue(options, "handle_segv=", 647 ASAN_NEEDS_SEGV); 648 FLAG_handle_sigill = IntFlagValue(options, "handle_sigill=", 0); 649 FLAG_stats = IntFlagValue(options, "stats=", 0); 650 FLAG_symbolize = IntFlagValue(options, "symbolize=", 1); 651 FLAG_demangle = IntFlagValue(options, "demangle=", 1); 652 FLAG_debug = IntFlagValue(options, "debug=", 0); 653 FLAG_replace_cfallocator = IntFlagValue(options, "replace_cfallocator=", 1); 654 FLAG_fast_unwind = IntFlagValue(options, "fast_unwind=", 1); 655 FLAG_mt = IntFlagValue(options, "mt=", 1); 656 FLAG_replace_str = IntFlagValue(options, "replace_str=", 1); 657 FLAG_replace_intrin = IntFlagValue(options, "replace_intrin=", 0); 658 FLAG_use_fake_stack = IntFlagValue(options, "use_fake_stack=", 1); 659 FLAG_exitcode = IntFlagValue(options, "exitcode=", EXIT_FAILURE); 660 FLAG_allow_user_poisoning = IntFlagValue(options, 661 "allow_user_poisoning=", 1); 662 663 if (FLAG_atexit) { 664 atexit(asan_atexit); 665 } 666 667 FLAG_quarantine_size = 668 IntFlagValue(options, "quarantine_size=", 1UL << 28); 669 670 // interceptors 671 InitializeAsanInterceptors(); 672 673 ReplaceSystemMalloc(); 674 675 INTERCEPT_FUNCTION(sigaction); 676 INTERCEPT_FUNCTION(signal); 677 INTERCEPT_FUNCTION(longjmp); 678 INTERCEPT_FUNCTION(_longjmp); 679 INTERCEPT_FUNCTION(__cxa_throw); 680 INTERCEPT_FUNCTION(pthread_create); 681#ifdef __APPLE__ 682 INTERCEPT_FUNCTION(dispatch_async_f); 683 INTERCEPT_FUNCTION(dispatch_sync_f); 684 INTERCEPT_FUNCTION(dispatch_after_f); 685 INTERCEPT_FUNCTION(dispatch_barrier_async_f); 686 INTERCEPT_FUNCTION(dispatch_group_async_f); 687 // We don't need to intercept pthread_workqueue_additem_np() to support the 688 // libdispatch API, but it helps us to debug the unsupported functions. Let's 689 // intercept it only during verbose runs. 690 if (FLAG_v >= 2) { 691 INTERCEPT_FUNCTION(pthread_workqueue_additem_np); 692 } 693#else 694 // On Darwin siglongjmp tailcalls longjmp, so we don't want to intercept it 695 // there. 696 INTERCEPT_FUNCTION(siglongjmp); 697#endif 698 699 MaybeInstallSigaction(SIGSEGV, ASAN_OnSIGSEGV); 700 MaybeInstallSigaction(SIGBUS, ASAN_OnSIGSEGV); 701 MaybeInstallSigaction(SIGILL, ASAN_OnSIGILL); 702 703 if (FLAG_v) { 704 Printf("|| `[%p, %p]` || HighMem ||\n", kHighMemBeg, kHighMemEnd); 705 Printf("|| `[%p, %p]` || HighShadow ||\n", 706 kHighShadowBeg, kHighShadowEnd); 707 Printf("|| `[%p, %p]` || ShadowGap ||\n", 708 kShadowGapBeg, kShadowGapEnd); 709 Printf("|| `[%p, %p]` || LowShadow ||\n", 710 kLowShadowBeg, kLowShadowEnd); 711 Printf("|| `[%p, %p]` || LowMem ||\n", kLowMemBeg, kLowMemEnd); 712 Printf("MemToShadow(shadow): %p %p %p %p\n", 713 MEM_TO_SHADOW(kLowShadowBeg), 714 MEM_TO_SHADOW(kLowShadowEnd), 715 MEM_TO_SHADOW(kHighShadowBeg), 716 MEM_TO_SHADOW(kHighShadowEnd)); 717 Printf("red_zone=%ld\n", FLAG_redzone); 718 Printf("malloc_context_size=%ld\n", (int)FLAG_malloc_context_size); 719 Printf("fast_unwind=%d\n", (int)FLAG_fast_unwind); 720 721 Printf("SHADOW_SCALE: %lx\n", SHADOW_SCALE); 722 Printf("SHADOW_GRANULARITY: %lx\n", SHADOW_GRANULARITY); 723 Printf("SHADOW_OFFSET: %lx\n", SHADOW_OFFSET); 724 CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7); 725 } 726 727 if (__WORDSIZE == 64) { 728 // Disable core dumper -- it makes little sense to dump 16T+ core. 729 struct rlimit nocore; 730 nocore.rlim_cur = 0; 731 nocore.rlim_max = 0; 732 setrlimit(RLIMIT_CORE, &nocore); 733 } 734 735 { 736 if (!FLAG_lazy_shadow) { 737 if (kLowShadowBeg != kLowShadowEnd) { 738 // mmap the low shadow plus one page. 739 mmap_range(kLowShadowBeg - kPageSize, kLowShadowEnd, "LowShadow"); 740 } 741 // mmap the high shadow. 742 mmap_range(kHighShadowBeg, kHighShadowEnd, "HighShadow"); 743 } 744 // protect the gap 745 protect_range(kShadowGapBeg, kShadowGapEnd); 746 } 747 748 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited 749 // should be set to 1 prior to initializing the threads. 750 asan_inited = 1; 751 asan_init_is_running = false; 752 753 asanThreadRegistry().Init(); 754 asanThreadRegistry().GetMain()->ThreadStart(); 755 __asan_force_interface_symbols(); // no-op. 756 757 if (FLAG_v) { 758 Report("AddressSanitizer r%s Init done ***\n", ASAN_REVISION); 759 } 760} 761