asan_mac.cc revision 2fbf620369f5f1b7200f7ebfe5938e75cb6fbeb2
1//===-- asan_mac.cc -------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Mac-specific details. 13//===----------------------------------------------------------------------===// 14 15#ifdef __APPLE__ 16 17#include "asan_interceptors.h" 18#include "asan_internal.h" 19#include "asan_mac.h" 20#include "asan_mapping.h" 21#include "asan_stack.h" 22#include "asan_thread.h" 23#include "asan_thread_registry.h" 24#include "sanitizer_common/sanitizer_libc.h" 25 26#include <crt_externs.h> // for _NSGetArgv 27#include <dlfcn.h> // for dladdr() 28#include <mach-o/dyld.h> 29#include <mach-o/loader.h> 30#include <sys/mman.h> 31#include <sys/resource.h> 32#include <sys/sysctl.h> 33#include <sys/ucontext.h> 34#include <fcntl.h> 35#include <pthread.h> 36#include <stdlib.h> // for free() 37#include <unistd.h> 38#include <libkern/OSAtomic.h> 39#include <CoreFoundation/CFString.h> 40 41namespace __asan { 42 43void GetPcSpBp(void *context, uptr *pc, uptr *sp, uptr *bp) { 44 ucontext_t *ucontext = (ucontext_t*)context; 45# if SANITIZER_WORDSIZE == 64 46 *pc = ucontext->uc_mcontext->__ss.__rip; 47 *bp = ucontext->uc_mcontext->__ss.__rbp; 48 *sp = ucontext->uc_mcontext->__ss.__rsp; 49# else 50 *pc = ucontext->uc_mcontext->__ss.__eip; 51 *bp = ucontext->uc_mcontext->__ss.__ebp; 52 *sp = ucontext->uc_mcontext->__ss.__esp; 53# endif // SANITIZER_WORDSIZE 54} 55 56int GetMacosVersion() { 57 int mib[2] = { CTL_KERN, KERN_OSRELEASE }; 58 char version[100]; 59 uptr len = 0, maxlen = sizeof(version) / sizeof(version[0]); 60 for (uptr i = 0; i < maxlen; i++) version[i] = '\0'; 61 // Get the version length. 62 CHECK(sysctl(mib, 2, 0, &len, 0, 0) != -1); 63 CHECK(len < maxlen); 64 CHECK(sysctl(mib, 2, version, &len, 0, 0) != -1); 65 switch (version[0]) { 66 case '9': return MACOS_VERSION_LEOPARD; 67 case '1': { 68 switch (version[1]) { 69 case '0': return MACOS_VERSION_SNOW_LEOPARD; 70 case '1': return MACOS_VERSION_LION; 71 case '2': return MACOS_VERSION_MOUNTAIN_LION; 72 default: return MACOS_VERSION_UNKNOWN; 73 } 74 } 75 default: return MACOS_VERSION_UNKNOWN; 76 } 77} 78 79bool PlatformHasDifferentMemcpyAndMemmove() { 80 // On OS X 10.7 memcpy() and memmove() are both resolved 81 // into memmove$VARIANT$sse42. 82 // See also http://code.google.com/p/address-sanitizer/issues/detail?id=34. 83 // TODO(glider): need to check dynamically that memcpy() and memmove() are 84 // actually the same function. 85 return GetMacosVersion() == MACOS_VERSION_SNOW_LEOPARD; 86} 87 88extern "C" 89void __asan_init(); 90 91static const char kDyldInsertLibraries[] = "DYLD_INSERT_LIBRARIES"; 92 93void MaybeReexec() { 94 if (!flags()->allow_reexec) return; 95#if MAC_INTERPOSE_FUNCTIONS 96 // If the program is linked with the dynamic ASan runtime library, make sure 97 // the library is preloaded so that the wrappers work. If it is not, set 98 // DYLD_INSERT_LIBRARIES and re-exec ourselves. 99 Dl_info info; 100 CHECK(dladdr((void*)((uptr)__asan_init), &info)); 101 const char *dyld_insert_libraries = GetEnv(kDyldInsertLibraries); 102 if (!dyld_insert_libraries || 103 !REAL(strstr)(dyld_insert_libraries, info.dli_fname)) { 104 // DYLD_INSERT_LIBRARIES is not set or does not contain the runtime 105 // library. 106 char program_name[1024]; 107 uint32_t buf_size = sizeof(program_name); 108 _NSGetExecutablePath(program_name, &buf_size); 109 // Ok to use setenv() since the wrappers don't depend on the value of 110 // asan_inited. 111 setenv(kDyldInsertLibraries, info.dli_fname, /*overwrite*/0); 112 if (flags()->verbosity >= 1) { 113 Report("exec()-ing the program with\n"); 114 Report("%s=%s\n", kDyldInsertLibraries, info.dli_fname); 115 Report("to enable ASan wrappers.\n"); 116 Report("Set ASAN_OPTIONS=allow_reexec=0 to disable this.\n"); 117 } 118 execv(program_name, *_NSGetArgv()); 119 } 120#endif // MAC_INTERPOSE_FUNCTIONS 121 // If we're not using the dynamic runtime, do nothing. 122} 123 124// No-op. Mac does not support static linkage anyway. 125void *AsanDoesNotSupportStaticLinkage() { 126 return 0; 127} 128 129bool AsanInterceptsSignal(int signum) { 130 return (signum == SIGSEGV || signum == SIGBUS) && flags()->handle_segv; 131} 132 133void AsanPlatformThreadInit() { 134 // For the first program thread, we can't replace the allocator before 135 // __CFInitialize() has been called. If it hasn't, we'll call 136 // MaybeReplaceCFAllocator() later on this thread. 137 // For other threads __CFInitialize() has been called before their creation. 138 // See also asan_malloc_mac.cc. 139 if (((CFRuntimeBase*)kCFAllocatorSystemDefault)->_cfisa) { 140 MaybeReplaceCFAllocator(); 141 } 142} 143 144AsanLock::AsanLock(LinkerInitialized) { 145 // We assume that OS_SPINLOCK_INIT is zero 146} 147 148void AsanLock::Lock() { 149 CHECK(sizeof(OSSpinLock) <= sizeof(opaque_storage_)); 150 CHECK(OS_SPINLOCK_INIT == 0); 151 CHECK(owner_ != (uptr)pthread_self()); 152 OSSpinLockLock((OSSpinLock*)&opaque_storage_); 153 CHECK(!owner_); 154 owner_ = (uptr)pthread_self(); 155} 156 157void AsanLock::Unlock() { 158 CHECK(owner_ == (uptr)pthread_self()); 159 owner_ = 0; 160 OSSpinLockUnlock((OSSpinLock*)&opaque_storage_); 161} 162 163void GetStackTrace(StackTrace *stack, uptr max_s, uptr pc, uptr bp) { 164 stack->size = 0; 165 stack->trace[0] = pc; 166 if ((max_s) > 1) { 167 stack->max_size = max_s; 168 if (!asan_inited) return; 169 if (AsanThread *t = asanThreadRegistry().GetCurrent()) 170 stack->FastUnwindStack(pc, bp, t->stack_top(), t->stack_bottom()); 171 } 172} 173 174void ClearShadowMemoryForContext(void *context) { 175 UNIMPLEMENTED(); 176} 177 178// The range of pages to be used for escape islands. 179// TODO(glider): instead of mapping a fixed range we must find a range of 180// unmapped pages in vmmap and take them. 181// These constants were chosen empirically and may not work if the shadow 182// memory layout changes. Unfortunately they do necessarily depend on 183// kHighMemBeg or kHighMemEnd. 184static void *island_allocator_pos = 0; 185 186#if SANITIZER_WORDSIZE == 32 187# define kIslandEnd (0xffdf0000 - GetPageSizeCached()) 188# define kIslandBeg (kIslandEnd - 256 * GetPageSizeCached()) 189#else 190# define kIslandEnd (0x7fffffdf0000 - GetPageSizeCached()) 191# define kIslandBeg (kIslandEnd - 256 * GetPageSizeCached()) 192#endif 193 194extern "C" 195mach_error_t __interception_allocate_island(void **ptr, 196 uptr unused_size, 197 void *unused_hint) { 198 if (!island_allocator_pos) { 199 island_allocator_pos = 200 internal_mmap((void*)kIslandBeg, kIslandEnd - kIslandBeg, 201 PROT_READ | PROT_WRITE | PROT_EXEC, 202 MAP_PRIVATE | MAP_ANON | MAP_FIXED, 203 -1, 0); 204 if (island_allocator_pos != (void*)kIslandBeg) { 205 return KERN_NO_SPACE; 206 } 207 if (flags()->verbosity) { 208 Report("Mapped pages %p--%p for branch islands.\n", 209 (void*)kIslandBeg, (void*)kIslandEnd); 210 } 211 // Should not be very performance-critical. 212 internal_memset(island_allocator_pos, 0xCC, kIslandEnd - kIslandBeg); 213 }; 214 *ptr = island_allocator_pos; 215 island_allocator_pos = (char*)island_allocator_pos + GetPageSizeCached(); 216 if (flags()->verbosity) { 217 Report("Branch island allocated at %p\n", *ptr); 218 } 219 return err_none; 220} 221 222extern "C" 223mach_error_t __interception_deallocate_island(void *ptr) { 224 // Do nothing. 225 // TODO(glider): allow to free and reuse the island memory. 226 return err_none; 227} 228 229// Support for the following functions from libdispatch on Mac OS: 230// dispatch_async_f() 231// dispatch_async() 232// dispatch_sync_f() 233// dispatch_sync() 234// dispatch_after_f() 235// dispatch_after() 236// dispatch_group_async_f() 237// dispatch_group_async() 238// TODO(glider): libdispatch API contains other functions that we don't support 239// yet. 240// 241// dispatch_sync() and dispatch_sync_f() are synchronous, although chances are 242// they can cause jobs to run on a thread different from the current one. 243// TODO(glider): if so, we need a test for this (otherwise we should remove 244// them). 245// 246// The following functions use dispatch_barrier_async_f() (which isn't a library 247// function but is exported) and are thus supported: 248// dispatch_source_set_cancel_handler_f() 249// dispatch_source_set_cancel_handler() 250// dispatch_source_set_event_handler_f() 251// dispatch_source_set_event_handler() 252// 253// The reference manual for Grand Central Dispatch is available at 254// http://developer.apple.com/library/mac/#documentation/Performance/Reference/GCD_libdispatch_Ref/Reference/reference.html 255// The implementation details are at 256// http://libdispatch.macosforge.org/trac/browser/trunk/src/queue.c 257 258typedef void* pthread_workqueue_t; 259typedef void* pthread_workitem_handle_t; 260 261typedef void* dispatch_group_t; 262typedef void* dispatch_queue_t; 263typedef void* dispatch_source_t; 264typedef u64 dispatch_time_t; 265typedef void (*dispatch_function_t)(void *block); 266typedef void* (*worker_t)(void *block); 267 268// A wrapper for the ObjC blocks used to support libdispatch. 269typedef struct { 270 void *block; 271 dispatch_function_t func; 272 u32 parent_tid; 273} asan_block_context_t; 274 275// We use extern declarations of libdispatch functions here instead 276// of including <dispatch/dispatch.h>. This header is not present on 277// Mac OS X Leopard and eariler, and although we don't expect ASan to 278// work on legacy systems, it's bad to break the build of 279// LLVM compiler-rt there. 280extern "C" { 281void dispatch_async_f(dispatch_queue_t dq, void *ctxt, 282 dispatch_function_t func); 283void dispatch_sync_f(dispatch_queue_t dq, void *ctxt, 284 dispatch_function_t func); 285void dispatch_after_f(dispatch_time_t when, dispatch_queue_t dq, void *ctxt, 286 dispatch_function_t func); 287void dispatch_barrier_async_f(dispatch_queue_t dq, void *ctxt, 288 dispatch_function_t func); 289void dispatch_group_async_f(dispatch_group_t group, dispatch_queue_t dq, 290 void *ctxt, dispatch_function_t func); 291int pthread_workqueue_additem_np(pthread_workqueue_t workq, 292 void *(*workitem_func)(void *), void * workitem_arg, 293 pthread_workitem_handle_t * itemhandlep, unsigned int *gencountp); 294} // extern "C" 295 296static ALWAYS_INLINE 297void asan_register_worker_thread(int parent_tid, StackTrace *stack) { 298 AsanThread *t = asanThreadRegistry().GetCurrent(); 299 if (!t) { 300 t = AsanThread::Create(parent_tid, 0, 0, stack); 301 asanThreadRegistry().RegisterThread(t); 302 t->Init(); 303 asanThreadRegistry().SetCurrent(t); 304 } 305} 306 307// For use by only those functions that allocated the context via 308// alloc_asan_context(). 309extern "C" 310void asan_dispatch_call_block_and_release(void *block) { 311 GET_STACK_TRACE_HERE(kStackTraceMax); 312 asan_block_context_t *context = (asan_block_context_t*)block; 313 if (flags()->verbosity >= 2) { 314 Report("asan_dispatch_call_block_and_release(): " 315 "context: %p, pthread_self: %p\n", 316 block, pthread_self()); 317 } 318 asan_register_worker_thread(context->parent_tid, &stack); 319 // Call the original dispatcher for the block. 320 context->func(context->block); 321 asan_free(context, &stack); 322} 323 324} // namespace __asan 325 326using namespace __asan; // NOLINT 327 328// Wrap |ctxt| and |func| into an asan_block_context_t. 329// The caller retains control of the allocated context. 330extern "C" 331asan_block_context_t *alloc_asan_context(void *ctxt, dispatch_function_t func, 332 StackTrace *stack) { 333 asan_block_context_t *asan_ctxt = 334 (asan_block_context_t*) asan_malloc(sizeof(asan_block_context_t), stack); 335 asan_ctxt->block = ctxt; 336 asan_ctxt->func = func; 337 asan_ctxt->parent_tid = asanThreadRegistry().GetCurrentTidOrInvalid(); 338 return asan_ctxt; 339} 340 341// Define interceptor for dispatch_*_f function with the three most common 342// parameters: dispatch_queue_t, context, dispatch_function_t. 343#define INTERCEPT_DISPATCH_X_F_3(dispatch_x_f) \ 344 INTERCEPTOR(void, dispatch_x_f, dispatch_queue_t dq, void *ctxt, \ 345 dispatch_function_t func) { \ 346 GET_STACK_TRACE_HERE(kStackTraceMax); \ 347 asan_block_context_t *asan_ctxt = alloc_asan_context(ctxt, func, &stack); \ 348 if (flags()->verbosity >= 2) { \ 349 Report(#dispatch_x_f "(): context: %p, pthread_self: %p\n", \ 350 asan_ctxt, pthread_self()); \ 351 PRINT_CURRENT_STACK(); \ 352 } \ 353 return REAL(dispatch_x_f)(dq, (void*)asan_ctxt, \ 354 asan_dispatch_call_block_and_release); \ 355 } 356 357INTERCEPT_DISPATCH_X_F_3(dispatch_async_f) 358INTERCEPT_DISPATCH_X_F_3(dispatch_sync_f) 359INTERCEPT_DISPATCH_X_F_3(dispatch_barrier_async_f) 360 361INTERCEPTOR(void, dispatch_after_f, dispatch_time_t when, 362 dispatch_queue_t dq, void *ctxt, 363 dispatch_function_t func) { 364 GET_STACK_TRACE_HERE(kStackTraceMax); 365 asan_block_context_t *asan_ctxt = alloc_asan_context(ctxt, func, &stack); 366 if (flags()->verbosity >= 2) { 367 Report("dispatch_after_f: %p\n", asan_ctxt); 368 PRINT_CURRENT_STACK(); 369 } 370 return REAL(dispatch_after_f)(when, dq, (void*)asan_ctxt, 371 asan_dispatch_call_block_and_release); 372} 373 374INTERCEPTOR(void, dispatch_group_async_f, dispatch_group_t group, 375 dispatch_queue_t dq, void *ctxt, 376 dispatch_function_t func) { 377 GET_STACK_TRACE_HERE(kStackTraceMax); 378 asan_block_context_t *asan_ctxt = alloc_asan_context(ctxt, func, &stack); 379 if (flags()->verbosity >= 2) { 380 Report("dispatch_group_async_f(): context: %p, pthread_self: %p\n", 381 asan_ctxt, pthread_self()); 382 PRINT_CURRENT_STACK(); 383 } 384 REAL(dispatch_group_async_f)(group, dq, (void*)asan_ctxt, 385 asan_dispatch_call_block_and_release); 386} 387 388#if MAC_INTERPOSE_FUNCTIONS && !defined(MISSING_BLOCKS_SUPPORT) 389// dispatch_async, dispatch_group_async and others tailcall the corresponding 390// dispatch_*_f functions. When wrapping functions with mach_override, those 391// dispatch_*_f are intercepted automatically. But with dylib interposition 392// this does not work, because the calls within the same library are not 393// interposed. 394// Therefore we need to re-implement dispatch_async and friends. 395 396extern "C" { 397// FIXME: consolidate these declarations with asan_intercepted_functions.h. 398void dispatch_async(dispatch_queue_t dq, void(^work)(void)); 399void dispatch_group_async(dispatch_group_t dg, dispatch_queue_t dq, 400 void(^work)(void)); 401void dispatch_after(dispatch_time_t when, dispatch_queue_t queue, 402 void(^work)(void)); 403void dispatch_source_set_cancel_handler(dispatch_source_t ds, 404 void(^work)(void)); 405void dispatch_source_set_event_handler(dispatch_source_t ds, void(^work)(void)); 406} 407 408#define GET_ASAN_BLOCK(work) \ 409 void (^asan_block)(void); \ 410 int parent_tid = asanThreadRegistry().GetCurrentTidOrInvalid(); \ 411 asan_block = ^(void) { \ 412 GET_STACK_TRACE_HERE(kStackTraceMax); \ 413 asan_register_worker_thread(parent_tid, &stack); \ 414 work(); \ 415 } 416 417INTERCEPTOR(void, dispatch_async, 418 dispatch_queue_t dq, void(^work)(void)) { 419 GET_ASAN_BLOCK(work); 420 REAL(dispatch_async)(dq, asan_block); 421} 422 423INTERCEPTOR(void, dispatch_group_async, 424 dispatch_group_t dg, dispatch_queue_t dq, void(^work)(void)) { 425 GET_ASAN_BLOCK(work); 426 REAL(dispatch_group_async)(dg, dq, asan_block); 427} 428 429INTERCEPTOR(void, dispatch_after, 430 dispatch_time_t when, dispatch_queue_t queue, void(^work)(void)) { 431 GET_ASAN_BLOCK(work); 432 REAL(dispatch_after)(when, queue, asan_block); 433} 434 435INTERCEPTOR(void, dispatch_source_set_cancel_handler, 436 dispatch_source_t ds, void(^work)(void)) { 437 GET_ASAN_BLOCK(work); 438 REAL(dispatch_source_set_cancel_handler)(ds, asan_block); 439} 440 441INTERCEPTOR(void, dispatch_source_set_event_handler, 442 dispatch_source_t ds, void(^work)(void)) { 443 GET_ASAN_BLOCK(work); 444 REAL(dispatch_source_set_event_handler)(ds, asan_block); 445} 446#endif 447 448// The following stuff has been extremely helpful while looking for the 449// unhandled functions that spawned jobs on Chromium shutdown. If the verbosity 450// level is 2 or greater, we wrap pthread_workqueue_additem_np() in order to 451// find the points of worker thread creation (each of such threads may be used 452// to run several tasks, that's why this is not enough to support the whole 453// libdispatch API. 454extern "C" 455void *wrap_workitem_func(void *arg) { 456 if (flags()->verbosity >= 2) { 457 Report("wrap_workitem_func: %p, pthread_self: %p\n", arg, pthread_self()); 458 } 459 asan_block_context_t *ctxt = (asan_block_context_t*)arg; 460 worker_t fn = (worker_t)(ctxt->func); 461 void *result = fn(ctxt->block); 462 GET_STACK_TRACE_HERE(kStackTraceMax); 463 asan_free(arg, &stack); 464 return result; 465} 466 467INTERCEPTOR(int, pthread_workqueue_additem_np, pthread_workqueue_t workq, 468 void *(*workitem_func)(void *), void * workitem_arg, 469 pthread_workitem_handle_t * itemhandlep, unsigned int *gencountp) { 470 GET_STACK_TRACE_HERE(kStackTraceMax); 471 asan_block_context_t *asan_ctxt = 472 (asan_block_context_t*) asan_malloc(sizeof(asan_block_context_t), &stack); 473 asan_ctxt->block = workitem_arg; 474 asan_ctxt->func = (dispatch_function_t)workitem_func; 475 asan_ctxt->parent_tid = asanThreadRegistry().GetCurrentTidOrInvalid(); 476 if (flags()->verbosity >= 2) { 477 Report("pthread_workqueue_additem_np: %p\n", asan_ctxt); 478 PRINT_CURRENT_STACK(); 479 } 480 return REAL(pthread_workqueue_additem_np)(workq, wrap_workitem_func, 481 asan_ctxt, itemhandlep, 482 gencountp); 483} 484 485// See http://opensource.apple.com/source/CF/CF-635.15/CFString.c 486int __CFStrIsConstant(CFStringRef str) { 487 CFRuntimeBase *base = (CFRuntimeBase*)str; 488#if __LP64__ 489 return base->_rc == 0; 490#else 491 return (base->_cfinfo[CF_RC_BITS]) == 0; 492#endif 493} 494 495INTERCEPTOR(CFStringRef, CFStringCreateCopy, CFAllocatorRef alloc, 496 CFStringRef str) { 497 if (__CFStrIsConstant(str)) { 498 return str; 499 } else { 500 return REAL(CFStringCreateCopy)(alloc, str); 501 } 502} 503 504DECLARE_REAL_AND_INTERCEPTOR(void, free, void *ptr) 505 506DECLARE_REAL_AND_INTERCEPTOR(void, __CFInitialize, void) 507 508namespace __asan { 509 510void InitializeMacInterceptors() { 511 CHECK(INTERCEPT_FUNCTION(dispatch_async_f)); 512 CHECK(INTERCEPT_FUNCTION(dispatch_sync_f)); 513 CHECK(INTERCEPT_FUNCTION(dispatch_after_f)); 514 CHECK(INTERCEPT_FUNCTION(dispatch_barrier_async_f)); 515 CHECK(INTERCEPT_FUNCTION(dispatch_group_async_f)); 516 // We don't need to intercept pthread_workqueue_additem_np() to support the 517 // libdispatch API, but it helps us to debug the unsupported functions. Let's 518 // intercept it only during verbose runs. 519 if (flags()->verbosity >= 2) { 520 CHECK(INTERCEPT_FUNCTION(pthread_workqueue_additem_np)); 521 } 522 // Normally CFStringCreateCopy should not copy constant CF strings. 523 // Replacing the default CFAllocator causes constant strings to be copied 524 // rather than just returned, which leads to bugs in big applications like 525 // Chromium and WebKit, see 526 // http://code.google.com/p/address-sanitizer/issues/detail?id=10 527 // Until this problem is fixed we need to check that the string is 528 // non-constant before calling CFStringCreateCopy. 529 CHECK(INTERCEPT_FUNCTION(CFStringCreateCopy)); 530 // Some of the library functions call free() directly, so we have to 531 // intercept it. 532 CHECK(INTERCEPT_FUNCTION(free)); 533 if (flags()->replace_cfallocator) { 534 CHECK(INTERCEPT_FUNCTION(__CFInitialize)); 535 } 536} 537 538} // namespace __asan 539 540#endif // __APPLE__ 541