asan_allocator2.cc revision 709a33e1cf20eb7f00653fe32dc07714b3f2c633
1//===-- asan_allocator2.cc ------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Implementation of ASan's memory allocator, 2-nd version. 13// This variant uses the allocator from sanitizer_common, i.e. the one shared 14// with ThreadSanitizer and MemorySanitizer. 15// 16// Status: under development, not enabled by default yet. 17//===----------------------------------------------------------------------===// 18#include "asan_allocator.h" 19#if ASAN_ALLOCATOR_VERSION == 2 20 21#include "asan_mapping.h" 22#include "asan_report.h" 23#include "asan_thread.h" 24#include "asan_thread_registry.h" 25#include "sanitizer/asan_interface.h" 26#include "sanitizer_common/sanitizer_allocator.h" 27#include "sanitizer_common/sanitizer_internal_defs.h" 28#include "sanitizer_common/sanitizer_list.h" 29#include "sanitizer_common/sanitizer_stackdepot.h" 30 31namespace __asan { 32 33struct AsanMapUnmapCallback { 34 void OnMap(uptr p, uptr size) const { 35 PoisonShadow(p, size, kAsanHeapLeftRedzoneMagic); 36 // Statistics. 37 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 38 thread_stats.mmaps++; 39 thread_stats.mmaped += size; 40 // thread_stats.mmaped_by_size[size_class] += n_chunks; 41 } 42 void OnUnmap(uptr p, uptr size) const { 43 PoisonShadow(p, size, 0); 44 // Statistics. 45 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 46 thread_stats.munmaps++; 47 thread_stats.munmaped += size; 48 } 49}; 50 51#if SANITIZER_WORDSIZE == 64 52const uptr kAllocatorSpace = 0x600000000000ULL; 53const uptr kAllocatorSize = 0x10000000000ULL; // 1T. 54typedef DefaultSizeClassMap SizeClassMap; 55typedef SizeClassAllocator64<kAllocatorSpace, kAllocatorSize, 0 /*metadata*/, 56 SizeClassMap, AsanMapUnmapCallback> PrimaryAllocator; 57#elif SANITIZER_WORDSIZE == 32 58static const u64 kAddressSpaceSize = 1ULL << 32; 59typedef CompactSizeClassMap SizeClassMap; 60typedef SizeClassAllocator32<0, kAddressSpaceSize, 16, 61 SizeClassMap, AsanMapUnmapCallback> PrimaryAllocator; 62#endif 63 64typedef SizeClassAllocatorLocalCache<PrimaryAllocator> AllocatorCache; 65typedef LargeMmapAllocator<AsanMapUnmapCallback> SecondaryAllocator; 66typedef CombinedAllocator<PrimaryAllocator, AllocatorCache, 67 SecondaryAllocator> Allocator; 68 69// We can not use THREADLOCAL because it is not supported on some of the 70// platforms we care about (OSX 10.6, Android). 71// static THREADLOCAL AllocatorCache cache; 72AllocatorCache *GetAllocatorCache(AsanThreadLocalMallocStorage *ms) { 73 CHECK(ms); 74 CHECK_LE(sizeof(AllocatorCache), sizeof(ms->allocator2_cache)); 75 return reinterpret_cast<AllocatorCache *>(ms->allocator2_cache); 76} 77 78static Allocator allocator; 79 80static const uptr kMaxAllowedMallocSize = 81 FIRST_32_SECOND_64(3UL << 30, 8UL << 30); 82 83static const uptr kMaxThreadLocalQuarantine = 84 FIRST_32_SECOND_64(1 << 18, 1 << 20); 85 86static const uptr kReturnOnZeroMalloc = 2048; // Zero page is protected. 87 88static int inited = 0; 89 90static void Init() { 91 if (inited) return; 92 __asan_init(); 93 inited = true; // this must happen before any threads are created. 94 allocator.Init(); 95} 96 97// Every chunk of memory allocated by this allocator can be in one of 3 states: 98// CHUNK_AVAILABLE: the chunk is in the free list and ready to be allocated. 99// CHUNK_ALLOCATED: the chunk is allocated and not yet freed. 100// CHUNK_QUARANTINE: the chunk was freed and put into quarantine zone. 101enum { 102 CHUNK_AVAILABLE = 0, // 0 is the default value even if we didn't set it. 103 CHUNK_ALLOCATED = 2, 104 CHUNK_QUARANTINE = 3 105}; 106 107// Valid redzone sizes are 16, 32, 64, ... 2048, so we encode them in 3 bits. 108// We use adaptive redzones: for larger allocation larger redzones are used. 109static u32 RZLog2Size(u32 rz_log) { 110 CHECK_LT(rz_log, 8); 111 return 16 << rz_log; 112} 113 114static u32 RZSize2Log(u32 rz_size) { 115 CHECK_GE(rz_size, 16); 116 CHECK_LE(rz_size, 2048); 117 CHECK(IsPowerOfTwo(rz_size)); 118 u32 res = __builtin_ctz(rz_size) - 4; 119 CHECK_EQ(rz_size, RZLog2Size(res)); 120 return res; 121} 122 123static uptr ComputeRZLog(uptr user_requested_size) { 124 u32 rz_log = 125 user_requested_size <= 64 - 16 ? 0 : 126 user_requested_size <= 128 - 32 ? 1 : 127 user_requested_size <= 512 - 64 ? 2 : 128 user_requested_size <= 4096 - 128 ? 3 : 129 user_requested_size <= (1 << 14) - 256 ? 4 : 130 user_requested_size <= (1 << 15) - 512 ? 5 : 131 user_requested_size <= (1 << 16) - 1024 ? 6 : 7; 132 return Max(rz_log, RZSize2Log(flags()->redzone)); 133} 134 135// The memory chunk allocated from the underlying allocator looks like this: 136// L L L L L L H H U U U U U U R R 137// L -- left redzone words (0 or more bytes) 138// H -- ChunkHeader (16 bytes), which is also a part of the left redzone. 139// U -- user memory. 140// R -- right redzone (0 or more bytes) 141// ChunkBase consists of ChunkHeader and other bytes that overlap with user 142// memory. 143 144// If a memory chunk is allocated by memalign and we had to increase the 145// allocation size to achieve the proper alignment, then we store this magic 146// value in the first uptr word of the memory block and store the address of 147// ChunkBase in the next uptr. 148// M B ? ? ? L L L L L L H H U U U U U U 149// M -- magic value kMemalignMagic 150// B -- address of ChunkHeader pointing to the first 'H' 151static const uptr kMemalignMagic = 0xCC6E96B9; 152 153struct ChunkHeader { 154 // 1-st 8 bytes. 155 u32 chunk_state : 8; // Must be first. 156 u32 alloc_tid : 24; 157 158 u32 free_tid : 24; 159 u32 from_memalign : 1; 160 u32 alloc_type : 2; 161 u32 rz_log : 3; 162 // 2-nd 8 bytes 163 // This field is used for small sizes. For large sizes it is equal to 164 // SizeClassMap::kMaxSize and the actual size is stored in the 165 // SecondaryAllocator's metadata. 166 u32 user_requested_size; 167 u32 alloc_context_id; 168}; 169 170struct ChunkBase : ChunkHeader { 171 // Header2, intersects with user memory. 172 AsanChunk *next; 173 u32 free_context_id; 174}; 175 176static const uptr kChunkHeaderSize = sizeof(ChunkHeader); 177static const uptr kChunkHeader2Size = sizeof(ChunkBase) - kChunkHeaderSize; 178COMPILER_CHECK(kChunkHeaderSize == 16); 179COMPILER_CHECK(kChunkHeader2Size <= 16); 180 181struct AsanChunk: ChunkBase { 182 uptr Beg() { return reinterpret_cast<uptr>(this) + kChunkHeaderSize; } 183 uptr UsedSize() { 184 if (user_requested_size != SizeClassMap::kMaxSize) 185 return user_requested_size; 186 return *reinterpret_cast<uptr *>(allocator.GetMetaData(AllocBeg())); 187 } 188 void *AllocBeg() { 189 if (from_memalign) 190 return allocator.GetBlockBegin(reinterpret_cast<void *>(this)); 191 return reinterpret_cast<void*>(Beg() - RZLog2Size(rz_log)); 192 } 193 // We store the alloc/free stack traces in the chunk itself. 194 u32 *AllocStackBeg() { 195 return (u32*)(Beg() - RZLog2Size(rz_log)); 196 } 197 uptr AllocStackSize() { 198 CHECK_LE(RZLog2Size(rz_log), kChunkHeaderSize); 199 return (RZLog2Size(rz_log) - kChunkHeaderSize) / sizeof(u32); 200 } 201 u32 *FreeStackBeg() { 202 return (u32*)(Beg() + kChunkHeader2Size); 203 } 204 uptr FreeStackSize() { 205 if (user_requested_size < kChunkHeader2Size) return 0; 206 uptr available = RoundUpTo(user_requested_size, SHADOW_GRANULARITY); 207 return (available - kChunkHeader2Size) / sizeof(u32); 208 } 209}; 210 211uptr AsanChunkView::Beg() { return chunk_->Beg(); } 212uptr AsanChunkView::End() { return Beg() + UsedSize(); } 213uptr AsanChunkView::UsedSize() { return chunk_->UsedSize(); } 214uptr AsanChunkView::AllocTid() { return chunk_->alloc_tid; } 215uptr AsanChunkView::FreeTid() { return chunk_->free_tid; } 216 217static void GetStackTraceFromId(u32 id, StackTrace *stack) { 218 CHECK(id); 219 uptr size = 0; 220 const uptr *trace = StackDepotGet(id, &size); 221 CHECK_LT(size, kStackTraceMax); 222 internal_memcpy(stack->trace, trace, sizeof(uptr) * size); 223 stack->size = size; 224} 225 226void AsanChunkView::GetAllocStack(StackTrace *stack) { 227 if (flags()->use_stack_depot) 228 GetStackTraceFromId(chunk_->alloc_context_id, stack); 229 else 230 StackTrace::UncompressStack(stack, chunk_->AllocStackBeg(), 231 chunk_->AllocStackSize()); 232} 233 234void AsanChunkView::GetFreeStack(StackTrace *stack) { 235 if (flags()->use_stack_depot) 236 GetStackTraceFromId(chunk_->free_context_id, stack); 237 else 238 StackTrace::UncompressStack(stack, chunk_->FreeStackBeg(), 239 chunk_->FreeStackSize()); 240} 241 242class Quarantine: public AsanChunkFifoList { 243 public: 244 void SwallowThreadLocalQuarantine(AsanThreadLocalMallocStorage *ms) { 245 AsanChunkFifoList *q = &ms->quarantine_; 246 if (!q->size()) return; 247 SpinMutexLock l(&mutex_); 248 PushList(q); 249 PopAndDeallocateLoop(ms); 250 } 251 252 void BypassThreadLocalQuarantine(AsanChunk *m) { 253 SpinMutexLock l(&mutex_); 254 Push(m); 255 } 256 257 private: 258 void PopAndDeallocateLoop(AsanThreadLocalMallocStorage *ms) { 259 while (size() > (uptr)flags()->quarantine_size) { 260 PopAndDeallocate(ms); 261 } 262 } 263 void PopAndDeallocate(AsanThreadLocalMallocStorage *ms) { 264 CHECK_GT(size(), 0); 265 AsanChunk *m = Pop(); 266 CHECK(m); 267 CHECK(m->chunk_state == CHUNK_QUARANTINE); 268 m->chunk_state = CHUNK_AVAILABLE; 269 CHECK_NE(m->alloc_tid, kInvalidTid); 270 CHECK_NE(m->free_tid, kInvalidTid); 271 PoisonShadow(m->Beg(), 272 RoundUpTo(m->UsedSize(), SHADOW_GRANULARITY), 273 kAsanHeapLeftRedzoneMagic); 274 void *p = reinterpret_cast<void *>(m->AllocBeg()); 275 if (m->from_memalign) { 276 uptr *memalign_magic = reinterpret_cast<uptr *>(p); 277 CHECK_EQ(memalign_magic[0], kMemalignMagic); 278 CHECK_EQ(memalign_magic[1], reinterpret_cast<uptr>(m)); 279 } 280 281 // Statistics. 282 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 283 thread_stats.real_frees++; 284 thread_stats.really_freed += m->UsedSize(); 285 286 allocator.Deallocate(GetAllocatorCache(ms), p); 287 } 288 SpinMutex mutex_; 289}; 290 291static Quarantine quarantine; 292 293void AsanChunkFifoList::PushList(AsanChunkFifoList *q) { 294 CHECK(q->size() > 0); 295 size_ += q->size(); 296 append_back(q); 297 q->clear(); 298} 299 300void AsanChunkFifoList::Push(AsanChunk *n) { 301 push_back(n); 302 size_ += n->UsedSize(); 303} 304 305// Interesting performance observation: this function takes up to 15% of overal 306// allocator time. That's because *first_ has been evicted from cache long time 307// ago. Not sure if we can or want to do anything with this. 308AsanChunk *AsanChunkFifoList::Pop() { 309 CHECK(first_); 310 AsanChunk *res = front(); 311 size_ -= res->UsedSize(); 312 pop_front(); 313 return res; 314} 315 316static void *Allocate(uptr size, uptr alignment, StackTrace *stack, 317 AllocType alloc_type) { 318 Init(); 319 CHECK(stack); 320 const uptr min_alignment = SHADOW_GRANULARITY; 321 if (alignment < min_alignment) 322 alignment = min_alignment; 323 if (size == 0) { 324 if (alignment <= kReturnOnZeroMalloc) 325 return reinterpret_cast<void *>(kReturnOnZeroMalloc); 326 else 327 return 0; // 0 bytes with large alignment requested. Just return 0. 328 } 329 CHECK(IsPowerOfTwo(alignment)); 330 uptr rz_log = ComputeRZLog(size); 331 uptr rz_size = RZLog2Size(rz_log); 332 uptr rounded_size = RoundUpTo(size, alignment); 333 if (rounded_size < kChunkHeader2Size) 334 rounded_size = kChunkHeader2Size; 335 uptr needed_size = rounded_size + rz_size; 336 if (alignment > min_alignment) 337 needed_size += alignment; 338 bool using_primary_allocator = true; 339 // If we are allocating from the secondary allocator, there will be no 340 // automatic right redzone, so add the right redzone manually. 341 if (!PrimaryAllocator::CanAllocate(needed_size, alignment)) { 342 needed_size += rz_size; 343 using_primary_allocator = false; 344 } 345 CHECK(IsAligned(needed_size, min_alignment)); 346 if (size > kMaxAllowedMallocSize || needed_size > kMaxAllowedMallocSize) { 347 Report("WARNING: AddressSanitizer failed to allocate %p bytes\n", 348 (void*)size); 349 return 0; 350 } 351 352 AsanThread *t = asanThreadRegistry().GetCurrent(); 353 AllocatorCache *cache = t ? GetAllocatorCache(&t->malloc_storage()) : 0; 354 void *allocated = allocator.Allocate(cache, needed_size, 8, false); 355 uptr alloc_beg = reinterpret_cast<uptr>(allocated); 356 uptr alloc_end = alloc_beg + needed_size; 357 uptr beg_plus_redzone = alloc_beg + rz_size; 358 uptr user_beg = beg_plus_redzone; 359 if (!IsAligned(user_beg, alignment)) 360 user_beg = RoundUpTo(user_beg, alignment); 361 uptr user_end = user_beg + size; 362 CHECK_LE(user_end, alloc_end); 363 uptr chunk_beg = user_beg - kChunkHeaderSize; 364 AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 365 m->chunk_state = CHUNK_ALLOCATED; 366 m->alloc_type = alloc_type; 367 m->rz_log = rz_log; 368 u32 alloc_tid = t ? t->tid() : 0; 369 m->alloc_tid = alloc_tid; 370 CHECK_EQ(alloc_tid, m->alloc_tid); // Does alloc_tid fit into the bitfield? 371 m->free_tid = kInvalidTid; 372 m->from_memalign = user_beg != beg_plus_redzone; 373 if (m->from_memalign) { 374 CHECK_LE(beg_plus_redzone + 2 * sizeof(uptr), user_beg); 375 uptr *memalign_magic = reinterpret_cast<uptr *>(alloc_beg); 376 memalign_magic[0] = kMemalignMagic; 377 memalign_magic[1] = chunk_beg; 378 } 379 if (using_primary_allocator) { 380 CHECK(size); 381 m->user_requested_size = size; 382 CHECK(allocator.FromPrimary(allocated)); 383 } else { 384 CHECK(!allocator.FromPrimary(allocated)); 385 m->user_requested_size = SizeClassMap::kMaxSize; 386 uptr *meta = reinterpret_cast<uptr *>(allocator.GetMetaData(allocated)); 387 meta[0] = size; 388 meta[1] = chunk_beg; 389 } 390 391 if (flags()->use_stack_depot) { 392 m->alloc_context_id = StackDepotPut(stack->trace, stack->size); 393 } else { 394 m->alloc_context_id = 0; 395 StackTrace::CompressStack(stack, m->AllocStackBeg(), m->AllocStackSize()); 396 } 397 398 uptr size_rounded_down_to_granularity = RoundDownTo(size, SHADOW_GRANULARITY); 399 // Unpoison the bulk of the memory region. 400 if (size_rounded_down_to_granularity) 401 PoisonShadow(user_beg, size_rounded_down_to_granularity, 0); 402 // Deal with the end of the region if size is not aligned to granularity. 403 if (size != size_rounded_down_to_granularity && flags()->poison_heap) { 404 u8 *shadow = (u8*)MemToShadow(user_beg + size_rounded_down_to_granularity); 405 *shadow = size & (SHADOW_GRANULARITY - 1); 406 } 407 408 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 409 thread_stats.mallocs++; 410 thread_stats.malloced += size; 411 thread_stats.malloced_redzones += needed_size - size; 412 uptr class_id = Min(kNumberOfSizeClasses, SizeClassMap::ClassID(needed_size)); 413 thread_stats.malloced_by_size[class_id]++; 414 if (needed_size > SizeClassMap::kMaxSize) 415 thread_stats.malloc_large++; 416 417 void *res = reinterpret_cast<void *>(user_beg); 418 ASAN_MALLOC_HOOK(res, size); 419 return res; 420} 421 422static void Deallocate(void *ptr, StackTrace *stack, AllocType alloc_type) { 423 uptr p = reinterpret_cast<uptr>(ptr); 424 if (p == 0 || p == kReturnOnZeroMalloc) return; 425 uptr chunk_beg = p - kChunkHeaderSize; 426 AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 427 428 // Flip the chunk_state atomically to avoid race on double-free. 429 u8 old_chunk_state = atomic_exchange((atomic_uint8_t*)m, CHUNK_QUARANTINE, 430 memory_order_acq_rel); 431 432 if (old_chunk_state == CHUNK_QUARANTINE) 433 ReportDoubleFree((uptr)ptr, stack); 434 else if (old_chunk_state != CHUNK_ALLOCATED) 435 ReportFreeNotMalloced((uptr)ptr, stack); 436 CHECK(old_chunk_state == CHUNK_ALLOCATED); 437 if (m->alloc_type != alloc_type && flags()->alloc_dealloc_mismatch) 438 ReportAllocTypeMismatch((uptr)ptr, stack, 439 (AllocType)m->alloc_type, (AllocType)alloc_type); 440 441 CHECK_GE(m->alloc_tid, 0); 442 if (SANITIZER_WORDSIZE == 64) // On 32-bits this resides in user area. 443 CHECK_EQ(m->free_tid, kInvalidTid); 444 AsanThread *t = asanThreadRegistry().GetCurrent(); 445 m->free_tid = t ? t->tid() : 0; 446 if (flags()->use_stack_depot) { 447 m->free_context_id = StackDepotPut(stack->trace, stack->size); 448 } else { 449 m->free_context_id = 0; 450 StackTrace::CompressStack(stack, m->FreeStackBeg(), m->FreeStackSize()); 451 } 452 CHECK(m->chunk_state == CHUNK_QUARANTINE); 453 // Poison the region. 454 PoisonShadow(m->Beg(), 455 RoundUpTo(m->UsedSize(), SHADOW_GRANULARITY), 456 kAsanHeapFreeMagic); 457 458 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 459 thread_stats.frees++; 460 thread_stats.freed += m->UsedSize(); 461 462 // Push into quarantine. 463 if (t) { 464 AsanChunkFifoList &q = t->malloc_storage().quarantine_; 465 q.Push(m); 466 467 if (q.size() > kMaxThreadLocalQuarantine) 468 quarantine.SwallowThreadLocalQuarantine(&t->malloc_storage()); 469 } else { 470 quarantine.BypassThreadLocalQuarantine(m); 471 } 472 473 ASAN_FREE_HOOK(ptr); 474} 475 476static void *Reallocate(void *old_ptr, uptr new_size, StackTrace *stack) { 477 CHECK(old_ptr && new_size); 478 uptr p = reinterpret_cast<uptr>(old_ptr); 479 uptr chunk_beg = p - kChunkHeaderSize; 480 AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 481 482 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 483 thread_stats.reallocs++; 484 thread_stats.realloced += new_size; 485 486 CHECK(m->chunk_state == CHUNK_ALLOCATED); 487 uptr old_size = m->UsedSize(); 488 uptr memcpy_size = Min(new_size, old_size); 489 void *new_ptr = Allocate(new_size, 8, stack, FROM_MALLOC); 490 if (new_ptr) { 491 CHECK(REAL(memcpy) != 0); 492 REAL(memcpy)(new_ptr, old_ptr, memcpy_size); 493 Deallocate(old_ptr, stack, FROM_MALLOC); 494 } 495 return new_ptr; 496} 497 498static AsanChunk *GetAsanChunkByAddr(uptr p) { 499 void *ptr = reinterpret_cast<void *>(p); 500 uptr alloc_beg = reinterpret_cast<uptr>(allocator.GetBlockBegin(ptr)); 501 if (!alloc_beg) return 0; 502 uptr *memalign_magic = reinterpret_cast<uptr *>(alloc_beg); 503 if (memalign_magic[0] == kMemalignMagic) { 504 AsanChunk *m = reinterpret_cast<AsanChunk *>(memalign_magic[1]); 505 CHECK(m->from_memalign); 506 return m; 507 } 508 if (!allocator.FromPrimary(ptr)) { 509 uptr *meta = reinterpret_cast<uptr *>( 510 allocator.GetMetaData(reinterpret_cast<void *>(alloc_beg))); 511 AsanChunk *m = reinterpret_cast<AsanChunk *>(meta[1]); 512 return m; 513 } 514 uptr actual_size = allocator.GetActuallyAllocatedSize(ptr); 515 CHECK_LE(actual_size, SizeClassMap::kMaxSize); 516 // We know the actually allocted size, but we don't know the redzone size. 517 // Just try all possible redzone sizes. 518 for (u32 rz_log = 0; rz_log < 8; rz_log++) { 519 u32 rz_size = RZLog2Size(rz_log); 520 uptr max_possible_size = actual_size - rz_size; 521 if (ComputeRZLog(max_possible_size) != rz_log) 522 continue; 523 return reinterpret_cast<AsanChunk *>( 524 alloc_beg + rz_size - kChunkHeaderSize); 525 } 526 return 0; 527} 528 529static uptr AllocationSize(uptr p) { 530 AsanChunk *m = GetAsanChunkByAddr(p); 531 if (!m) return 0; 532 if (m->chunk_state != CHUNK_ALLOCATED) return 0; 533 if (m->Beg() != p) return 0; 534 return m->UsedSize(); 535} 536 537// We have an address between two chunks, and we want to report just one. 538AsanChunk *ChooseChunk(uptr addr, 539 AsanChunk *left_chunk, AsanChunk *right_chunk) { 540 // Prefer an allocated chunk over freed chunk and freed chunk 541 // over available chunk. 542 if (left_chunk->chunk_state != right_chunk->chunk_state) { 543 if (left_chunk->chunk_state == CHUNK_ALLOCATED) 544 return left_chunk; 545 if (right_chunk->chunk_state == CHUNK_ALLOCATED) 546 return right_chunk; 547 if (left_chunk->chunk_state == CHUNK_QUARANTINE) 548 return left_chunk; 549 if (right_chunk->chunk_state == CHUNK_QUARANTINE) 550 return right_chunk; 551 } 552 // Same chunk_state: choose based on offset. 553 uptr l_offset = 0, r_offset = 0; 554 CHECK(AsanChunkView(left_chunk).AddrIsAtRight(addr, 1, &l_offset)); 555 CHECK(AsanChunkView(right_chunk).AddrIsAtLeft(addr, 1, &r_offset)); 556 if (l_offset < r_offset) 557 return left_chunk; 558 return right_chunk; 559} 560 561AsanChunkView FindHeapChunkByAddress(uptr addr) { 562 AsanChunk *m1 = GetAsanChunkByAddr(addr); 563 if (!m1) return AsanChunkView(m1); 564 uptr offset = 0; 565 if (AsanChunkView(m1).AddrIsAtLeft(addr, 1, &offset)) { 566 // The address is in the chunk's left redzone, so maybe it is actually 567 // a right buffer overflow from the other chunk to the left. 568 // Search a bit to the left to see if there is another chunk. 569 AsanChunk *m2 = 0; 570 for (uptr l = 1; l < GetPageSizeCached(); l++) { 571 m2 = GetAsanChunkByAddr(addr - l); 572 if (m2 == m1) continue; // Still the same chunk. 573 break; 574 } 575 if (m2 && AsanChunkView(m2).AddrIsAtRight(addr, 1, &offset)) 576 m1 = ChooseChunk(addr, m2, m1); 577 } 578 return AsanChunkView(m1); 579} 580 581void AsanThreadLocalMallocStorage::CommitBack() { 582 quarantine.SwallowThreadLocalQuarantine(this); 583 allocator.SwallowCache(GetAllocatorCache(this)); 584} 585 586SANITIZER_INTERFACE_ATTRIBUTE 587void *asan_memalign(uptr alignment, uptr size, StackTrace *stack, 588 AllocType alloc_type) { 589 return Allocate(size, alignment, stack, alloc_type); 590} 591 592SANITIZER_INTERFACE_ATTRIBUTE 593void asan_free(void *ptr, StackTrace *stack, AllocType alloc_type) { 594 Deallocate(ptr, stack, alloc_type); 595} 596 597SANITIZER_INTERFACE_ATTRIBUTE 598void *asan_malloc(uptr size, StackTrace *stack) { 599 return Allocate(size, 8, stack, FROM_MALLOC); 600} 601 602void *asan_calloc(uptr nmemb, uptr size, StackTrace *stack) { 603 void *ptr = Allocate(nmemb * size, 8, stack, FROM_MALLOC); 604 if (ptr) 605 REAL(memset)(ptr, 0, nmemb * size); 606 return ptr; 607} 608 609void *asan_realloc(void *p, uptr size, StackTrace *stack) { 610 if (p == 0) 611 return Allocate(size, 8, stack, FROM_MALLOC); 612 if (size == 0) { 613 Deallocate(p, stack, FROM_MALLOC); 614 return 0; 615 } 616 return Reallocate(p, size, stack); 617} 618 619void *asan_valloc(uptr size, StackTrace *stack) { 620 return Allocate(size, GetPageSizeCached(), stack, FROM_MALLOC); 621} 622 623void *asan_pvalloc(uptr size, StackTrace *stack) { 624 uptr PageSize = GetPageSizeCached(); 625 size = RoundUpTo(size, PageSize); 626 if (size == 0) { 627 // pvalloc(0) should allocate one page. 628 size = PageSize; 629 } 630 return Allocate(size, PageSize, stack, FROM_MALLOC); 631} 632 633int asan_posix_memalign(void **memptr, uptr alignment, uptr size, 634 StackTrace *stack) { 635 void *ptr = Allocate(size, alignment, stack, FROM_MALLOC); 636 CHECK(IsAligned((uptr)ptr, alignment)); 637 *memptr = ptr; 638 return 0; 639} 640 641uptr asan_malloc_usable_size(void *ptr, StackTrace *stack) { 642 CHECK(stack); 643 if (ptr == 0) return 0; 644 uptr usable_size = AllocationSize(reinterpret_cast<uptr>(ptr)); 645 if (flags()->check_malloc_usable_size && (usable_size == 0)) 646 ReportMallocUsableSizeNotOwned((uptr)ptr, stack); 647 return usable_size; 648} 649 650uptr asan_mz_size(const void *ptr) { 651 UNIMPLEMENTED(); 652 return 0; 653} 654 655void asan_mz_force_lock() { 656 UNIMPLEMENTED(); 657} 658 659void asan_mz_force_unlock() { 660 UNIMPLEMENTED(); 661} 662 663} // namespace __asan 664 665// ---------------------- Interface ---------------- {{{1 666using namespace __asan; // NOLINT 667 668// ASan allocator doesn't reserve extra bytes, so normally we would 669// just return "size". We don't want to expose our redzone sizes, etc here. 670uptr __asan_get_estimated_allocated_size(uptr size) { 671 return size; 672} 673 674bool __asan_get_ownership(const void *p) { 675 return AllocationSize(reinterpret_cast<uptr>(p)) > 0; 676} 677 678uptr __asan_get_allocated_size(const void *p) { 679 if (p == 0) return 0; 680 uptr allocated_size = AllocationSize(reinterpret_cast<uptr>(p)); 681 // Die if p is not malloced or if it is already freed. 682 if (allocated_size == 0) { 683 GET_STACK_TRACE_FATAL_HERE; 684 ReportAsanGetAllocatedSizeNotOwned(reinterpret_cast<uptr>(p), &stack); 685 } 686 return allocated_size; 687} 688 689#if !SANITIZER_SUPPORTS_WEAK_HOOKS 690// Provide default (no-op) implementation of malloc hooks. 691extern "C" { 692SANITIZER_WEAK_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE 693void __asan_malloc_hook(void *ptr, uptr size) { 694 (void)ptr; 695 (void)size; 696} 697SANITIZER_WEAK_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE 698void __asan_free_hook(void *ptr) { 699 (void)ptr; 700} 701} // extern "C" 702#endif 703 704 705#endif // ASAN_ALLOCATOR_VERSION 706