asan_rtl.cc revision 51e75c45a6886455a5bdb91c0951bc77dd2c47a2 
1//===-- asan_rtl.cc ---------------------------------------------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12// Main file of the ASan run-time library.
13//===----------------------------------------------------------------------===//
14#include "asan_allocator.h"
15#include "asan_interceptors.h"
16#include "asan_interface.h"
17#include "asan_internal.h"
18#include "asan_lock.h"
19#ifdef __APPLE__
20#include "asan_mac.h"
21#endif
22#include "asan_mapping.h"
23#include "asan_stack.h"
24#include "asan_stats.h"
25#include "asan_thread.h"
26#include "asan_thread_registry.h"
27
28#include <new>
29#include <dlfcn.h>
30#include <execinfo.h>
31#include <fcntl.h>
32#include <pthread.h>
33#include <signal.h>
34#include <stdarg.h>
35#include <stdint.h>
36#include <stdio.h>
37#include <stdlib.h>
38#include <string.h>
39#include <sys/mman.h>
40#include <sys/stat.h>
41#include <sys/types.h>
42#include <sys/ucontext.h>
43#include <sys/time.h>
44#include <sys/resource.h>
45#include <unistd.h>
46// must not include <setjmp.h> on Linux
47
48namespace __asan {
49
50// -------------------------- Flags ------------------------- {{{1
51static const size_t kMallocContextSize = 30;
52static int    FLAG_atexit;
53bool   FLAG_fast_unwind = true;
54
55size_t FLAG_redzone;  // power of two, >= 32
56size_t FLAG_quarantine_size;
57int    FLAG_demangle;
58bool   FLAG_symbolize;
59int    FLAG_v;
60int    FLAG_debug;
61bool   FLAG_poison_shadow;
62int    FLAG_report_globals;
63size_t FLAG_malloc_context_size = kMallocContextSize;
64uintptr_t FLAG_large_malloc;
65bool   FLAG_lazy_shadow;
66bool   FLAG_handle_segv;
67bool   FLAG_handle_sigill;
68bool   FLAG_replace_str;
69bool   FLAG_replace_intrin;
70bool   FLAG_replace_cfallocator;  // Used on Mac only.
71size_t FLAG_max_malloc_fill_size = 0;
72bool   FLAG_use_fake_stack;
73int    FLAG_exitcode = EXIT_FAILURE;
74bool   FLAG_allow_user_poisoning;
75
76// -------------------------- Globals --------------------- {{{1
77int asan_inited;
78bool asan_init_is_running;
79
80// -------------------------- Interceptors ---------------- {{{1
81typedef int (*sigaction_f)(int signum, const struct sigaction *act,
82                           struct sigaction *oldact);
83typedef sig_t (*signal_f)(int signum, sig_t handler);
84typedef void (*longjmp_f)(void *env, int val);
85typedef longjmp_f _longjmp_f;
86typedef longjmp_f siglongjmp_f;
87typedef void (*__cxa_throw_f)(void *, void *, void *);
88typedef int (*pthread_create_f)(pthread_t *thread, const pthread_attr_t *attr,
89                                void *(*start_routine) (void *), void *arg);
90#ifdef __APPLE__
91dispatch_async_f_f real_dispatch_async_f;
92dispatch_sync_f_f real_dispatch_sync_f;
93dispatch_after_f_f real_dispatch_after_f;
94dispatch_barrier_async_f_f real_dispatch_barrier_async_f;
95dispatch_group_async_f_f real_dispatch_group_async_f;
96pthread_workqueue_additem_np_f real_pthread_workqueue_additem_np;
97#endif
98
99sigaction_f             real_sigaction;
100signal_f                real_signal;
101longjmp_f               real_longjmp;
102_longjmp_f              real__longjmp;
103siglongjmp_f            real_siglongjmp;
104__cxa_throw_f           real___cxa_throw;
105pthread_create_f        real_pthread_create;
106
107// -------------------------- Misc ---------------- {{{1
108void ShowStatsAndAbort() {
109  __asan_print_accumulated_stats();
110  ASAN_DIE;
111}
112
113static void PrintBytes(const char *before, uintptr_t *a) {
114  uint8_t *bytes = (uint8_t*)a;
115  size_t byte_num = (__WORDSIZE) / 8;
116  Printf("%s%p:", before, (uintptr_t)a);
117  for (size_t i = 0; i < byte_num; i++) {
118    Printf(" %lx%lx", bytes[i] >> 4, bytes[i] & 15);
119  }
120  Printf("\n");
121}
122
123// ---------------------- Thread ------------------------- {{{1
124static void *asan_thread_start(void *arg) {
125  AsanThread *t= (AsanThread*)arg;
126  asanThreadRegistry().SetCurrent(t);
127  return t->ThreadStart();
128}
129
130// ---------------------- mmap -------------------- {{{1
131static void OutOfMemoryMessage(const char *mem_type, size_t size) {
132  Report("ERROR: AddressSanitizer failed to allocate "
133         "0x%lx (%ld) bytes of %s\n",
134         size, size, mem_type);
135}
136
137static char *mmap_pages(size_t start_page, size_t n_pages, const char *mem_type,
138                        bool abort_on_failure = true) {
139  void *res = asan_mmap((void*)start_page, kPageSize * n_pages,
140                   PROT_READ | PROT_WRITE,
141                   MAP_PRIVATE | MAP_ANON | MAP_FIXED | MAP_NORESERVE, 0, 0);
142  // Printf("%p => %p\n", (void*)start_page, res);
143  char *ch = (char*)res;
144  if (res == (void*)-1L && abort_on_failure) {
145    OutOfMemoryMessage(mem_type, n_pages * kPageSize);
146    ShowStatsAndAbort();
147  }
148  CHECK(res == (void*)start_page || res == (void*)-1L);
149  return ch;
150}
151
152// mmap range [beg, end]
153static char *mmap_range(uintptr_t beg, uintptr_t end, const char *mem_type) {
154  CHECK((beg % kPageSize) == 0);
155  CHECK(((end + 1) % kPageSize) == 0);
156  // Printf("mmap_range %p %p %ld\n", beg, end, (end - beg) / kPageSize);
157  return mmap_pages(beg, (end - beg + 1) / kPageSize, mem_type);
158}
159
160// protect range [beg, end]
161static void protect_range(uintptr_t beg, uintptr_t end) {
162  CHECK((beg % kPageSize) == 0);
163  CHECK(((end+1) % kPageSize) == 0);
164  // Printf("protect_range %p %p %ld\n", beg, end, (end - beg) / kPageSize);
165  void *res = asan_mmap((void*)beg, end - beg + 1,
166                   PROT_NONE,
167                   MAP_PRIVATE | MAP_ANON | MAP_FIXED | MAP_NORESERVE, 0, 0);
168  CHECK(res == (void*)beg);
169}
170
171// ---------------------- LowLevelAllocator ------------- {{{1
172void *LowLevelAllocator::Allocate(size_t size) {
173  CHECK((size & (size - 1)) == 0 && "size must be a power of two");
174  if (allocated_end_ - allocated_current_ < size) {
175    size_t size_to_allocate = Max(size, kPageSize);
176    allocated_current_ = (char*)asan_mmap(0, size_to_allocate,
177                                          PROT_READ | PROT_WRITE,
178                                          MAP_PRIVATE | MAP_ANON, -1, 0);
179    CHECK((allocated_current_ != (char*)-1) && "Can't mmap");
180    allocated_end_ = allocated_current_ + size_to_allocate;
181    PoisonShadow((uintptr_t)allocated_current_, size_to_allocate,
182                 kAsanInternalHeapMagic);
183  }
184  CHECK(allocated_end_ - allocated_current_ >= size);
185  void *res = allocated_current_;
186  allocated_current_ += size;
187  return res;
188}
189
190// ---------------------- DescribeAddress -------------------- {{{1
191static bool DescribeStackAddress(uintptr_t addr, uintptr_t access_size) {
192  AsanThread *t = asanThreadRegistry().FindThreadByStackAddress(addr);
193  if (!t) return false;
194  const intptr_t kBufSize = 4095;
195  char buf[kBufSize];
196  uintptr_t offset = 0;
197  const char *frame_descr = t->GetFrameNameByAddr(addr, &offset);
198  // This string is created by the compiler and has the following form:
199  // "FunctioName n alloc_1 alloc_2 ... alloc_n"
200  // where alloc_i looks like "offset size len ObjectName ".
201  CHECK(frame_descr);
202  // Report the function name and the offset.
203  const char *name_end = real_strchr(frame_descr, ' ');
204  CHECK(name_end);
205  buf[0] = 0;
206  strncat(buf, frame_descr,
207          Min(kBufSize, static_cast<intptr_t>(name_end - frame_descr)));
208  Printf("Address %p is located at offset %ld "
209         "in frame <%s> of T%d's stack:\n",
210         addr, offset, buf, t->tid());
211  // Report the number of stack objects.
212  char *p;
213  size_t n_objects = strtol(name_end, &p, 10);
214  CHECK(n_objects > 0);
215  Printf("  This frame has %ld object(s):\n", n_objects);
216  // Report all objects in this frame.
217  for (size_t i = 0; i < n_objects; i++) {
218    size_t beg, size;
219    intptr_t len;
220    beg  = strtol(p, &p, 10);
221    size = strtol(p, &p, 10);
222    len  = strtol(p, &p, 10);
223    if (beg <= 0 || size <= 0 || len < 0 || *p != ' ') {
224      Printf("AddressSanitizer can't parse the stack frame descriptor: |%s|\n",
225             frame_descr);
226      break;
227    }
228    p++;
229    buf[0] = 0;
230    strncat(buf, p, Min(kBufSize, len));
231    p += len;
232    Printf("    [%ld, %ld) '%s'\n", beg, beg + size, buf);
233  }
234  Printf("HINT: this may be a false positive if your program uses "
235         "some custom stack unwind mechanism\n"
236         "      (longjmp and C++ exceptions *are* supported)\n");
237  t->summary()->Announce();
238  return true;
239}
240
241__attribute__((noinline))
242static void DescribeAddress(uintptr_t addr, uintptr_t access_size) {
243  // Check if this is a global.
244  if (DescribeAddrIfGlobal(addr))
245    return;
246
247  if (DescribeStackAddress(addr, access_size))
248    return;
249
250  // finally, check if this is a heap.
251  DescribeHeapAddress(addr, access_size);
252}
253
254// -------------------------- Run-time entry ------------------- {{{1
255void GetPcSpBpAx(void *context,
256                 uintptr_t *pc, uintptr_t *sp, uintptr_t *bp, uintptr_t *ax) {
257  ucontext_t *ucontext = (ucontext_t*)context;
258#ifdef __APPLE__
259# if __WORDSIZE == 64
260  *pc = ucontext->uc_mcontext->__ss.__rip;
261  *bp = ucontext->uc_mcontext->__ss.__rbp;
262  *sp = ucontext->uc_mcontext->__ss.__rsp;
263  *ax = ucontext->uc_mcontext->__ss.__rax;
264# else
265  *pc = ucontext->uc_mcontext->__ss.__eip;
266  *bp = ucontext->uc_mcontext->__ss.__ebp;
267  *sp = ucontext->uc_mcontext->__ss.__esp;
268  *ax = ucontext->uc_mcontext->__ss.__eax;
269# endif  // __WORDSIZE
270#else  // assume linux
271# if defined(__arm__)
272  *pc = ucontext->uc_mcontext.arm_pc;
273  *bp = ucontext->uc_mcontext.arm_fp;
274  *sp = ucontext->uc_mcontext.arm_sp;
275  *ax = ucontext->uc_mcontext.arm_r0;
276# elif __WORDSIZE == 64
277  *pc = ucontext->uc_mcontext.gregs[REG_RIP];
278  *bp = ucontext->uc_mcontext.gregs[REG_RBP];
279  *sp = ucontext->uc_mcontext.gregs[REG_RSP];
280  *ax = ucontext->uc_mcontext.gregs[REG_RAX];
281# else
282  *pc = ucontext->uc_mcontext.gregs[REG_EIP];
283  *bp = ucontext->uc_mcontext.gregs[REG_EBP];
284  *sp = ucontext->uc_mcontext.gregs[REG_ESP];
285  *ax = ucontext->uc_mcontext.gregs[REG_EAX];
286# endif  // __WORDSIZE
287#endif
288}
289
290static void     ASAN_OnSIGSEGV(int, siginfo_t *siginfo, void *context) {
291  uintptr_t addr = (uintptr_t)siginfo->si_addr;
292  if (AddrIsInShadow(addr) && FLAG_lazy_shadow) {
293    // We traped on access to a shadow address. Just map a large chunk around
294    // this address.
295    const uintptr_t chunk_size = kPageSize << 10;  // 4M
296    uintptr_t chunk = addr & ~(chunk_size - 1);
297    asan_mmap((void*)chunk, chunk_size,
298                   PROT_READ | PROT_WRITE,
299                   MAP_PRIVATE | MAP_ANON | MAP_FIXED, 0, 0);
300    return;
301  }
302  // Write the first message using the bullet-proof write.
303  if (13 != asan_write(2, "ASAN:SIGSEGV\n", 13)) ASAN_DIE;
304  uintptr_t pc, sp, bp, ax;
305  GetPcSpBpAx(context, &pc, &sp, &bp, &ax);
306  Report("ERROR: AddressSanitizer crashed on unknown address %p"
307         " (pc %p sp %p bp %p ax %p T%d)\n",
308         addr, pc, sp, bp, ax,
309         asanThreadRegistry().GetCurrentTidOrMinusOne());
310  Printf("AddressSanitizer can not provide additional info. ABORTING\n");
311  GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, false, pc, bp);
312  stack.PrintStack();
313  ShowStatsAndAbort();
314}
315
316static void     ASAN_OnSIGILL(int, siginfo_t *siginfo, void *context) {
317  // Write the first message using the bullet-proof write.
318  if (12 != asan_write(2, "ASAN:SIGILL\n", 12)) ASAN_DIE;
319  uintptr_t pc, sp, bp, ax;
320  GetPcSpBpAx(context, &pc, &sp, &bp, &ax);
321
322  uintptr_t addr = ax;
323
324  uint8_t *insn = (uint8_t*)pc;
325  CHECK(insn[0] == 0x0f && insn[1] == 0x0b);  // ud2
326  unsigned access_size_and_type = insn[2] - 0x50;
327  CHECK(access_size_and_type < 16);
328  bool is_write = access_size_and_type & 8;
329  int access_size = 1 << (access_size_and_type & 7);
330  __asan_report_error(pc, bp, sp, addr, is_write, access_size);
331}
332
333// exported functions
334#define ASAN_REPORT_ERROR(type, is_write, size)                     \
335extern "C" void __asan_report_ ## type ## size(uintptr_t addr)      \
336  __attribute__((visibility("default"))) __attribute__((noinline)); \
337extern "C" void __asan_report_ ## type ## size(uintptr_t addr) {    \
338  GET_BP_PC_SP;                                                     \
339  __asan_report_error(pc, bp, sp, addr, is_write, size);            \
340}
341
342ASAN_REPORT_ERROR(load, false, 1)
343ASAN_REPORT_ERROR(load, false, 2)
344ASAN_REPORT_ERROR(load, false, 4)
345ASAN_REPORT_ERROR(load, false, 8)
346ASAN_REPORT_ERROR(load, false, 16)
347ASAN_REPORT_ERROR(store, true, 1)
348ASAN_REPORT_ERROR(store, true, 2)
349ASAN_REPORT_ERROR(store, true, 4)
350ASAN_REPORT_ERROR(store, true, 8)
351ASAN_REPORT_ERROR(store, true, 16)
352
353// Force the linker to keep the symbols for various ASan interface functions.
354// We want to keep those in the executable in order to let the instrumented
355// dynamic libraries access the symbol even if it is not used by the executable
356// itself. This should help if the build system is removing dead code at link
357// time.
358static void force_interface_symbols() {
359  volatile int fake_condition = 0;  // prevent dead condition elimination.
360  if (fake_condition) {
361    __asan_report_load1(NULL);
362    __asan_report_load2(NULL);
363    __asan_report_load4(NULL);
364    __asan_report_load8(NULL);
365    __asan_report_load16(NULL);
366    __asan_report_store1(NULL);
367    __asan_report_store2(NULL);
368    __asan_report_store4(NULL);
369    __asan_report_store8(NULL);
370    __asan_report_store16(NULL);
371    __asan_register_global(0, 0, NULL);
372    __asan_register_globals(NULL, 0);
373  }
374}
375
376// -------------------------- Init ------------------- {{{1
377static int64_t IntFlagValue(const char *flags, const char *flag,
378                            int64_t default_val) {
379  if (!flags) return default_val;
380  const char *str = strstr(flags, flag);
381  if (!str) return default_val;
382  return atoll(str + internal_strlen(flag));
383}
384
385static void asan_atexit() {
386  Printf("AddressSanitizer exit stats:\n");
387  __asan_print_accumulated_stats();
388}
389
390void CheckFailed(const char *cond, const char *file, int line) {
391  Report("CHECK failed: %s at %s:%d, pthread_self=%p\n",
392         cond, file, line, pthread_self());
393  PRINT_CURRENT_STACK();
394  ShowStatsAndAbort();
395}
396
397}  // namespace __asan
398
399// -------------------------- Interceptors ------------------- {{{1
400using namespace __asan;  // NOLINT
401
402#define OPERATOR_NEW_BODY \
403  GET_STACK_TRACE_HERE_FOR_MALLOC;\
404  return asan_memalign(0, size, &stack);
405
406#ifdef ANDROID
407void *operator new(size_t size) { OPERATOR_NEW_BODY; }
408void *operator new[](size_t size) { OPERATOR_NEW_BODY; }
409#else
410void *operator new(size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; }
411void *operator new[](size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; }
412void *operator new(size_t size, std::nothrow_t const&) throw()
413{ OPERATOR_NEW_BODY; }
414void *operator new[](size_t size, std::nothrow_t const&) throw()
415{ OPERATOR_NEW_BODY; }
416#endif
417
418#define OPERATOR_DELETE_BODY \
419  GET_STACK_TRACE_HERE_FOR_FREE(ptr);\
420  asan_free(ptr, &stack);
421
422void operator delete(void *ptr) throw() { OPERATOR_DELETE_BODY; }
423void operator delete[](void *ptr) throw() { OPERATOR_DELETE_BODY; }
424void operator delete(void *ptr, std::nothrow_t const&) throw()
425{ OPERATOR_DELETE_BODY; }
426void operator delete[](void *ptr, std::nothrow_t const&) throw()
427{ OPERATOR_DELETE_BODY;}
428
429extern "C"
430#ifndef __APPLE__
431__attribute__((visibility("default")))
432#endif
433int WRAP(pthread_create)(pthread_t *thread, const pthread_attr_t *attr,
434                         void *(*start_routine) (void *), void *arg) {
435  GET_STACK_TRACE_HERE(kStackTraceMax, /*fast_unwind*/false);
436  AsanThread *t = (AsanThread*)asan_malloc(sizeof(AsanThread), &stack);
437  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
438  CHECK(curr_thread || asanThreadRegistry().IsCurrentThreadDying());
439  new(t) AsanThread(asanThreadRegistry().GetCurrentTidOrMinusOne(),
440                    start_routine, arg, &stack);
441  return real_pthread_create(thread, attr, asan_thread_start, t);
442}
443
444static bool MySignal(int signum) {
445  if (FLAG_handle_sigill && signum == SIGILL) return true;
446  if (FLAG_handle_segv && signum == SIGSEGV) return true;
447#ifdef __APPLE__
448  if (FLAG_handle_segv && signum == SIGBUS) return true;
449#endif
450  return false;
451}
452
453static void MaybeInstallSigaction(int signum,
454                                  void (*handler)(int, siginfo_t *, void *)) {
455  if (!MySignal(signum))
456    return;
457  struct sigaction sigact;
458  real_memset(&sigact, 0, sizeof(sigact));
459  sigact.sa_sigaction = handler;
460  sigact.sa_flags = SA_SIGINFO;
461  CHECK(0 == real_sigaction(signum, &sigact, 0));
462}
463
464extern "C"
465sig_t WRAP(signal)(int signum, sig_t handler) {
466  if (!MySignal(signum)) {
467    return real_signal(signum, handler);
468  }
469  return NULL;
470}
471
472extern "C"
473int WRAP(sigaction)(int signum, const struct sigaction *act,
474                    struct sigaction *oldact) {
475  if (!MySignal(signum)) {
476    return real_sigaction(signum, act, oldact);
477  }
478  return 0;
479}
480
481
482static void UnpoisonStackFromHereToTop() {
483  int local_stack;
484  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
485  CHECK(curr_thread);
486  uintptr_t top = curr_thread->stack_top();
487  uintptr_t bottom = ((uintptr_t)&local_stack - kPageSize) & ~(kPageSize-1);
488  PoisonShadow(bottom, top - bottom, 0);
489}
490
491extern "C" void WRAP(longjmp)(void *env, int val) {
492  UnpoisonStackFromHereToTop();
493  real_longjmp(env, val);
494}
495
496extern "C" void WRAP(_longjmp)(void *env, int val) {
497  UnpoisonStackFromHereToTop();
498  real__longjmp(env, val);
499}
500
501extern "C" void WRAP(siglongjmp)(void *env, int val) {
502  UnpoisonStackFromHereToTop();
503  real_siglongjmp(env, val);
504}
505
506extern "C" void __cxa_throw(void *a, void *b, void *c);
507
508#if ASAN_HAS_EXCEPTIONS == 1
509extern "C" void WRAP(__cxa_throw)(void *a, void *b, void *c) {
510  CHECK(&real___cxa_throw);
511  UnpoisonStackFromHereToTop();
512  real___cxa_throw(a, b, c);
513}
514#endif
515
516extern "C" {
517// intercept mlock and friends.
518// Since asan maps 16T of RAM, mlock is completely unfriendly to asan.
519// All functions return 0 (success).
520static void MlockIsUnsupported() {
521  static bool printed = 0;
522  if (printed) return;
523  printed = true;
524  Printf("INFO: AddressSanitizer ignores mlock/mlockall/munlock/munlockall\n");
525}
526int mlock(const void *addr, size_t len) {
527  MlockIsUnsupported();
528  return 0;
529}
530int munlock(const void *addr, size_t len) {
531  MlockIsUnsupported();
532  return 0;
533}
534int mlockall(int flags) {
535  MlockIsUnsupported();
536  return 0;
537}
538int munlockall(void) {
539  MlockIsUnsupported();
540  return 0;
541}
542}  // extern "C"
543
544// ---------------------- Interface ---------------- {{{1
545int __asan_set_error_exit_code(int exit_code) {
546  int old = FLAG_exitcode;
547  FLAG_exitcode = exit_code;
548  return old;
549}
550
551void __asan_report_error(uintptr_t pc, uintptr_t bp, uintptr_t sp,
552                         uintptr_t addr, bool is_write, size_t access_size) {
553  // Do not print more than one report, otherwise they will mix up.
554  static int num_calls = 0;
555  if (AtomicInc(&num_calls) > 1) return;
556
557  Printf("=================================================================\n");
558  const char *bug_descr = "unknown-crash";
559  if (AddrIsInMem(addr)) {
560    uint8_t *shadow_addr = (uint8_t*)MemToShadow(addr);
561    // If we are accessing 16 bytes, look at the second shadow byte.
562    if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY)
563      shadow_addr++;
564    // If we are in the partial right redzone, look at the next shadow byte.
565    if (*shadow_addr > 0 && *shadow_addr < 128)
566      shadow_addr++;
567    switch (*shadow_addr) {
568      case kAsanHeapLeftRedzoneMagic:
569      case kAsanHeapRightRedzoneMagic:
570        bug_descr = "heap-buffer-overflow";
571        break;
572      case kAsanHeapFreeMagic:
573        bug_descr = "heap-use-after-free";
574        break;
575      case kAsanStackLeftRedzoneMagic:
576        bug_descr = "stack-buffer-underflow";
577        break;
578      case kAsanStackMidRedzoneMagic:
579      case kAsanStackRightRedzoneMagic:
580      case kAsanStackPartialRedzoneMagic:
581        bug_descr = "stack-buffer-overflow";
582        break;
583      case kAsanStackAfterReturnMagic:
584        bug_descr = "stack-use-after-return";
585        break;
586      case kAsanUserPoisonedMemoryMagic:
587        bug_descr = "use-after-poison";
588        break;
589      case kAsanGlobalRedzoneMagic:
590        bug_descr = "global-buffer-overflow";
591        break;
592    }
593  }
594
595  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
596  int curr_tid = asanThreadRegistry().GetCurrentTidOrMinusOne();
597
598  if (curr_thread) {
599    // We started reporting an error message. Stop using the fake stack
600    // in case we will call an instrumented function from a symbolizer.
601    curr_thread->fake_stack().StopUsingFakeStack();
602  }
603
604  Report("ERROR: AddressSanitizer %s on address "
605         "%p at pc 0x%lx bp 0x%lx sp 0x%lx\n",
606         bug_descr, addr, pc, bp, sp);
607
608  Printf("%s of size %d at %p thread T%d\n",
609         access_size ? (is_write ? "WRITE" : "READ") : "ACCESS",
610         access_size, addr, curr_tid);
611
612  if (FLAG_debug) {
613    PrintBytes("PC: ", (uintptr_t*)pc);
614  }
615
616  GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax,
617                                 false,  // FLAG_fast_unwind,
618                                 pc, bp);
619  stack.PrintStack();
620
621  CHECK(AddrIsInMem(addr));
622
623  DescribeAddress(addr, access_size);
624
625  uintptr_t shadow_addr = MemToShadow(addr);
626  Report("ABORTING\n");
627  __asan_print_accumulated_stats();
628  Printf("Shadow byte and word:\n");
629  Printf("  %p: %x\n", shadow_addr, *(unsigned char*)shadow_addr);
630  uintptr_t aligned_shadow = shadow_addr & ~(kWordSize - 1);
631  PrintBytes("  ", (uintptr_t*)(aligned_shadow));
632  Printf("More shadow bytes:\n");
633  PrintBytes("  ", (uintptr_t*)(aligned_shadow-4*kWordSize));
634  PrintBytes("  ", (uintptr_t*)(aligned_shadow-3*kWordSize));
635  PrintBytes("  ", (uintptr_t*)(aligned_shadow-2*kWordSize));
636  PrintBytes("  ", (uintptr_t*)(aligned_shadow-1*kWordSize));
637  PrintBytes("=>", (uintptr_t*)(aligned_shadow+0*kWordSize));
638  PrintBytes("  ", (uintptr_t*)(aligned_shadow+1*kWordSize));
639  PrintBytes("  ", (uintptr_t*)(aligned_shadow+2*kWordSize));
640  PrintBytes("  ", (uintptr_t*)(aligned_shadow+3*kWordSize));
641  PrintBytes("  ", (uintptr_t*)(aligned_shadow+4*kWordSize));
642  ASAN_DIE;
643}
644
645void __asan_init() {
646  if (asan_inited) return;
647  asan_init_is_running = true;
648
649  // Make sure we are not statically linked.
650  AsanDoesNotSupportStaticLinkage();
651
652  // flags
653  const char *options = getenv("ASAN_OPTIONS");
654  FLAG_malloc_context_size =
655      IntFlagValue(options, "malloc_context_size=", kMallocContextSize);
656  CHECK(FLAG_malloc_context_size <= kMallocContextSize);
657
658  FLAG_max_malloc_fill_size =
659      IntFlagValue(options, "max_malloc_fill_size=", 0);
660
661  FLAG_v = IntFlagValue(options, "verbosity=", 0);
662
663  FLAG_redzone = IntFlagValue(options, "redzone=", 128);
664  CHECK(FLAG_redzone >= 32);
665  CHECK((FLAG_redzone & (FLAG_redzone - 1)) == 0);
666
667  FLAG_atexit = IntFlagValue(options, "atexit=", 0);
668  FLAG_poison_shadow = IntFlagValue(options, "poison_shadow=", 1);
669  FLAG_report_globals = IntFlagValue(options, "report_globals=", 1);
670  FLAG_lazy_shadow = IntFlagValue(options, "lazy_shadow=", 0);
671  FLAG_handle_segv = IntFlagValue(options, "handle_segv=", ASAN_NEEDS_SEGV);
672  FLAG_handle_sigill = IntFlagValue(options, "handle_sigill=", 0);
673  FLAG_symbolize = IntFlagValue(options, "symbolize=", 1);
674  FLAG_demangle = IntFlagValue(options, "demangle=", 1);
675  FLAG_debug = IntFlagValue(options, "debug=", 0);
676  FLAG_replace_cfallocator = IntFlagValue(options, "replace_cfallocator=", 1);
677  FLAG_fast_unwind = IntFlagValue(options, "fast_unwind=", 1);
678  FLAG_replace_str = IntFlagValue(options, "replace_str=", 1);
679  FLAG_replace_intrin = IntFlagValue(options, "replace_intrin=", 0);
680  FLAG_use_fake_stack = IntFlagValue(options, "use_fake_stack=", 1);
681  FLAG_exitcode = IntFlagValue(options, "exitcode=", EXIT_FAILURE);
682  FLAG_allow_user_poisoning = IntFlagValue(options,
683                                           "allow_user_poisoning=", 1);
684
685  if (FLAG_atexit) {
686    atexit(asan_atexit);
687  }
688
689  FLAG_quarantine_size =
690      IntFlagValue(options, "quarantine_size=", 1UL << 28);
691
692  // interceptors
693  InitializeAsanInterceptors();
694
695  ReplaceSystemMalloc();
696
697  INTERCEPT_FUNCTION(sigaction);
698  INTERCEPT_FUNCTION(signal);
699  INTERCEPT_FUNCTION(longjmp);
700  INTERCEPT_FUNCTION(_longjmp);
701  INTERCEPT_FUNCTION_IF_EXISTS(__cxa_throw);
702  INTERCEPT_FUNCTION(pthread_create);
703#ifdef __APPLE__
704  INTERCEPT_FUNCTION(dispatch_async_f);
705  INTERCEPT_FUNCTION(dispatch_sync_f);
706  INTERCEPT_FUNCTION(dispatch_after_f);
707  INTERCEPT_FUNCTION(dispatch_barrier_async_f);
708  INTERCEPT_FUNCTION(dispatch_group_async_f);
709  // We don't need to intercept pthread_workqueue_additem_np() to support the
710  // libdispatch API, but it helps us to debug the unsupported functions. Let's
711  // intercept it only during verbose runs.
712  if (FLAG_v >= 2) {
713    INTERCEPT_FUNCTION(pthread_workqueue_additem_np);
714  }
715#else
716  // On Darwin siglongjmp tailcalls longjmp, so we don't want to intercept it
717  // there.
718  INTERCEPT_FUNCTION(siglongjmp);
719#endif
720
721  MaybeInstallSigaction(SIGSEGV, ASAN_OnSIGSEGV);
722  MaybeInstallSigaction(SIGBUS, ASAN_OnSIGSEGV);
723  MaybeInstallSigaction(SIGILL, ASAN_OnSIGILL);
724
725  if (FLAG_v) {
726    Printf("|| `[%p, %p]` || HighMem    ||\n", kHighMemBeg, kHighMemEnd);
727    Printf("|| `[%p, %p]` || HighShadow ||\n",
728           kHighShadowBeg, kHighShadowEnd);
729    Printf("|| `[%p, %p]` || ShadowGap  ||\n",
730           kShadowGapBeg, kShadowGapEnd);
731    Printf("|| `[%p, %p]` || LowShadow  ||\n",
732           kLowShadowBeg, kLowShadowEnd);
733    Printf("|| `[%p, %p]` || LowMem     ||\n", kLowMemBeg, kLowMemEnd);
734    Printf("MemToShadow(shadow): %p %p %p %p\n",
735           MEM_TO_SHADOW(kLowShadowBeg),
736           MEM_TO_SHADOW(kLowShadowEnd),
737           MEM_TO_SHADOW(kHighShadowBeg),
738           MEM_TO_SHADOW(kHighShadowEnd));
739    Printf("red_zone=%ld\n", FLAG_redzone);
740    Printf("malloc_context_size=%ld\n", (int)FLAG_malloc_context_size);
741    Printf("fast_unwind=%d\n", (int)FLAG_fast_unwind);
742
743    Printf("SHADOW_SCALE: %lx\n", SHADOW_SCALE);
744    Printf("SHADOW_GRANULARITY: %lx\n", SHADOW_GRANULARITY);
745    Printf("SHADOW_OFFSET: %lx\n", SHADOW_OFFSET);
746    CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7);
747  }
748
749  if (__WORDSIZE == 64) {
750    // Disable core dumper -- it makes little sense to dump 16T+ core.
751    struct rlimit nocore;
752    nocore.rlim_cur = 0;
753    nocore.rlim_max = 0;
754    setrlimit(RLIMIT_CORE, &nocore);
755  }
756
757  {
758    if (!FLAG_lazy_shadow) {
759      if (kLowShadowBeg != kLowShadowEnd) {
760        // mmap the low shadow plus one page.
761        mmap_range(kLowShadowBeg - kPageSize, kLowShadowEnd, "LowShadow");
762      }
763      // mmap the high shadow.
764      mmap_range(kHighShadowBeg, kHighShadowEnd, "HighShadow");
765    }
766    // protect the gap
767    protect_range(kShadowGapBeg, kShadowGapEnd);
768  }
769
770  // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
771  // should be set to 1 prior to initializing the threads.
772  asan_inited = 1;
773  asan_init_is_running = false;
774
775  asanThreadRegistry().Init();
776  asanThreadRegistry().GetMain()->ThreadStart();
777  force_interface_symbols();  // no-op.
778
779  if (FLAG_v) {
780    Report("AddressSanitizer Init done\n");
781  }
782}
783