asan_malloc_mac.cc revision 0fedcd5abe8e9d51dc7177cf2fa239d9b83e270b
1//===-- asan_rtl.cc -------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Mac-specific malloc interception. 13//===----------------------------------------------------------------------===// 14 15#ifdef __APPLE__ 16 17#include <AvailabilityMacros.h> 18#include <CoreFoundation/CFBase.h> 19#include <dlfcn.h> 20#include <malloc/malloc.h> 21#include <setjmp.h> 22 23#include "asan_allocator.h" 24#include "asan_interceptors.h" 25#include "asan_internal.h" 26#include "asan_mac.h" 27#include "asan_stack.h" 28 29// Similar code is used in Google Perftools, 30// http://code.google.com/p/google-perftools. 31 32// ---------------------- Replacement functions ---------------- {{{1 33using namespace __asan; // NOLINT 34 35// TODO(glider): do we need both zones? 36static malloc_zone_t *system_malloc_zone = 0; 37static malloc_zone_t *system_purgeable_zone = 0; 38static malloc_zone_t asan_zone; 39CFAllocatorRef cf_asan = 0; 40 41// The free() implementation provided by OS X calls malloc_zone_from_ptr() 42// to find the owner of |ptr|. If the result is 0, an invalid free() is 43// reported. Our implementation falls back to asan_free() in this case 44// in order to print an ASan-style report. 45// 46// For the objects created by _CFRuntimeCreateInstance a CFAllocatorRef is 47// placed at the beginning of the allocated chunk and the pointer returned by 48// our allocator is off by sizeof(CFAllocatorRef). This pointer can be then 49// passed directly to free(), which will lead to errors. 50// To overcome this we're checking whether |ptr-sizeof(CFAllocatorRef)| 51// contains a pointer to our CFAllocator (assuming no other allocator is used). 52// See http://code.google.com/p/address-sanitizer/issues/detail?id=70 for more 53// info. 54INTERCEPTOR(void, free, void *ptr) { 55 malloc_zone_t *zone = malloc_zone_from_ptr(ptr); 56 if (zone) { 57#if defined(MAC_OS_X_VERSION_10_6) && \ 58 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 59 if ((zone->version >= 6) && (zone->free_definite_size)) { 60 zone->free_definite_size(zone, ptr, malloc_size(ptr)); 61 } else { 62 malloc_zone_free(zone, ptr); 63 } 64#else 65 malloc_zone_free(zone, ptr); 66#endif 67 } else { 68 if (FLAG_replace_cfallocator) { 69 // Make sure we're not hitting the previous page. This may be incorrect 70 // if ASan's malloc returns an address ending with 0xFF8, which will be 71 // then padded to a page boundary with a CFAllocatorRef. 72 uptr arith_ptr = (uptr)ptr; 73 if ((arith_ptr & 0xFFF) > sizeof(CFAllocatorRef)) { 74 CFAllocatorRef *saved = 75 (CFAllocatorRef*)(arith_ptr - sizeof(CFAllocatorRef)); 76 if ((*saved == cf_asan) && asan_mz_size(saved)) ptr = (void*)saved; 77 } 78 } 79 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 80 asan_free(ptr, &stack); 81 } 82} 83 84namespace __asan { 85 void ReplaceCFAllocator(); 86} 87 88// We can't always replace the default CFAllocator with cf_asan right in 89// ReplaceSystemMalloc(), because it is sometimes called before 90// __CFInitialize(), when the default allocator is invalid and replacing it may 91// crash the program. Instead we wait for the allocator to initialize and jump 92// in just after __CFInitialize(). Nobody is going to allocate memory using 93// CFAllocators before that, so we won't miss anything. 94// 95// See http://code.google.com/p/address-sanitizer/issues/detail?id=87 96// and http://opensource.apple.com/source/CF/CF-550.43/CFRuntime.c 97INTERCEPTOR(void, __CFInitialize) { 98 CHECK(FLAG_replace_cfallocator); 99 CHECK(asan_inited); 100 REAL(__CFInitialize)(); 101 if (!cf_asan) ReplaceCFAllocator(); 102} 103 104namespace { 105 106// TODO(glider): the mz_* functions should be united with the Linux wrappers, 107// as they are basically copied from there. 108size_t mz_size(malloc_zone_t* zone, const void* ptr) { 109 return asan_mz_size(ptr); 110} 111 112void *mz_malloc(malloc_zone_t *zone, size_t size) { 113 if (!asan_inited) { 114 CHECK(system_malloc_zone); 115 return malloc_zone_malloc(system_malloc_zone, size); 116 } 117 GET_STACK_TRACE_HERE_FOR_MALLOC; 118 return asan_malloc(size, &stack); 119} 120 121void *cf_malloc(CFIndex size, CFOptionFlags hint, void *info) { 122 if (!asan_inited) { 123 CHECK(system_malloc_zone); 124 return malloc_zone_malloc(system_malloc_zone, size); 125 } 126 GET_STACK_TRACE_HERE_FOR_MALLOC; 127 return asan_malloc(size, &stack); 128} 129 130void *mz_calloc(malloc_zone_t *zone, size_t nmemb, size_t size) { 131 if (!asan_inited) { 132 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym. 133 const size_t kCallocPoolSize = 1024; 134 static uptr calloc_memory_for_dlsym[kCallocPoolSize]; 135 static size_t allocated; 136 size_t size_in_words = ((nmemb * size) + kWordSize - 1) / kWordSize; 137 void *mem = (void*)&calloc_memory_for_dlsym[allocated]; 138 allocated += size_in_words; 139 CHECK(allocated < kCallocPoolSize); 140 return mem; 141 } 142 GET_STACK_TRACE_HERE_FOR_MALLOC; 143 return asan_calloc(nmemb, size, &stack); 144} 145 146void *mz_valloc(malloc_zone_t *zone, size_t size) { 147 if (!asan_inited) { 148 CHECK(system_malloc_zone); 149 return malloc_zone_valloc(system_malloc_zone, size); 150 } 151 GET_STACK_TRACE_HERE_FOR_MALLOC; 152 return asan_memalign(kPageSize, size, &stack); 153} 154 155void print_zone_for_ptr(void *ptr) { 156 malloc_zone_t *orig_zone = malloc_zone_from_ptr(ptr); 157 if (orig_zone) { 158 if (orig_zone->zone_name) { 159 AsanPrintf("malloc_zone_from_ptr(%p) = %p, which is %s\n", 160 ptr, orig_zone, orig_zone->zone_name); 161 } else { 162 AsanPrintf("malloc_zone_from_ptr(%p) = %p, which doesn't have a name\n", 163 ptr, orig_zone); 164 } 165 } else { 166 AsanPrintf("malloc_zone_from_ptr(%p) = 0\n", ptr); 167 } 168} 169 170void ALWAYS_INLINE free_common(void *context, void *ptr) { 171 if (!ptr) return; 172 if (!FLAG_mac_ignore_invalid_free || asan_mz_size(ptr)) { 173 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 174 asan_free(ptr, &stack); 175 } else { 176 // Let us just leak this memory for now. 177 AsanPrintf("free_common(%p) -- attempting to free unallocated memory.\n" 178 "AddressSanitizer is ignoring this error on Mac OS now.\n", 179 ptr); 180 print_zone_for_ptr(ptr); 181 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 182 stack.PrintStack(); 183 return; 184 } 185} 186 187// TODO(glider): the allocation callbacks need to be refactored. 188void mz_free(malloc_zone_t *zone, void *ptr) { 189 free_common(zone, ptr); 190} 191 192void cf_free(void *ptr, void *info) { 193 free_common(info, ptr); 194} 195 196void *mz_realloc(malloc_zone_t *zone, void *ptr, size_t size) { 197 if (!ptr) { 198 GET_STACK_TRACE_HERE_FOR_MALLOC; 199 return asan_malloc(size, &stack); 200 } else { 201 if (asan_mz_size(ptr)) { 202 GET_STACK_TRACE_HERE_FOR_MALLOC; 203 return asan_realloc(ptr, size, &stack); 204 } else { 205 // We can't recover from reallocating an unknown address, because 206 // this would require reading at most |size| bytes from 207 // potentially unaccessible memory. 208 AsanPrintf("mz_realloc(%p) -- attempting to realloc unallocated memory.\n" 209 "This is an unrecoverable problem, exiting now.\n", 210 ptr); 211 print_zone_for_ptr(ptr); 212 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 213 stack.PrintStack(); 214 ShowStatsAndAbort(); 215 return 0; // unreachable 216 } 217 } 218} 219 220void *cf_realloc(void *ptr, CFIndex size, CFOptionFlags hint, void *info) { 221 if (!ptr) { 222 GET_STACK_TRACE_HERE_FOR_MALLOC; 223 return asan_malloc(size, &stack); 224 } else { 225 if (asan_mz_size(ptr)) { 226 GET_STACK_TRACE_HERE_FOR_MALLOC; 227 return asan_realloc(ptr, size, &stack); 228 } else { 229 // We can't recover from reallocating an unknown address, because 230 // this would require reading at most |size| bytes from 231 // potentially unaccessible memory. 232 AsanPrintf("cf_realloc(%p) -- attempting to realloc unallocated memory.\n" 233 "This is an unrecoverable problem, exiting now.\n", 234 ptr); 235 print_zone_for_ptr(ptr); 236 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 237 stack.PrintStack(); 238 ShowStatsAndAbort(); 239 return 0; // unreachable 240 } 241 } 242} 243 244void mz_destroy(malloc_zone_t* zone) { 245 // A no-op -- we will not be destroyed! 246 AsanPrintf("mz_destroy() called -- ignoring\n"); 247} 248 // from AvailabilityMacros.h 249#if defined(MAC_OS_X_VERSION_10_6) && \ 250 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 251void *mz_memalign(malloc_zone_t *zone, size_t align, size_t size) { 252 if (!asan_inited) { 253 CHECK(system_malloc_zone); 254 return malloc_zone_memalign(system_malloc_zone, align, size); 255 } 256 GET_STACK_TRACE_HERE_FOR_MALLOC; 257 return asan_memalign(align, size, &stack); 258} 259 260// This function is currently unused, and we build with -Werror. 261#if 0 262void mz_free_definite_size(malloc_zone_t* zone, void *ptr, size_t size) { 263 // TODO(glider): check that |size| is valid. 264 UNIMPLEMENTED(); 265} 266#endif 267#endif 268 269// malloc_introspection callbacks. I'm not clear on what all of these do. 270kern_return_t mi_enumerator(task_t task, void *, 271 unsigned type_mask, vm_address_t zone_address, 272 memory_reader_t reader, 273 vm_range_recorder_t recorder) { 274 // Should enumerate all the pointers we have. Seems like a lot of work. 275 return KERN_FAILURE; 276} 277 278size_t mi_good_size(malloc_zone_t *zone, size_t size) { 279 // I think it's always safe to return size, but we maybe could do better. 280 return size; 281} 282 283boolean_t mi_check(malloc_zone_t *zone) { 284 UNIMPLEMENTED(); 285 return true; 286} 287 288void mi_print(malloc_zone_t *zone, boolean_t verbose) { 289 UNIMPLEMENTED(); 290 return; 291} 292 293void mi_log(malloc_zone_t *zone, void *address) { 294 // I don't think we support anything like this 295} 296 297void mi_force_lock(malloc_zone_t *zone) { 298 asan_mz_force_lock(); 299} 300 301void mi_force_unlock(malloc_zone_t *zone) { 302 asan_mz_force_unlock(); 303} 304 305// This function is currently unused, and we build with -Werror. 306#if 0 307void mi_statistics(malloc_zone_t *zone, malloc_statistics_t *stats) { 308 // TODO(csilvers): figure out how to fill these out 309 // TODO(glider): port this from tcmalloc when ready. 310 stats->blocks_in_use = 0; 311 stats->size_in_use = 0; 312 stats->max_size_in_use = 0; 313 stats->size_allocated = 0; 314} 315#endif 316 317#if defined(MAC_OS_X_VERSION_10_6) && \ 318 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 319boolean_t mi_zone_locked(malloc_zone_t *zone) { 320 // UNIMPLEMENTED(); 321 return false; 322} 323#endif 324 325} // unnamed namespace 326 327extern int __CFRuntimeClassTableSize; 328 329namespace __asan { 330void ReplaceCFAllocator() { 331 static CFAllocatorContext asan_context = { 332 /*version*/ 0, /*info*/ &asan_zone, 333 /*retain*/ 0, /*release*/ 0, 334 /*copyDescription*/0, 335 /*allocate*/ &cf_malloc, 336 /*reallocate*/ &cf_realloc, 337 /*deallocate*/ &cf_free, 338 /*preferredSize*/ 0 }; 339 cf_asan = CFAllocatorCreate(kCFAllocatorUseContext, &asan_context); 340 CFAllocatorSetDefault(cf_asan); 341} 342 343void ReplaceSystemMalloc() { 344 static malloc_introspection_t asan_introspection; 345 // Ok to use internal_memset, these places are not performance-critical. 346 internal_memset(&asan_introspection, 0, sizeof(asan_introspection)); 347 348 asan_introspection.enumerator = &mi_enumerator; 349 asan_introspection.good_size = &mi_good_size; 350 asan_introspection.check = &mi_check; 351 asan_introspection.print = &mi_print; 352 asan_introspection.log = &mi_log; 353 asan_introspection.force_lock = &mi_force_lock; 354 asan_introspection.force_unlock = &mi_force_unlock; 355 356 internal_memset(&asan_zone, 0, sizeof(malloc_zone_t)); 357 358 // Start with a version 4 zone which is used for OS X 10.4 and 10.5. 359 asan_zone.version = 4; 360 asan_zone.zone_name = "asan"; 361 asan_zone.size = &mz_size; 362 asan_zone.malloc = &mz_malloc; 363 asan_zone.calloc = &mz_calloc; 364 asan_zone.valloc = &mz_valloc; 365 asan_zone.free = &mz_free; 366 asan_zone.realloc = &mz_realloc; 367 asan_zone.destroy = &mz_destroy; 368 asan_zone.batch_malloc = 0; 369 asan_zone.batch_free = 0; 370 asan_zone.introspect = &asan_introspection; 371 372 // from AvailabilityMacros.h 373#if defined(MAC_OS_X_VERSION_10_6) && \ 374 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 375 // Switch to version 6 on OSX 10.6 to support memalign. 376 asan_zone.version = 6; 377 asan_zone.free_definite_size = 0; 378 asan_zone.memalign = &mz_memalign; 379 asan_introspection.zone_locked = &mi_zone_locked; 380 381 // Request the default purgable zone to force its creation. The 382 // current default zone is registered with the purgable zone for 383 // doing tiny and small allocs. Sadly, it assumes that the default 384 // zone is the szone implementation from OS X and will crash if it 385 // isn't. By creating the zone now, this will be true and changing 386 // the default zone won't cause a problem. (OS X 10.6 and higher.) 387 system_purgeable_zone = malloc_default_purgeable_zone(); 388#endif 389 390 // Register the ASan zone. At this point, it will not be the 391 // default zone. 392 malloc_zone_register(&asan_zone); 393 394 // Unregister and reregister the default zone. Unregistering swaps 395 // the specified zone with the last one registered which for the 396 // default zone makes the more recently registered zone the default 397 // zone. The default zone is then re-registered to ensure that 398 // allocations made from it earlier will be handled correctly. 399 // Things are not guaranteed to work that way, but it's how they work now. 400 system_malloc_zone = malloc_default_zone(); 401 malloc_zone_unregister(system_malloc_zone); 402 malloc_zone_register(system_malloc_zone); 403 // Make sure the default allocator was replaced. 404 CHECK(malloc_default_zone() == &asan_zone); 405 406 if (FLAG_replace_cfallocator) { 407 // If __CFInitialize() hasn't been called yet, cf_asan will be created and 408 // installed as the default allocator after __CFInitialize() finishes (see 409 // the interceptor for __CFInitialize() above). Otherwise install cf_asan 410 // right now. On both Snow Leopard and Lion __CFInitialize() calls 411 // __CFAllocatorInitialize(), which initializes the _base._cfisa field of 412 // the default allocators we check here. 413 if (((CFRuntimeBase*)kCFAllocatorSystemDefault)->_cfisa) { 414 ReplaceCFAllocator(); 415 } 416 } 417} 418} // namespace __asan 419 420#endif // __APPLE__ 421