asan_allocator2.cc revision a05af3d0f2417cd6516460a46d0381a7345a5837
1//===-- asan_allocator2.cc ------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Implementation of ASan's memory allocator, 2-nd version. 13// This variant uses the allocator from sanitizer_common, i.e. the one shared 14// with ThreadSanitizer and MemorySanitizer. 15// 16// Status: under development, not enabled by default yet. 17//===----------------------------------------------------------------------===// 18#include "asan_allocator.h" 19#if ASAN_ALLOCATOR_VERSION == 2 20 21#include "asan_mapping.h" 22#include "asan_report.h" 23#include "asan_thread.h" 24#include "sanitizer_common/sanitizer_allocator.h" 25#include "sanitizer_common/sanitizer_internal_defs.h" 26#include "sanitizer_common/sanitizer_list.h" 27#include "sanitizer_common/sanitizer_stackdepot.h" 28#include "sanitizer_common/sanitizer_quarantine.h" 29 30namespace __asan { 31 32struct AsanMapUnmapCallback { 33 void OnMap(uptr p, uptr size) const { 34 PoisonShadow(p, size, kAsanHeapLeftRedzoneMagic); 35 // Statistics. 36 AsanStats &thread_stats = GetCurrentThreadStats(); 37 thread_stats.mmaps++; 38 thread_stats.mmaped += size; 39 } 40 void OnUnmap(uptr p, uptr size) const { 41 PoisonShadow(p, size, 0); 42 // We are about to unmap a chunk of user memory. 43 // Mark the corresponding shadow memory as not needed. 44 // Since asan's mapping is compacting, the shadow chunk may be 45 // not page-aligned, so we only flush the page-aligned portion. 46 uptr page_size = GetPageSizeCached(); 47 uptr shadow_beg = RoundUpTo(MemToShadow(p), page_size); 48 uptr shadow_end = RoundDownTo(MemToShadow(p + size), page_size); 49 FlushUnneededShadowMemory(shadow_beg, shadow_end - shadow_beg); 50 // Statistics. 51 AsanStats &thread_stats = GetCurrentThreadStats(); 52 thread_stats.munmaps++; 53 thread_stats.munmaped += size; 54 } 55}; 56 57#if SANITIZER_WORDSIZE == 64 58#if defined(__powerpc64__) 59const uptr kAllocatorSpace = 0xa0000000000ULL; 60#else 61const uptr kAllocatorSpace = 0x600000000000ULL; 62#endif 63const uptr kAllocatorSize = 0x40000000000ULL; // 4T. 64typedef DefaultSizeClassMap SizeClassMap; 65typedef SizeClassAllocator64<kAllocatorSpace, kAllocatorSize, 0 /*metadata*/, 66 SizeClassMap, AsanMapUnmapCallback> PrimaryAllocator; 67#elif SANITIZER_WORDSIZE == 32 68static const u64 kAddressSpaceSize = 1ULL << 32; 69typedef CompactSizeClassMap SizeClassMap; 70typedef SizeClassAllocator32<0, kAddressSpaceSize, 16, 71 SizeClassMap, AsanMapUnmapCallback> PrimaryAllocator; 72#endif 73 74typedef SizeClassAllocatorLocalCache<PrimaryAllocator> AllocatorCache; 75typedef LargeMmapAllocator<AsanMapUnmapCallback> SecondaryAllocator; 76typedef CombinedAllocator<PrimaryAllocator, AllocatorCache, 77 SecondaryAllocator> Allocator; 78 79// We can not use THREADLOCAL because it is not supported on some of the 80// platforms we care about (OSX 10.6, Android). 81// static THREADLOCAL AllocatorCache cache; 82AllocatorCache *GetAllocatorCache(AsanThreadLocalMallocStorage *ms) { 83 CHECK(ms); 84 CHECK_LE(sizeof(AllocatorCache), sizeof(ms->allocator2_cache)); 85 return reinterpret_cast<AllocatorCache *>(ms->allocator2_cache); 86} 87 88static Allocator allocator; 89 90static const uptr kMaxAllowedMallocSize = 91 FIRST_32_SECOND_64(3UL << 30, 8UL << 30); 92 93static const uptr kMaxThreadLocalQuarantine = 94 FIRST_32_SECOND_64(1 << 18, 1 << 20); 95 96// Every chunk of memory allocated by this allocator can be in one of 3 states: 97// CHUNK_AVAILABLE: the chunk is in the free list and ready to be allocated. 98// CHUNK_ALLOCATED: the chunk is allocated and not yet freed. 99// CHUNK_QUARANTINE: the chunk was freed and put into quarantine zone. 100enum { 101 CHUNK_AVAILABLE = 0, // 0 is the default value even if we didn't set it. 102 CHUNK_ALLOCATED = 2, 103 CHUNK_QUARANTINE = 3 104}; 105 106// Valid redzone sizes are 16, 32, 64, ... 2048, so we encode them in 3 bits. 107// We use adaptive redzones: for larger allocation larger redzones are used. 108static u32 RZLog2Size(u32 rz_log) { 109 CHECK_LT(rz_log, 8); 110 return 16 << rz_log; 111} 112 113static u32 RZSize2Log(u32 rz_size) { 114 CHECK_GE(rz_size, 16); 115 CHECK_LE(rz_size, 2048); 116 CHECK(IsPowerOfTwo(rz_size)); 117 u32 res = Log2(rz_size) - 4; 118 CHECK_EQ(rz_size, RZLog2Size(res)); 119 return res; 120} 121 122static uptr ComputeRZLog(uptr user_requested_size) { 123 u32 rz_log = 124 user_requested_size <= 64 - 16 ? 0 : 125 user_requested_size <= 128 - 32 ? 1 : 126 user_requested_size <= 512 - 64 ? 2 : 127 user_requested_size <= 4096 - 128 ? 3 : 128 user_requested_size <= (1 << 14) - 256 ? 4 : 129 user_requested_size <= (1 << 15) - 512 ? 5 : 130 user_requested_size <= (1 << 16) - 1024 ? 6 : 7; 131 return Max(rz_log, RZSize2Log(flags()->redzone)); 132} 133 134// The memory chunk allocated from the underlying allocator looks like this: 135// L L L L L L H H U U U U U U R R 136// L -- left redzone words (0 or more bytes) 137// H -- ChunkHeader (16 bytes), which is also a part of the left redzone. 138// U -- user memory. 139// R -- right redzone (0 or more bytes) 140// ChunkBase consists of ChunkHeader and other bytes that overlap with user 141// memory. 142 143// If a memory chunk is allocated by memalign and we had to increase the 144// allocation size to achieve the proper alignment, then we store this magic 145// value in the first uptr word of the memory block and store the address of 146// ChunkBase in the next uptr. 147// M B ? ? ? L L L L L L H H U U U U U U 148// M -- magic value kMemalignMagic 149// B -- address of ChunkHeader pointing to the first 'H' 150static const uptr kMemalignMagic = 0xCC6E96B9; 151 152struct ChunkHeader { 153 // 1-st 8 bytes. 154 u32 chunk_state : 8; // Must be first. 155 u32 alloc_tid : 24; 156 157 u32 free_tid : 24; 158 u32 from_memalign : 1; 159 u32 alloc_type : 2; 160 u32 rz_log : 3; 161 // 2-nd 8 bytes 162 // This field is used for small sizes. For large sizes it is equal to 163 // SizeClassMap::kMaxSize and the actual size is stored in the 164 // SecondaryAllocator's metadata. 165 u32 user_requested_size; 166 u32 alloc_context_id; 167}; 168 169struct ChunkBase : ChunkHeader { 170 // Header2, intersects with user memory. 171 AsanChunk *next; 172 u32 free_context_id; 173}; 174 175static const uptr kChunkHeaderSize = sizeof(ChunkHeader); 176static const uptr kChunkHeader2Size = sizeof(ChunkBase) - kChunkHeaderSize; 177COMPILER_CHECK(kChunkHeaderSize == 16); 178COMPILER_CHECK(kChunkHeader2Size <= 16); 179 180struct AsanChunk: ChunkBase { 181 uptr Beg() { return reinterpret_cast<uptr>(this) + kChunkHeaderSize; } 182 uptr UsedSize() { 183 if (user_requested_size != SizeClassMap::kMaxSize) 184 return user_requested_size; 185 return *reinterpret_cast<uptr *>(allocator.GetMetaData(AllocBeg())); 186 } 187 void *AllocBeg() { 188 if (from_memalign) 189 return allocator.GetBlockBegin(reinterpret_cast<void *>(this)); 190 return reinterpret_cast<void*>(Beg() - RZLog2Size(rz_log)); 191 } 192 // We store the alloc/free stack traces in the chunk itself. 193 u32 *AllocStackBeg() { 194 return (u32*)(Beg() - RZLog2Size(rz_log)); 195 } 196 uptr AllocStackSize() { 197 CHECK_LE(RZLog2Size(rz_log), kChunkHeaderSize); 198 return (RZLog2Size(rz_log) - kChunkHeaderSize) / sizeof(u32); 199 } 200 u32 *FreeStackBeg() { 201 return (u32*)(Beg() + kChunkHeader2Size); 202 } 203 uptr FreeStackSize() { 204 if (user_requested_size < kChunkHeader2Size) return 0; 205 uptr available = RoundUpTo(user_requested_size, SHADOW_GRANULARITY); 206 return (available - kChunkHeader2Size) / sizeof(u32); 207 } 208}; 209 210uptr AsanChunkView::Beg() { return chunk_->Beg(); } 211uptr AsanChunkView::End() { return Beg() + UsedSize(); } 212uptr AsanChunkView::UsedSize() { return chunk_->UsedSize(); } 213uptr AsanChunkView::AllocTid() { return chunk_->alloc_tid; } 214uptr AsanChunkView::FreeTid() { return chunk_->free_tid; } 215 216static void GetStackTraceFromId(u32 id, StackTrace *stack) { 217 CHECK(id); 218 uptr size = 0; 219 const uptr *trace = StackDepotGet(id, &size); 220 CHECK_LT(size, kStackTraceMax); 221 internal_memcpy(stack->trace, trace, sizeof(uptr) * size); 222 stack->size = size; 223} 224 225void AsanChunkView::GetAllocStack(StackTrace *stack) { 226 if (flags()->use_stack_depot) 227 GetStackTraceFromId(chunk_->alloc_context_id, stack); 228 else 229 StackTrace::UncompressStack(stack, chunk_->AllocStackBeg(), 230 chunk_->AllocStackSize()); 231} 232 233void AsanChunkView::GetFreeStack(StackTrace *stack) { 234 if (flags()->use_stack_depot) 235 GetStackTraceFromId(chunk_->free_context_id, stack); 236 else 237 StackTrace::UncompressStack(stack, chunk_->FreeStackBeg(), 238 chunk_->FreeStackSize()); 239} 240 241struct QuarantineCallback; 242typedef Quarantine<QuarantineCallback, AsanChunk> AsanQuarantine; 243typedef AsanQuarantine::Cache QuarantineCache; 244static AsanQuarantine quarantine(LINKER_INITIALIZED); 245static QuarantineCache fallback_quarantine_cache(LINKER_INITIALIZED); 246static AllocatorCache fallback_allocator_cache; 247static SpinMutex fallback_mutex; 248 249QuarantineCache *GetQuarantineCache(AsanThreadLocalMallocStorage *ms) { 250 CHECK(ms); 251 CHECK_LE(sizeof(QuarantineCache), sizeof(ms->quarantine_cache)); 252 return reinterpret_cast<QuarantineCache *>(ms->quarantine_cache); 253} 254 255struct QuarantineCallback { 256 explicit QuarantineCallback(AllocatorCache *cache) 257 : cache_(cache) { 258 } 259 260 void Recycle(AsanChunk *m) { 261 CHECK(m->chunk_state == CHUNK_QUARANTINE); 262 m->chunk_state = CHUNK_AVAILABLE; 263 CHECK_NE(m->alloc_tid, kInvalidTid); 264 CHECK_NE(m->free_tid, kInvalidTid); 265 PoisonShadow(m->Beg(), 266 RoundUpTo(m->UsedSize(), SHADOW_GRANULARITY), 267 kAsanHeapLeftRedzoneMagic); 268 void *p = reinterpret_cast<void *>(m->AllocBeg()); 269 if (m->from_memalign) { 270 uptr *memalign_magic = reinterpret_cast<uptr *>(p); 271 CHECK_EQ(memalign_magic[0], kMemalignMagic); 272 CHECK_EQ(memalign_magic[1], reinterpret_cast<uptr>(m)); 273 } 274 275 // Statistics. 276 AsanStats &thread_stats = GetCurrentThreadStats(); 277 thread_stats.real_frees++; 278 thread_stats.really_freed += m->UsedSize(); 279 280 allocator.Deallocate(cache_, p); 281 } 282 283 void *Allocate(uptr size) { 284 return allocator.Allocate(cache_, size, 1, false); 285 } 286 287 void Deallocate(void *p) { 288 allocator.Deallocate(cache_, p); 289 } 290 291 AllocatorCache *cache_; 292}; 293 294void InitializeAllocator() { 295 allocator.Init(); 296 quarantine.Init((uptr)flags()->quarantine_size, kMaxThreadLocalQuarantine); 297} 298 299static void *Allocate(uptr size, uptr alignment, StackTrace *stack, 300 AllocType alloc_type) { 301 if (!asan_inited) 302 __asan_init(); 303 CHECK(stack); 304 const uptr min_alignment = SHADOW_GRANULARITY; 305 if (alignment < min_alignment) 306 alignment = min_alignment; 307 if (size == 0) { 308 // We'd be happy to avoid allocating memory for zero-size requests, but 309 // some programs/tests depend on this behavior and assume that malloc would 310 // not return NULL even for zero-size allocations. Moreover, it looks like 311 // operator new should never return NULL, and results of consecutive "new" 312 // calls must be different even if the allocated size is zero. 313 size = 1; 314 } 315 CHECK(IsPowerOfTwo(alignment)); 316 uptr rz_log = ComputeRZLog(size); 317 uptr rz_size = RZLog2Size(rz_log); 318 uptr rounded_size = RoundUpTo(size, alignment); 319 if (rounded_size < kChunkHeader2Size) 320 rounded_size = kChunkHeader2Size; 321 uptr needed_size = rounded_size + rz_size; 322 if (alignment > min_alignment) 323 needed_size += alignment; 324 bool using_primary_allocator = true; 325 // If we are allocating from the secondary allocator, there will be no 326 // automatic right redzone, so add the right redzone manually. 327 if (!PrimaryAllocator::CanAllocate(needed_size, alignment)) { 328 needed_size += rz_size; 329 using_primary_allocator = false; 330 } 331 CHECK(IsAligned(needed_size, min_alignment)); 332 if (size > kMaxAllowedMallocSize || needed_size > kMaxAllowedMallocSize) { 333 Report("WARNING: AddressSanitizer failed to allocate %p bytes\n", 334 (void*)size); 335 return 0; 336 } 337 338 AsanThread *t = GetCurrentThread(); 339 void *allocated; 340 if (t) { 341 AllocatorCache *cache = GetAllocatorCache(&t->malloc_storage()); 342 allocated = allocator.Allocate(cache, needed_size, 8, false); 343 } else { 344 SpinMutexLock l(&fallback_mutex); 345 AllocatorCache *cache = &fallback_allocator_cache; 346 allocated = allocator.Allocate(cache, needed_size, 8, false); 347 } 348 uptr alloc_beg = reinterpret_cast<uptr>(allocated); 349 // Clear the first allocated word (an old kMemalignMagic may still be there). 350 reinterpret_cast<uptr *>(alloc_beg)[0] = 0; 351 uptr alloc_end = alloc_beg + needed_size; 352 uptr beg_plus_redzone = alloc_beg + rz_size; 353 uptr user_beg = beg_plus_redzone; 354 if (!IsAligned(user_beg, alignment)) 355 user_beg = RoundUpTo(user_beg, alignment); 356 uptr user_end = user_beg + size; 357 CHECK_LE(user_end, alloc_end); 358 uptr chunk_beg = user_beg - kChunkHeaderSize; 359 AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 360 m->chunk_state = CHUNK_ALLOCATED; 361 m->alloc_type = alloc_type; 362 m->rz_log = rz_log; 363 u32 alloc_tid = t ? t->tid() : 0; 364 m->alloc_tid = alloc_tid; 365 CHECK_EQ(alloc_tid, m->alloc_tid); // Does alloc_tid fit into the bitfield? 366 m->free_tid = kInvalidTid; 367 m->from_memalign = user_beg != beg_plus_redzone; 368 if (m->from_memalign) { 369 CHECK_LE(beg_plus_redzone + 2 * sizeof(uptr), user_beg); 370 uptr *memalign_magic = reinterpret_cast<uptr *>(alloc_beg); 371 memalign_magic[0] = kMemalignMagic; 372 memalign_magic[1] = chunk_beg; 373 } 374 if (using_primary_allocator) { 375 CHECK(size); 376 m->user_requested_size = size; 377 CHECK(allocator.FromPrimary(allocated)); 378 } else { 379 CHECK(!allocator.FromPrimary(allocated)); 380 m->user_requested_size = SizeClassMap::kMaxSize; 381 uptr *meta = reinterpret_cast<uptr *>(allocator.GetMetaData(allocated)); 382 meta[0] = size; 383 meta[1] = chunk_beg; 384 } 385 386 if (flags()->use_stack_depot) { 387 m->alloc_context_id = StackDepotPut(stack->trace, stack->size); 388 } else { 389 m->alloc_context_id = 0; 390 StackTrace::CompressStack(stack, m->AllocStackBeg(), m->AllocStackSize()); 391 } 392 393 uptr size_rounded_down_to_granularity = RoundDownTo(size, SHADOW_GRANULARITY); 394 // Unpoison the bulk of the memory region. 395 if (size_rounded_down_to_granularity) 396 PoisonShadow(user_beg, size_rounded_down_to_granularity, 0); 397 // Deal with the end of the region if size is not aligned to granularity. 398 if (size != size_rounded_down_to_granularity && flags()->poison_heap) { 399 u8 *shadow = (u8*)MemToShadow(user_beg + size_rounded_down_to_granularity); 400 *shadow = size & (SHADOW_GRANULARITY - 1); 401 } 402 403 AsanStats &thread_stats = GetCurrentThreadStats(); 404 thread_stats.mallocs++; 405 thread_stats.malloced += size; 406 thread_stats.malloced_redzones += needed_size - size; 407 uptr class_id = Min(kNumberOfSizeClasses, SizeClassMap::ClassID(needed_size)); 408 thread_stats.malloced_by_size[class_id]++; 409 if (needed_size > SizeClassMap::kMaxSize) 410 thread_stats.malloc_large++; 411 412 void *res = reinterpret_cast<void *>(user_beg); 413 ASAN_MALLOC_HOOK(res, size); 414 return res; 415} 416 417static void Deallocate(void *ptr, StackTrace *stack, AllocType alloc_type) { 418 uptr p = reinterpret_cast<uptr>(ptr); 419 if (p == 0) return; 420 ASAN_FREE_HOOK(ptr); 421 uptr chunk_beg = p - kChunkHeaderSize; 422 AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 423 424 u8 old_chunk_state = CHUNK_ALLOCATED; 425 // Flip the chunk_state atomically to avoid race on double-free. 426 if (!atomic_compare_exchange_strong((atomic_uint8_t*)m, &old_chunk_state, 427 CHUNK_QUARANTINE, memory_order_relaxed)) { 428 if (old_chunk_state == CHUNK_QUARANTINE) 429 ReportDoubleFree((uptr)ptr, stack); 430 else 431 ReportFreeNotMalloced((uptr)ptr, stack); 432 } 433 CHECK_EQ(CHUNK_ALLOCATED, old_chunk_state); 434 435 if (m->alloc_type != alloc_type && flags()->alloc_dealloc_mismatch) 436 ReportAllocTypeMismatch((uptr)ptr, stack, 437 (AllocType)m->alloc_type, (AllocType)alloc_type); 438 439 CHECK_GE(m->alloc_tid, 0); 440 if (SANITIZER_WORDSIZE == 64) // On 32-bits this resides in user area. 441 CHECK_EQ(m->free_tid, kInvalidTid); 442 AsanThread *t = GetCurrentThread(); 443 m->free_tid = t ? t->tid() : 0; 444 if (flags()->use_stack_depot) { 445 m->free_context_id = StackDepotPut(stack->trace, stack->size); 446 } else { 447 m->free_context_id = 0; 448 StackTrace::CompressStack(stack, m->FreeStackBeg(), m->FreeStackSize()); 449 } 450 CHECK(m->chunk_state == CHUNK_QUARANTINE); 451 // Poison the region. 452 PoisonShadow(m->Beg(), 453 RoundUpTo(m->UsedSize(), SHADOW_GRANULARITY), 454 kAsanHeapFreeMagic); 455 456 AsanStats &thread_stats = GetCurrentThreadStats(); 457 thread_stats.frees++; 458 thread_stats.freed += m->UsedSize(); 459 460 // Push into quarantine. 461 if (t) { 462 AsanThreadLocalMallocStorage *ms = &t->malloc_storage(); 463 AllocatorCache *ac = GetAllocatorCache(ms); 464 quarantine.Put(GetQuarantineCache(ms), QuarantineCallback(ac), 465 m, m->UsedSize()); 466 } else { 467 SpinMutexLock l(&fallback_mutex); 468 AllocatorCache *ac = &fallback_allocator_cache; 469 quarantine.Put(&fallback_quarantine_cache, QuarantineCallback(ac), 470 m, m->UsedSize()); 471 } 472} 473 474static void *Reallocate(void *old_ptr, uptr new_size, StackTrace *stack) { 475 CHECK(old_ptr && new_size); 476 uptr p = reinterpret_cast<uptr>(old_ptr); 477 uptr chunk_beg = p - kChunkHeaderSize; 478 AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 479 480 AsanStats &thread_stats = GetCurrentThreadStats(); 481 thread_stats.reallocs++; 482 thread_stats.realloced += new_size; 483 484 CHECK(m->chunk_state == CHUNK_ALLOCATED); 485 uptr old_size = m->UsedSize(); 486 uptr memcpy_size = Min(new_size, old_size); 487 void *new_ptr = Allocate(new_size, 8, stack, FROM_MALLOC); 488 if (new_ptr) { 489 CHECK_NE(REAL(memcpy), (void*)0); 490 REAL(memcpy)(new_ptr, old_ptr, memcpy_size); 491 Deallocate(old_ptr, stack, FROM_MALLOC); 492 } 493 return new_ptr; 494} 495 496static AsanChunk *GetAsanChunkByAddr(uptr p) { 497 void *ptr = reinterpret_cast<void *>(p); 498 uptr alloc_beg = reinterpret_cast<uptr>(allocator.GetBlockBegin(ptr)); 499 if (!alloc_beg) return 0; 500 uptr *memalign_magic = reinterpret_cast<uptr *>(alloc_beg); 501 if (memalign_magic[0] == kMemalignMagic) { 502 AsanChunk *m = reinterpret_cast<AsanChunk *>(memalign_magic[1]); 503 CHECK(m->from_memalign); 504 return m; 505 } 506 if (!allocator.FromPrimary(ptr)) { 507 uptr *meta = reinterpret_cast<uptr *>( 508 allocator.GetMetaData(reinterpret_cast<void *>(alloc_beg))); 509 AsanChunk *m = reinterpret_cast<AsanChunk *>(meta[1]); 510 return m; 511 } 512 uptr actual_size = allocator.GetActuallyAllocatedSize(ptr); 513 CHECK_LE(actual_size, SizeClassMap::kMaxSize); 514 // We know the actually allocted size, but we don't know the redzone size. 515 // Just try all possible redzone sizes. 516 for (u32 rz_log = 0; rz_log < 8; rz_log++) { 517 u32 rz_size = RZLog2Size(rz_log); 518 uptr max_possible_size = actual_size - rz_size; 519 if (ComputeRZLog(max_possible_size) != rz_log) 520 continue; 521 return reinterpret_cast<AsanChunk *>( 522 alloc_beg + rz_size - kChunkHeaderSize); 523 } 524 return 0; 525} 526 527static uptr AllocationSize(uptr p) { 528 AsanChunk *m = GetAsanChunkByAddr(p); 529 if (!m) return 0; 530 if (m->chunk_state != CHUNK_ALLOCATED) return 0; 531 if (m->Beg() != p) return 0; 532 return m->UsedSize(); 533} 534 535// We have an address between two chunks, and we want to report just one. 536AsanChunk *ChooseChunk(uptr addr, 537 AsanChunk *left_chunk, AsanChunk *right_chunk) { 538 // Prefer an allocated chunk over freed chunk and freed chunk 539 // over available chunk. 540 if (left_chunk->chunk_state != right_chunk->chunk_state) { 541 if (left_chunk->chunk_state == CHUNK_ALLOCATED) 542 return left_chunk; 543 if (right_chunk->chunk_state == CHUNK_ALLOCATED) 544 return right_chunk; 545 if (left_chunk->chunk_state == CHUNK_QUARANTINE) 546 return left_chunk; 547 if (right_chunk->chunk_state == CHUNK_QUARANTINE) 548 return right_chunk; 549 } 550 // Same chunk_state: choose based on offset. 551 sptr l_offset = 0, r_offset = 0; 552 CHECK(AsanChunkView(left_chunk).AddrIsAtRight(addr, 1, &l_offset)); 553 CHECK(AsanChunkView(right_chunk).AddrIsAtLeft(addr, 1, &r_offset)); 554 if (l_offset < r_offset) 555 return left_chunk; 556 return right_chunk; 557} 558 559AsanChunkView FindHeapChunkByAddress(uptr addr) { 560 AsanChunk *m1 = GetAsanChunkByAddr(addr); 561 if (!m1) return AsanChunkView(m1); 562 sptr offset = 0; 563 if (AsanChunkView(m1).AddrIsAtLeft(addr, 1, &offset)) { 564 // The address is in the chunk's left redzone, so maybe it is actually 565 // a right buffer overflow from the other chunk to the left. 566 // Search a bit to the left to see if there is another chunk. 567 AsanChunk *m2 = 0; 568 for (uptr l = 1; l < GetPageSizeCached(); l++) { 569 m2 = GetAsanChunkByAddr(addr - l); 570 if (m2 == m1) continue; // Still the same chunk. 571 break; 572 } 573 if (m2 && AsanChunkView(m2).AddrIsAtRight(addr, 1, &offset)) 574 m1 = ChooseChunk(addr, m2, m1); 575 } 576 return AsanChunkView(m1); 577} 578 579void AsanThreadLocalMallocStorage::CommitBack() { 580 AllocatorCache *ac = GetAllocatorCache(this); 581 quarantine.Drain(GetQuarantineCache(this), QuarantineCallback(ac)); 582 allocator.SwallowCache(GetAllocatorCache(this)); 583} 584 585void PrintInternalAllocatorStats() { 586 allocator.PrintStats(); 587} 588 589SANITIZER_INTERFACE_ATTRIBUTE 590void *asan_memalign(uptr alignment, uptr size, StackTrace *stack, 591 AllocType alloc_type) { 592 return Allocate(size, alignment, stack, alloc_type); 593} 594 595SANITIZER_INTERFACE_ATTRIBUTE 596void asan_free(void *ptr, StackTrace *stack, AllocType alloc_type) { 597 Deallocate(ptr, stack, alloc_type); 598} 599 600SANITIZER_INTERFACE_ATTRIBUTE 601void *asan_malloc(uptr size, StackTrace *stack) { 602 return Allocate(size, 8, stack, FROM_MALLOC); 603} 604 605void *asan_calloc(uptr nmemb, uptr size, StackTrace *stack) { 606 if (CallocShouldReturnNullDueToOverflow(size, nmemb)) return 0; 607 void *ptr = Allocate(nmemb * size, 8, stack, FROM_MALLOC); 608 // If the memory comes from the secondary allocator no need to clear it 609 // as it comes directly from mmap. 610 if (ptr && allocator.FromPrimary(ptr)) 611 REAL(memset)(ptr, 0, nmemb * size); 612 return ptr; 613} 614 615void *asan_realloc(void *p, uptr size, StackTrace *stack) { 616 if (p == 0) 617 return Allocate(size, 8, stack, FROM_MALLOC); 618 if (size == 0) { 619 Deallocate(p, stack, FROM_MALLOC); 620 return 0; 621 } 622 return Reallocate(p, size, stack); 623} 624 625void *asan_valloc(uptr size, StackTrace *stack) { 626 return Allocate(size, GetPageSizeCached(), stack, FROM_MALLOC); 627} 628 629void *asan_pvalloc(uptr size, StackTrace *stack) { 630 uptr PageSize = GetPageSizeCached(); 631 size = RoundUpTo(size, PageSize); 632 if (size == 0) { 633 // pvalloc(0) should allocate one page. 634 size = PageSize; 635 } 636 return Allocate(size, PageSize, stack, FROM_MALLOC); 637} 638 639int asan_posix_memalign(void **memptr, uptr alignment, uptr size, 640 StackTrace *stack) { 641 void *ptr = Allocate(size, alignment, stack, FROM_MALLOC); 642 CHECK(IsAligned((uptr)ptr, alignment)); 643 *memptr = ptr; 644 return 0; 645} 646 647uptr asan_malloc_usable_size(void *ptr, StackTrace *stack) { 648 CHECK(stack); 649 if (ptr == 0) return 0; 650 uptr usable_size = AllocationSize(reinterpret_cast<uptr>(ptr)); 651 if (flags()->check_malloc_usable_size && (usable_size == 0)) 652 ReportMallocUsableSizeNotOwned((uptr)ptr, stack); 653 return usable_size; 654} 655 656uptr asan_mz_size(const void *ptr) { 657 return AllocationSize(reinterpret_cast<uptr>(ptr)); 658} 659 660void asan_mz_force_lock() { 661 allocator.ForceLock(); 662 fallback_mutex.Lock(); 663} 664 665void asan_mz_force_unlock() { 666 fallback_mutex.Unlock(); 667 allocator.ForceUnlock(); 668} 669 670} // namespace __asan 671 672// ---------------------- Interface ---------------- {{{1 673using namespace __asan; // NOLINT 674 675// ASan allocator doesn't reserve extra bytes, so normally we would 676// just return "size". We don't want to expose our redzone sizes, etc here. 677uptr __asan_get_estimated_allocated_size(uptr size) { 678 return size; 679} 680 681bool __asan_get_ownership(const void *p) { 682 uptr ptr = reinterpret_cast<uptr>(p); 683 return (AllocationSize(ptr) > 0); 684} 685 686uptr __asan_get_allocated_size(const void *p) { 687 if (p == 0) return 0; 688 uptr ptr = reinterpret_cast<uptr>(p); 689 uptr allocated_size = AllocationSize(ptr); 690 // Die if p is not malloced or if it is already freed. 691 if (allocated_size == 0) { 692 GET_STACK_TRACE_FATAL_HERE; 693 ReportAsanGetAllocatedSizeNotOwned(ptr, &stack); 694 } 695 return allocated_size; 696} 697 698#if !SANITIZER_SUPPORTS_WEAK_HOOKS 699// Provide default (no-op) implementation of malloc hooks. 700extern "C" { 701SANITIZER_WEAK_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE 702void __asan_malloc_hook(void *ptr, uptr size) { 703 (void)ptr; 704 (void)size; 705} 706SANITIZER_WEAK_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE 707void __asan_free_hook(void *ptr) { 708 (void)ptr; 709} 710} // extern "C" 711#endif 712 713 714#endif // ASAN_ALLOCATOR_VERSION 715