asan_allocator2.cc revision a3ab1a7da70a5ef111257ba8887920c1fdcd7be5
1//===-- asan_allocator2.cc ------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Implementation of ASan's memory allocator, 2-nd version. 13// This variant uses the allocator from sanitizer_common, i.e. the one shared 14// with ThreadSanitizer and MemorySanitizer. 15// 16// Status: under development, not enabled by default yet. 17//===----------------------------------------------------------------------===// 18#include "asan_allocator.h" 19#if ASAN_ALLOCATOR_VERSION == 2 20 21#include "asan_mapping.h" 22#include "asan_report.h" 23#include "asan_thread.h" 24#include "asan_thread_registry.h" 25#include "sanitizer/asan_interface.h" 26#include "sanitizer_common/sanitizer_allocator.h" 27#include "sanitizer_common/sanitizer_internal_defs.h" 28#include "sanitizer_common/sanitizer_list.h" 29#include "sanitizer_common/sanitizer_stackdepot.h" 30#include "sanitizer_common/sanitizer_quarantine.h" 31 32namespace __asan { 33 34struct AsanMapUnmapCallback { 35 void OnMap(uptr p, uptr size) const { 36 PoisonShadow(p, size, kAsanHeapLeftRedzoneMagic); 37 // Statistics. 38 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 39 thread_stats.mmaps++; 40 thread_stats.mmaped += size; 41 } 42 void OnUnmap(uptr p, uptr size) const { 43 PoisonShadow(p, size, 0); 44 // We are about to unmap a chunk of user memory. 45 // Mark the corresponding shadow memory as not needed. 46 // Since asan's mapping is compacting, the shadow chunk may be 47 // not page-aligned, so we only flush the page-aligned portion. 48 uptr page_size = GetPageSizeCached(); 49 uptr shadow_beg = RoundUpTo(MemToShadow(p), page_size); 50 uptr shadow_end = RoundDownTo(MemToShadow(p + size), page_size); 51 FlushUnneededShadowMemory(shadow_beg, shadow_end - shadow_beg); 52 // Statistics. 53 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 54 thread_stats.munmaps++; 55 thread_stats.munmaped += size; 56 } 57}; 58 59#if SANITIZER_WORDSIZE == 64 60#if defined(__powerpc64__) 61const uptr kAllocatorSpace = 0xa0000000000ULL; 62#else 63const uptr kAllocatorSpace = 0x600000000000ULL; 64#endif 65const uptr kAllocatorSize = 0x10000000000ULL; // 1T. 66typedef DefaultSizeClassMap SizeClassMap; 67typedef SizeClassAllocator64<kAllocatorSpace, kAllocatorSize, 0 /*metadata*/, 68 SizeClassMap, AsanMapUnmapCallback> PrimaryAllocator; 69#elif SANITIZER_WORDSIZE == 32 70static const u64 kAddressSpaceSize = 1ULL << 32; 71typedef CompactSizeClassMap SizeClassMap; 72typedef SizeClassAllocator32<0, kAddressSpaceSize, 16, 73 SizeClassMap, AsanMapUnmapCallback> PrimaryAllocator; 74#endif 75 76typedef SizeClassAllocatorLocalCache<PrimaryAllocator> AllocatorCache; 77typedef LargeMmapAllocator<AsanMapUnmapCallback> SecondaryAllocator; 78typedef CombinedAllocator<PrimaryAllocator, AllocatorCache, 79 SecondaryAllocator> Allocator; 80 81// We can not use THREADLOCAL because it is not supported on some of the 82// platforms we care about (OSX 10.6, Android). 83// static THREADLOCAL AllocatorCache cache; 84AllocatorCache *GetAllocatorCache(AsanThreadLocalMallocStorage *ms) { 85 CHECK(ms); 86 CHECK_LE(sizeof(AllocatorCache), sizeof(ms->allocator2_cache)); 87 return reinterpret_cast<AllocatorCache *>(ms->allocator2_cache); 88} 89 90static Allocator allocator; 91 92static const uptr kMaxAllowedMallocSize = 93 FIRST_32_SECOND_64(3UL << 30, 8UL << 30); 94 95static const uptr kMaxThreadLocalQuarantine = 96 FIRST_32_SECOND_64(1 << 18, 1 << 20); 97 98static const uptr kReturnOnZeroMalloc = 2048; // Zero page is protected. 99 100// Every chunk of memory allocated by this allocator can be in one of 3 states: 101// CHUNK_AVAILABLE: the chunk is in the free list and ready to be allocated. 102// CHUNK_ALLOCATED: the chunk is allocated and not yet freed. 103// CHUNK_QUARANTINE: the chunk was freed and put into quarantine zone. 104enum { 105 CHUNK_AVAILABLE = 0, // 0 is the default value even if we didn't set it. 106 CHUNK_ALLOCATED = 2, 107 CHUNK_QUARANTINE = 3 108}; 109 110// Valid redzone sizes are 16, 32, 64, ... 2048, so we encode them in 3 bits. 111// We use adaptive redzones: for larger allocation larger redzones are used. 112static u32 RZLog2Size(u32 rz_log) { 113 CHECK_LT(rz_log, 8); 114 return 16 << rz_log; 115} 116 117static u32 RZSize2Log(u32 rz_size) { 118 CHECK_GE(rz_size, 16); 119 CHECK_LE(rz_size, 2048); 120 CHECK(IsPowerOfTwo(rz_size)); 121 u32 res = __builtin_ctz(rz_size) - 4; 122 CHECK_EQ(rz_size, RZLog2Size(res)); 123 return res; 124} 125 126static uptr ComputeRZLog(uptr user_requested_size) { 127 u32 rz_log = 128 user_requested_size <= 64 - 16 ? 0 : 129 user_requested_size <= 128 - 32 ? 1 : 130 user_requested_size <= 512 - 64 ? 2 : 131 user_requested_size <= 4096 - 128 ? 3 : 132 user_requested_size <= (1 << 14) - 256 ? 4 : 133 user_requested_size <= (1 << 15) - 512 ? 5 : 134 user_requested_size <= (1 << 16) - 1024 ? 6 : 7; 135 return Max(rz_log, RZSize2Log(flags()->redzone)); 136} 137 138// The memory chunk allocated from the underlying allocator looks like this: 139// L L L L L L H H U U U U U U R R 140// L -- left redzone words (0 or more bytes) 141// H -- ChunkHeader (16 bytes), which is also a part of the left redzone. 142// U -- user memory. 143// R -- right redzone (0 or more bytes) 144// ChunkBase consists of ChunkHeader and other bytes that overlap with user 145// memory. 146 147// If a memory chunk is allocated by memalign and we had to increase the 148// allocation size to achieve the proper alignment, then we store this magic 149// value in the first uptr word of the memory block and store the address of 150// ChunkBase in the next uptr. 151// M B ? ? ? L L L L L L H H U U U U U U 152// M -- magic value kMemalignMagic 153// B -- address of ChunkHeader pointing to the first 'H' 154static const uptr kMemalignMagic = 0xCC6E96B9; 155 156struct ChunkHeader { 157 // 1-st 8 bytes. 158 u32 chunk_state : 8; // Must be first. 159 u32 alloc_tid : 24; 160 161 u32 free_tid : 24; 162 u32 from_memalign : 1; 163 u32 alloc_type : 2; 164 u32 rz_log : 3; 165 // 2-nd 8 bytes 166 // This field is used for small sizes. For large sizes it is equal to 167 // SizeClassMap::kMaxSize and the actual size is stored in the 168 // SecondaryAllocator's metadata. 169 u32 user_requested_size; 170 u32 alloc_context_id; 171}; 172 173struct ChunkBase : ChunkHeader { 174 // Header2, intersects with user memory. 175 AsanChunk *next; 176 u32 free_context_id; 177}; 178 179static const uptr kChunkHeaderSize = sizeof(ChunkHeader); 180static const uptr kChunkHeader2Size = sizeof(ChunkBase) - kChunkHeaderSize; 181COMPILER_CHECK(kChunkHeaderSize == 16); 182COMPILER_CHECK(kChunkHeader2Size <= 16); 183 184struct AsanChunk: ChunkBase { 185 uptr Beg() { return reinterpret_cast<uptr>(this) + kChunkHeaderSize; } 186 uptr UsedSize() { 187 if (user_requested_size != SizeClassMap::kMaxSize) 188 return user_requested_size; 189 return *reinterpret_cast<uptr *>(allocator.GetMetaData(AllocBeg())); 190 } 191 void *AllocBeg() { 192 if (from_memalign) 193 return allocator.GetBlockBegin(reinterpret_cast<void *>(this)); 194 return reinterpret_cast<void*>(Beg() - RZLog2Size(rz_log)); 195 } 196 // We store the alloc/free stack traces in the chunk itself. 197 u32 *AllocStackBeg() { 198 return (u32*)(Beg() - RZLog2Size(rz_log)); 199 } 200 uptr AllocStackSize() { 201 CHECK_LE(RZLog2Size(rz_log), kChunkHeaderSize); 202 return (RZLog2Size(rz_log) - kChunkHeaderSize) / sizeof(u32); 203 } 204 u32 *FreeStackBeg() { 205 return (u32*)(Beg() + kChunkHeader2Size); 206 } 207 uptr FreeStackSize() { 208 if (user_requested_size < kChunkHeader2Size) return 0; 209 uptr available = RoundUpTo(user_requested_size, SHADOW_GRANULARITY); 210 return (available - kChunkHeader2Size) / sizeof(u32); 211 } 212}; 213 214uptr AsanChunkView::Beg() { return chunk_->Beg(); } 215uptr AsanChunkView::End() { return Beg() + UsedSize(); } 216uptr AsanChunkView::UsedSize() { return chunk_->UsedSize(); } 217uptr AsanChunkView::AllocTid() { return chunk_->alloc_tid; } 218uptr AsanChunkView::FreeTid() { return chunk_->free_tid; } 219 220static void GetStackTraceFromId(u32 id, StackTrace *stack) { 221 CHECK(id); 222 uptr size = 0; 223 const uptr *trace = StackDepotGet(id, &size); 224 CHECK_LT(size, kStackTraceMax); 225 internal_memcpy(stack->trace, trace, sizeof(uptr) * size); 226 stack->size = size; 227} 228 229void AsanChunkView::GetAllocStack(StackTrace *stack) { 230 if (flags()->use_stack_depot) 231 GetStackTraceFromId(chunk_->alloc_context_id, stack); 232 else 233 StackTrace::UncompressStack(stack, chunk_->AllocStackBeg(), 234 chunk_->AllocStackSize()); 235} 236 237void AsanChunkView::GetFreeStack(StackTrace *stack) { 238 if (flags()->use_stack_depot) 239 GetStackTraceFromId(chunk_->free_context_id, stack); 240 else 241 StackTrace::UncompressStack(stack, chunk_->FreeStackBeg(), 242 chunk_->FreeStackSize()); 243} 244 245struct QuarantineCallback; 246typedef Quarantine<QuarantineCallback, AsanChunk> AsanQuarantine; 247typedef AsanQuarantine::Cache QuarantineCache; 248static AsanQuarantine quarantine(LINKER_INITIALIZED); 249static QuarantineCache fallback_quarantine_cache(LINKER_INITIALIZED); 250static AllocatorCache fallback_allocator_cache; 251static SpinMutex fallback_mutex; 252 253QuarantineCache *GetQuarantineCache(AsanThreadLocalMallocStorage *ms) { 254 CHECK(ms); 255 CHECK_LE(sizeof(QuarantineCache), sizeof(ms->quarantine_cache)); 256 return reinterpret_cast<QuarantineCache *>(ms->quarantine_cache); 257} 258 259struct QuarantineCallback { 260 explicit QuarantineCallback(AllocatorCache *cache) 261 : cache_(cache) { 262 } 263 264 void Recycle(AsanChunk *m) { 265 CHECK(m->chunk_state == CHUNK_QUARANTINE); 266 m->chunk_state = CHUNK_AVAILABLE; 267 CHECK_NE(m->alloc_tid, kInvalidTid); 268 CHECK_NE(m->free_tid, kInvalidTid); 269 PoisonShadow(m->Beg(), 270 RoundUpTo(m->UsedSize(), SHADOW_GRANULARITY), 271 kAsanHeapLeftRedzoneMagic); 272 void *p = reinterpret_cast<void *>(m->AllocBeg()); 273 if (m->from_memalign) { 274 uptr *memalign_magic = reinterpret_cast<uptr *>(p); 275 CHECK_EQ(memalign_magic[0], kMemalignMagic); 276 CHECK_EQ(memalign_magic[1], reinterpret_cast<uptr>(m)); 277 } 278 279 // Statistics. 280 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 281 thread_stats.real_frees++; 282 thread_stats.really_freed += m->UsedSize(); 283 284 allocator.Deallocate(cache_, p); 285 } 286 287 void *Allocate(uptr size) { 288 return allocator.Allocate(cache_, size, 1, false); 289 } 290 291 void Deallocate(void *p) { 292 allocator.Deallocate(cache_, p); 293 } 294 295 AllocatorCache *cache_; 296}; 297 298void InitializeAllocator() { 299 allocator.Init(); 300 quarantine.Init((uptr)flags()->quarantine_size, kMaxThreadLocalQuarantine); 301} 302 303static void *Allocate(uptr size, uptr alignment, StackTrace *stack, 304 AllocType alloc_type) { 305 if (!asan_inited) 306 __asan_init(); 307 CHECK(stack); 308 const uptr min_alignment = SHADOW_GRANULARITY; 309 if (alignment < min_alignment) 310 alignment = min_alignment; 311 if (size == 0) { 312 if (alignment <= kReturnOnZeroMalloc) 313 return reinterpret_cast<void *>(kReturnOnZeroMalloc); 314 else 315 return 0; // 0 bytes with large alignment requested. Just return 0. 316 } 317 CHECK(IsPowerOfTwo(alignment)); 318 uptr rz_log = ComputeRZLog(size); 319 uptr rz_size = RZLog2Size(rz_log); 320 uptr rounded_size = RoundUpTo(size, alignment); 321 if (rounded_size < kChunkHeader2Size) 322 rounded_size = kChunkHeader2Size; 323 uptr needed_size = rounded_size + rz_size; 324 if (alignment > min_alignment) 325 needed_size += alignment; 326 bool using_primary_allocator = true; 327 // If we are allocating from the secondary allocator, there will be no 328 // automatic right redzone, so add the right redzone manually. 329 if (!PrimaryAllocator::CanAllocate(needed_size, alignment)) { 330 needed_size += rz_size; 331 using_primary_allocator = false; 332 } 333 CHECK(IsAligned(needed_size, min_alignment)); 334 if (size > kMaxAllowedMallocSize || needed_size > kMaxAllowedMallocSize) { 335 Report("WARNING: AddressSanitizer failed to allocate %p bytes\n", 336 (void*)size); 337 return 0; 338 } 339 340 AsanThread *t = asanThreadRegistry().GetCurrent(); 341 void *allocated; 342 if (t) { 343 AllocatorCache *cache = GetAllocatorCache(&t->malloc_storage()); 344 allocated = allocator.Allocate(cache, needed_size, 8, false); 345 } else { 346 SpinMutexLock l(&fallback_mutex); 347 AllocatorCache *cache = &fallback_allocator_cache; 348 allocated = allocator.Allocate(cache, needed_size, 8, false); 349 } 350 uptr alloc_beg = reinterpret_cast<uptr>(allocated); 351 // Clear the first allocated word (an old kMemalignMagic may still be there). 352 reinterpret_cast<uptr *>(alloc_beg)[0] = 0; 353 uptr alloc_end = alloc_beg + needed_size; 354 uptr beg_plus_redzone = alloc_beg + rz_size; 355 uptr user_beg = beg_plus_redzone; 356 if (!IsAligned(user_beg, alignment)) 357 user_beg = RoundUpTo(user_beg, alignment); 358 uptr user_end = user_beg + size; 359 CHECK_LE(user_end, alloc_end); 360 uptr chunk_beg = user_beg - kChunkHeaderSize; 361 AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 362 m->chunk_state = CHUNK_ALLOCATED; 363 m->alloc_type = alloc_type; 364 m->rz_log = rz_log; 365 u32 alloc_tid = t ? t->tid() : 0; 366 m->alloc_tid = alloc_tid; 367 CHECK_EQ(alloc_tid, m->alloc_tid); // Does alloc_tid fit into the bitfield? 368 m->free_tid = kInvalidTid; 369 m->from_memalign = user_beg != beg_plus_redzone; 370 if (m->from_memalign) { 371 CHECK_LE(beg_plus_redzone + 2 * sizeof(uptr), user_beg); 372 uptr *memalign_magic = reinterpret_cast<uptr *>(alloc_beg); 373 memalign_magic[0] = kMemalignMagic; 374 memalign_magic[1] = chunk_beg; 375 } 376 if (using_primary_allocator) { 377 CHECK(size); 378 m->user_requested_size = size; 379 CHECK(allocator.FromPrimary(allocated)); 380 } else { 381 CHECK(!allocator.FromPrimary(allocated)); 382 m->user_requested_size = SizeClassMap::kMaxSize; 383 uptr *meta = reinterpret_cast<uptr *>(allocator.GetMetaData(allocated)); 384 meta[0] = size; 385 meta[1] = chunk_beg; 386 } 387 388 if (flags()->use_stack_depot) { 389 m->alloc_context_id = StackDepotPut(stack->trace, stack->size); 390 } else { 391 m->alloc_context_id = 0; 392 StackTrace::CompressStack(stack, m->AllocStackBeg(), m->AllocStackSize()); 393 } 394 395 uptr size_rounded_down_to_granularity = RoundDownTo(size, SHADOW_GRANULARITY); 396 // Unpoison the bulk of the memory region. 397 if (size_rounded_down_to_granularity) 398 PoisonShadow(user_beg, size_rounded_down_to_granularity, 0); 399 // Deal with the end of the region if size is not aligned to granularity. 400 if (size != size_rounded_down_to_granularity && flags()->poison_heap) { 401 u8 *shadow = (u8*)MemToShadow(user_beg + size_rounded_down_to_granularity); 402 *shadow = size & (SHADOW_GRANULARITY - 1); 403 } 404 405 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 406 thread_stats.mallocs++; 407 thread_stats.malloced += size; 408 thread_stats.malloced_redzones += needed_size - size; 409 uptr class_id = Min(kNumberOfSizeClasses, SizeClassMap::ClassID(needed_size)); 410 thread_stats.malloced_by_size[class_id]++; 411 if (needed_size > SizeClassMap::kMaxSize) 412 thread_stats.malloc_large++; 413 414 void *res = reinterpret_cast<void *>(user_beg); 415 ASAN_MALLOC_HOOK(res, size); 416 return res; 417} 418 419static void Deallocate(void *ptr, StackTrace *stack, AllocType alloc_type) { 420 uptr p = reinterpret_cast<uptr>(ptr); 421 if (p == 0 || p == kReturnOnZeroMalloc) return; 422 uptr chunk_beg = p - kChunkHeaderSize; 423 AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 424 425 // Flip the chunk_state atomically to avoid race on double-free. 426 u8 old_chunk_state = atomic_exchange((atomic_uint8_t*)m, CHUNK_QUARANTINE, 427 memory_order_relaxed); 428 429 if (old_chunk_state == CHUNK_QUARANTINE) 430 ReportDoubleFree((uptr)ptr, stack); 431 else if (old_chunk_state != CHUNK_ALLOCATED) 432 ReportFreeNotMalloced((uptr)ptr, stack); 433 CHECK(old_chunk_state == CHUNK_ALLOCATED); 434 if (m->alloc_type != alloc_type && flags()->alloc_dealloc_mismatch) 435 ReportAllocTypeMismatch((uptr)ptr, stack, 436 (AllocType)m->alloc_type, (AllocType)alloc_type); 437 438 CHECK_GE(m->alloc_tid, 0); 439 if (SANITIZER_WORDSIZE == 64) // On 32-bits this resides in user area. 440 CHECK_EQ(m->free_tid, kInvalidTid); 441 AsanThread *t = asanThreadRegistry().GetCurrent(); 442 m->free_tid = t ? t->tid() : 0; 443 if (flags()->use_stack_depot) { 444 m->free_context_id = StackDepotPut(stack->trace, stack->size); 445 } else { 446 m->free_context_id = 0; 447 StackTrace::CompressStack(stack, m->FreeStackBeg(), m->FreeStackSize()); 448 } 449 CHECK(m->chunk_state == CHUNK_QUARANTINE); 450 // Poison the region. 451 PoisonShadow(m->Beg(), 452 RoundUpTo(m->UsedSize(), SHADOW_GRANULARITY), 453 kAsanHeapFreeMagic); 454 455 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 456 thread_stats.frees++; 457 thread_stats.freed += m->UsedSize(); 458 459 // Push into quarantine. 460 if (t) { 461 AsanThreadLocalMallocStorage *ms = &t->malloc_storage(); 462 AllocatorCache *ac = GetAllocatorCache(ms); 463 quarantine.Put(GetQuarantineCache(ms), QuarantineCallback(ac), 464 m, m->UsedSize()); 465 } else { 466 SpinMutexLock l(&fallback_mutex); 467 AllocatorCache *ac = &fallback_allocator_cache; 468 quarantine.Put(&fallback_quarantine_cache, QuarantineCallback(ac), 469 m, m->UsedSize()); 470 } 471 472 ASAN_FREE_HOOK(ptr); 473} 474 475static void *Reallocate(void *old_ptr, uptr new_size, StackTrace *stack) { 476 CHECK(old_ptr && new_size); 477 uptr p = reinterpret_cast<uptr>(old_ptr); 478 uptr chunk_beg = p - kChunkHeaderSize; 479 AsanChunk *m = reinterpret_cast<AsanChunk *>(chunk_beg); 480 481 AsanStats &thread_stats = asanThreadRegistry().GetCurrentThreadStats(); 482 thread_stats.reallocs++; 483 thread_stats.realloced += new_size; 484 485 CHECK(m->chunk_state == CHUNK_ALLOCATED); 486 uptr old_size = m->UsedSize(); 487 uptr memcpy_size = Min(new_size, old_size); 488 void *new_ptr = Allocate(new_size, 8, stack, FROM_MALLOC); 489 if (new_ptr) { 490 CHECK(REAL(memcpy) != 0); 491 REAL(memcpy)(new_ptr, old_ptr, memcpy_size); 492 Deallocate(old_ptr, stack, FROM_MALLOC); 493 } 494 return new_ptr; 495} 496 497static AsanChunk *GetAsanChunkByAddr(uptr p) { 498 void *ptr = reinterpret_cast<void *>(p); 499 uptr alloc_beg = reinterpret_cast<uptr>(allocator.GetBlockBegin(ptr)); 500 if (!alloc_beg) return 0; 501 uptr *memalign_magic = reinterpret_cast<uptr *>(alloc_beg); 502 if (memalign_magic[0] == kMemalignMagic) { 503 AsanChunk *m = reinterpret_cast<AsanChunk *>(memalign_magic[1]); 504 CHECK(m->from_memalign); 505 return m; 506 } 507 if (!allocator.FromPrimary(ptr)) { 508 uptr *meta = reinterpret_cast<uptr *>( 509 allocator.GetMetaData(reinterpret_cast<void *>(alloc_beg))); 510 AsanChunk *m = reinterpret_cast<AsanChunk *>(meta[1]); 511 return m; 512 } 513 uptr actual_size = allocator.GetActuallyAllocatedSize(ptr); 514 CHECK_LE(actual_size, SizeClassMap::kMaxSize); 515 // We know the actually allocted size, but we don't know the redzone size. 516 // Just try all possible redzone sizes. 517 for (u32 rz_log = 0; rz_log < 8; rz_log++) { 518 u32 rz_size = RZLog2Size(rz_log); 519 uptr max_possible_size = actual_size - rz_size; 520 if (ComputeRZLog(max_possible_size) != rz_log) 521 continue; 522 return reinterpret_cast<AsanChunk *>( 523 alloc_beg + rz_size - kChunkHeaderSize); 524 } 525 return 0; 526} 527 528static uptr AllocationSize(uptr p) { 529 AsanChunk *m = GetAsanChunkByAddr(p); 530 if (!m) return 0; 531 if (m->chunk_state != CHUNK_ALLOCATED) return 0; 532 if (m->Beg() != p) return 0; 533 return m->UsedSize(); 534} 535 536// We have an address between two chunks, and we want to report just one. 537AsanChunk *ChooseChunk(uptr addr, 538 AsanChunk *left_chunk, AsanChunk *right_chunk) { 539 // Prefer an allocated chunk over freed chunk and freed chunk 540 // over available chunk. 541 if (left_chunk->chunk_state != right_chunk->chunk_state) { 542 if (left_chunk->chunk_state == CHUNK_ALLOCATED) 543 return left_chunk; 544 if (right_chunk->chunk_state == CHUNK_ALLOCATED) 545 return right_chunk; 546 if (left_chunk->chunk_state == CHUNK_QUARANTINE) 547 return left_chunk; 548 if (right_chunk->chunk_state == CHUNK_QUARANTINE) 549 return right_chunk; 550 } 551 // Same chunk_state: choose based on offset. 552 uptr l_offset = 0, r_offset = 0; 553 CHECK(AsanChunkView(left_chunk).AddrIsAtRight(addr, 1, &l_offset)); 554 CHECK(AsanChunkView(right_chunk).AddrIsAtLeft(addr, 1, &r_offset)); 555 if (l_offset < r_offset) 556 return left_chunk; 557 return right_chunk; 558} 559 560AsanChunkView FindHeapChunkByAddress(uptr addr) { 561 AsanChunk *m1 = GetAsanChunkByAddr(addr); 562 if (!m1) return AsanChunkView(m1); 563 uptr offset = 0; 564 if (AsanChunkView(m1).AddrIsAtLeft(addr, 1, &offset)) { 565 // The address is in the chunk's left redzone, so maybe it is actually 566 // a right buffer overflow from the other chunk to the left. 567 // Search a bit to the left to see if there is another chunk. 568 AsanChunk *m2 = 0; 569 for (uptr l = 1; l < GetPageSizeCached(); l++) { 570 m2 = GetAsanChunkByAddr(addr - l); 571 if (m2 == m1) continue; // Still the same chunk. 572 break; 573 } 574 if (m2 && AsanChunkView(m2).AddrIsAtRight(addr, 1, &offset)) 575 m1 = ChooseChunk(addr, m2, m1); 576 } 577 return AsanChunkView(m1); 578} 579 580void AsanThreadLocalMallocStorage::CommitBack() { 581 AllocatorCache *ac = GetAllocatorCache(this); 582 quarantine.Drain(GetQuarantineCache(this), QuarantineCallback(ac)); 583 allocator.SwallowCache(GetAllocatorCache(this)); 584} 585 586void PrintInternalAllocatorStats() { 587 allocator.PrintStats(); 588} 589 590SANITIZER_INTERFACE_ATTRIBUTE 591void *asan_memalign(uptr alignment, uptr size, StackTrace *stack, 592 AllocType alloc_type) { 593 return Allocate(size, alignment, stack, alloc_type); 594} 595 596SANITIZER_INTERFACE_ATTRIBUTE 597void asan_free(void *ptr, StackTrace *stack, AllocType alloc_type) { 598 Deallocate(ptr, stack, alloc_type); 599} 600 601SANITIZER_INTERFACE_ATTRIBUTE 602void *asan_malloc(uptr size, StackTrace *stack) { 603 return Allocate(size, 8, stack, FROM_MALLOC); 604} 605 606void *asan_calloc(uptr nmemb, uptr size, StackTrace *stack) { 607 if (CallocShouldReturnNullDueToOverflow(size, nmemb)) return 0; 608 void *ptr = Allocate(nmemb * size, 8, stack, FROM_MALLOC); 609 if (ptr) 610 REAL(memset)(ptr, 0, nmemb * size); 611 return ptr; 612} 613 614void *asan_realloc(void *p, uptr size, StackTrace *stack) { 615 if (p == 0 || reinterpret_cast<uptr>(p) == kReturnOnZeroMalloc) 616 return Allocate(size, 8, stack, FROM_MALLOC); 617 if (size == 0) { 618 Deallocate(p, stack, FROM_MALLOC); 619 return 0; 620 } 621 return Reallocate(p, size, stack); 622} 623 624void *asan_valloc(uptr size, StackTrace *stack) { 625 return Allocate(size, GetPageSizeCached(), stack, FROM_MALLOC); 626} 627 628void *asan_pvalloc(uptr size, StackTrace *stack) { 629 uptr PageSize = GetPageSizeCached(); 630 size = RoundUpTo(size, PageSize); 631 if (size == 0) { 632 // pvalloc(0) should allocate one page. 633 size = PageSize; 634 } 635 return Allocate(size, PageSize, stack, FROM_MALLOC); 636} 637 638int asan_posix_memalign(void **memptr, uptr alignment, uptr size, 639 StackTrace *stack) { 640 void *ptr = Allocate(size, alignment, stack, FROM_MALLOC); 641 CHECK(IsAligned((uptr)ptr, alignment)); 642 *memptr = ptr; 643 return 0; 644} 645 646uptr asan_malloc_usable_size(void *ptr, StackTrace *stack) { 647 CHECK(stack); 648 if (ptr == 0) return 0; 649 uptr usable_size = AllocationSize(reinterpret_cast<uptr>(ptr)); 650 if (flags()->check_malloc_usable_size && (usable_size == 0)) 651 ReportMallocUsableSizeNotOwned((uptr)ptr, stack); 652 return usable_size; 653} 654 655uptr asan_mz_size(const void *ptr) { 656 UNIMPLEMENTED(); 657 return 0; 658} 659 660void asan_mz_force_lock() { 661 UNIMPLEMENTED(); 662} 663 664void asan_mz_force_unlock() { 665 UNIMPLEMENTED(); 666} 667 668} // namespace __asan 669 670// ---------------------- Interface ---------------- {{{1 671using namespace __asan; // NOLINT 672 673// ASan allocator doesn't reserve extra bytes, so normally we would 674// just return "size". We don't want to expose our redzone sizes, etc here. 675uptr __asan_get_estimated_allocated_size(uptr size) { 676 return size; 677} 678 679bool __asan_get_ownership(const void *p) { 680 uptr ptr = reinterpret_cast<uptr>(p); 681 return (ptr == kReturnOnZeroMalloc) || (AllocationSize(ptr) > 0); 682} 683 684uptr __asan_get_allocated_size(const void *p) { 685 if (p == 0) return 0; 686 uptr ptr = reinterpret_cast<uptr>(p); 687 uptr allocated_size = AllocationSize(ptr); 688 // Die if p is not malloced or if it is already freed. 689 if (allocated_size == 0 && ptr != kReturnOnZeroMalloc) { 690 GET_STACK_TRACE_FATAL_HERE; 691 ReportAsanGetAllocatedSizeNotOwned(ptr, &stack); 692 } 693 return allocated_size; 694} 695 696#if !SANITIZER_SUPPORTS_WEAK_HOOKS 697// Provide default (no-op) implementation of malloc hooks. 698extern "C" { 699SANITIZER_WEAK_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE 700void __asan_malloc_hook(void *ptr, uptr size) { 701 (void)ptr; 702 (void)size; 703} 704SANITIZER_WEAK_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE 705void __asan_free_hook(void *ptr) { 706 (void)ptr; 707} 708} // extern "C" 709#endif 710 711 712#endif // ASAN_ALLOCATOR_VERSION 713