asan_malloc_mac.cc revision 4ea14c2fa243684e1d7a017bd4f0d1e38801de0a
1f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles)//===-- asan_malloc_mac.cc ------------------------------------------------===// 290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// 390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// The LLVM Compiler Infrastructure 490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// 590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// This file is distributed under the University of Illinois Open Source 6f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles)// License. See LICENSE.TXT for details. 76e8cce623b6e4fe0c9e4af605d675dd9d0338c38Torne (Richard Coles)// 8f8ee788a64d60abd8f2d742a5fdedde054ecd910Torne (Richard Coles)//===----------------------------------------------------------------------===// 990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// 10a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// This file is a part of AddressSanitizer, an address sanity checker. 11a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// 12a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// Mac-specific malloc interception. 13a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)//===----------------------------------------------------------------------===// 14a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 15a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)#ifdef __APPLE__ 1690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 1790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include <AvailabilityMacros.h> 1890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include <CoreFoundation/CFBase.h> 1990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include <dlfcn.h> 2090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include <malloc/malloc.h> 2190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 2290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "asan_allocator.h" 2390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "asan_interceptors.h" 2490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "asan_internal.h" 2590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "asan_mac.h" 2690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "asan_report.h" 2790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "asan_stack.h" 2890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 2990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// Similar code is used in Google Perftools, 3090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// http://code.google.com/p/google-perftools. 3190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 3290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// ---------------------- Replacement functions ---------------- {{{1 3390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)using namespace __asan; // NOLINT 3490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 3590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// TODO(glider): do we need both zones? 3690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)static malloc_zone_t *system_malloc_zone = 0; 3790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)static malloc_zone_t *system_purgeable_zone = 0; 3890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)static malloc_zone_t asan_zone; 3990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)CFAllocatorRef cf_asan = 0; 4090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 4190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// _CFRuntimeCreateInstance() checks whether the supplied allocator is 4290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// kCFAllocatorSystemDefault and, if it is not, stores the allocator reference 4390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// at the beginning of the allocated memory and returns the pointer to the 4490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// allocated memory plus sizeof(CFAllocatorRef). See 4590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// http://www.opensource.apple.com/source/CF/CF-635.21/CFRuntime.c 4690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// Pointers returned by _CFRuntimeCreateInstance() can then be passed directly 4790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// to free() or CFAllocatorDeallocate(), which leads to false invalid free 4890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// reports. 4990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// The corresponding rdar bug is http://openradar.appspot.com/radar?id=1796404. 5090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)void* ALWAYS_INLINE get_saved_cfallocator_ref(void *ptr) { 5190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) if (flags()->replace_cfallocator) { 5290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // Make sure we're not hitting the previous page. This may be incorrect 5390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // if ASan's malloc returns an address ending with 0xFF8, which will be 5490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) // then padded to a page boundary with a CFAllocatorRef. 5590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) uptr arith_ptr = (uptr)ptr; 5690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) if ((arith_ptr & 0xFFF) > sizeof(CFAllocatorRef)) { 5790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) CFAllocatorRef *saved = 5890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) (CFAllocatorRef*)(arith_ptr - sizeof(CFAllocatorRef)); 5990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) if ((*saved == cf_asan) && asan_mz_size(saved)) ptr = (void*)saved; 6090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) } 61a3f7b4e666c476898878fa745f637129375cd889Ben Murdoch } 6290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) return ptr; 6390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)} 6490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 6590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// The free() implementation provided by OS X calls malloc_zone_from_ptr() 6690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// to find the owner of |ptr|. If the result is 0, an invalid free() is 6790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// reported. Our implementation falls back to asan_free() in this case 6890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// in order to print an ASan-style report. 6990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// 7090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// For the objects created by _CFRuntimeCreateInstance a CFAllocatorRef is 7190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// placed at the beginning of the allocated chunk and the pointer returned by 7290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// our allocator is off by sizeof(CFAllocatorRef). This pointer can be then 7390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// passed directly to free(), which will lead to errors. 7490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// To overcome this we're checking whether |ptr-sizeof(CFAllocatorRef)| 7590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// contains a pointer to our CFAllocator (assuming no other allocator is used). 7690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// See http://code.google.com/p/address-sanitizer/issues/detail?id=70 for more 77a3f7b4e666c476898878fa745f637129375cd889Ben Murdoch// info. 7890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)INTERCEPTOR(void, free, void *ptr) { 7990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) malloc_zone_t *zone = malloc_zone_from_ptr(ptr); 8090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) if (zone) { 8190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#if defined(MAC_OS_X_VERSION_10_6) && \ 8290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 8390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) if ((zone->version >= 6) && (zone->free_definite_size)) { 8490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) zone->free_definite_size(zone, ptr, malloc_size(ptr)); 8590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) } else { 8690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) malloc_zone_free(zone, ptr); 8790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) } 8890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#else 8990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) malloc_zone_free(zone, ptr); 9090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#endif 91a3f7b4e666c476898878fa745f637129375cd889Ben Murdoch } else { 9290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) if (!asan_mz_size(ptr)) ptr = get_saved_cfallocator_ref(ptr); 9390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) GET_STACK_TRACE_HERE_FOR_FREE(ptr); 9490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) asan_free(ptr, &stack); 9590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) } 9690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)} 9790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 9890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)namespace __asan { 9990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) void ReplaceCFAllocator(); 10090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)} 10190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 10290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// We can't always replace the default CFAllocator with cf_asan right in 103a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// ReplaceSystemMalloc(), because it is sometimes called before 10490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// __CFInitialize(), when the default allocator is invalid and replacing it may 105a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// crash the program. Instead we wait for the allocator to initialize and jump 10690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// in just after __CFInitialize(). Nobody is going to allocate memory using 10790dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// CFAllocators before that, so we won't miss anything. 10890dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)// 109a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// See http://code.google.com/p/address-sanitizer/issues/detail?id=87 110a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)// and http://opensource.apple.com/source/CF/CF-550.43/CFRuntime.c 111558790d6acca3451cf3a6b497803a5f07d0bec58Ben MurdochINTERCEPTOR(void, __CFInitialize, void) { 1125d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // If the runtime is built as dynamic library, __CFInitialize wrapper may be 1135d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) // called before __asan_init. 1145d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#if !MAC_INTERPOSE_FUNCTIONS 1155d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) CHECK(flags()->replace_cfallocator); 1165d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) CHECK(asan_inited); 1175d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)#endif 1185d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) REAL(__CFInitialize)(); 1195d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) if (!cf_asan && asan_inited) ReplaceCFAllocator(); 1205d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)} 1215d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1225d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)namespace { 1235d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) 1245d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)// TODO(glider): the mz_* functions should be united with the Linux wrappers, 1255d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)// as they are basically copied from there. 1265d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)size_t mz_size(malloc_zone_t* zone, const void* ptr) { 1275d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles) return asan_mz_size(ptr); 128a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles)} 129a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) 1305d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)void *mz_malloc(malloc_zone_t *zone, size_t size) { 131558790d6acca3451cf3a6b497803a5f07d0bec58Ben Murdoch if (!asan_inited) { 132558790d6acca3451cf3a6b497803a5f07d0bec58Ben Murdoch CHECK(system_malloc_zone); 133a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return malloc_zone_malloc(system_malloc_zone, size); 134a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) } 135a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) GET_STACK_TRACE_HERE_FOR_MALLOC; 136a1401311d1ab56c4ed0a474bd38c108f75cb0cd9Torne (Richard Coles) return asan_malloc(size, &stack); 137558790d6acca3451cf3a6b497803a5f07d0bec58Ben Murdoch} 138a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 139a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)void *cf_malloc(CFIndex size, CFOptionFlags hint, void *info) { 140a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) if (!asan_inited) { 141a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) CHECK(system_malloc_zone); 142558790d6acca3451cf3a6b497803a5f07d0bec58Ben Murdoch return malloc_zone_malloc(system_malloc_zone, size); 143558790d6acca3451cf3a6b497803a5f07d0bec58Ben Murdoch } 144558790d6acca3451cf3a6b497803a5f07d0bec58Ben Murdoch GET_STACK_TRACE_HERE_FOR_MALLOC; 145a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) return asan_malloc(size, &stack); 146a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)} 147a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles) 148a3f6a49ab37290eeeb8db0f41ec0f1cb74a68be7Torne (Richard Coles)void *mz_calloc(malloc_zone_t *zone, size_t nmemb, size_t size) { 149 if (!asan_inited) { 150 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym. 151 const size_t kCallocPoolSize = 1024; 152 static uptr calloc_memory_for_dlsym[kCallocPoolSize]; 153 static size_t allocated; 154 size_t size_in_words = ((nmemb * size) + kWordSize - 1) / kWordSize; 155 void *mem = (void*)&calloc_memory_for_dlsym[allocated]; 156 allocated += size_in_words; 157 CHECK(allocated < kCallocPoolSize); 158 return mem; 159 } 160 GET_STACK_TRACE_HERE_FOR_MALLOC; 161 return asan_calloc(nmemb, size, &stack); 162} 163 164void *mz_valloc(malloc_zone_t *zone, size_t size) { 165 if (!asan_inited) { 166 CHECK(system_malloc_zone); 167 return malloc_zone_valloc(system_malloc_zone, size); 168 } 169 GET_STACK_TRACE_HERE_FOR_MALLOC; 170 return asan_memalign(kPageSize, size, &stack); 171} 172 173#define GET_ZONE_FOR_PTR(ptr) \ 174 malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); \ 175 const char *zone_name = (zone_ptr == 0) ? 0 : zone_ptr->zone_name 176 177void ALWAYS_INLINE free_common(void *context, void *ptr) { 178 if (!ptr) return; 179 if (asan_mz_size(ptr)) { 180 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 181 asan_free(ptr, &stack); 182 } else { 183 // If the pointer does not belong to any of the zones, use one of the 184 // fallback methods to free memory. 185 malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); 186 if (zone_ptr == system_purgeable_zone) { 187 // allocations from malloc_default_purgeable_zone() done before 188 // __asan_init() may be occasionally freed via free_common(). 189 // see http://code.google.com/p/address-sanitizer/issues/detail?id=99. 190 malloc_zone_free(zone_ptr, ptr); 191 } else { 192 // If the memory chunk pointer was moved to store additional 193 // CFAllocatorRef, fix it back. 194 ptr = get_saved_cfallocator_ref(ptr); 195 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 196 if (!flags()->mac_ignore_invalid_free) { 197 asan_free(ptr, &stack); 198 } else { 199 GET_ZONE_FOR_PTR(ptr); 200 WarnMacFreeUnallocated((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); 201 return; 202 } 203 } 204 } 205} 206 207// TODO(glider): the allocation callbacks need to be refactored. 208void mz_free(malloc_zone_t *zone, void *ptr) { 209 free_common(zone, ptr); 210} 211 212void cf_free(void *ptr, void *info) { 213 free_common(info, ptr); 214} 215 216void *mz_realloc(malloc_zone_t *zone, void *ptr, size_t size) { 217 if (!ptr) { 218 GET_STACK_TRACE_HERE_FOR_MALLOC; 219 return asan_malloc(size, &stack); 220 } else { 221 if (asan_mz_size(ptr)) { 222 GET_STACK_TRACE_HERE_FOR_MALLOC; 223 return asan_realloc(ptr, size, &stack); 224 } else { 225 // We can't recover from reallocating an unknown address, because 226 // this would require reading at most |size| bytes from 227 // potentially unaccessible memory. 228 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 229 GET_ZONE_FOR_PTR(ptr); 230 ReportMacMzReallocUnknown((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); 231 } 232 } 233} 234 235void *cf_realloc(void *ptr, CFIndex size, CFOptionFlags hint, void *info) { 236 if (!ptr) { 237 GET_STACK_TRACE_HERE_FOR_MALLOC; 238 return asan_malloc(size, &stack); 239 } else { 240 if (asan_mz_size(ptr)) { 241 GET_STACK_TRACE_HERE_FOR_MALLOC; 242 return asan_realloc(ptr, size, &stack); 243 } else { 244 // We can't recover from reallocating an unknown address, because 245 // this would require reading at most |size| bytes from 246 // potentially unaccessible memory. 247 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 248 GET_ZONE_FOR_PTR(ptr); 249 ReportMacCfReallocUnknown((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); 250 } 251 } 252} 253 254void mz_destroy(malloc_zone_t* zone) { 255 // A no-op -- we will not be destroyed! 256 Printf("mz_destroy() called -- ignoring\n"); 257} 258 // from AvailabilityMacros.h 259#if defined(MAC_OS_X_VERSION_10_6) && \ 260 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 261void *mz_memalign(malloc_zone_t *zone, size_t align, size_t size) { 262 if (!asan_inited) { 263 CHECK(system_malloc_zone); 264 return malloc_zone_memalign(system_malloc_zone, align, size); 265 } 266 GET_STACK_TRACE_HERE_FOR_MALLOC; 267 return asan_memalign(align, size, &stack); 268} 269 270// This function is currently unused, and we build with -Werror. 271#if 0 272void mz_free_definite_size(malloc_zone_t* zone, void *ptr, size_t size) { 273 // TODO(glider): check that |size| is valid. 274 UNIMPLEMENTED(); 275} 276#endif 277#endif 278 279// malloc_introspection callbacks. I'm not clear on what all of these do. 280kern_return_t mi_enumerator(task_t task, void *, 281 unsigned type_mask, vm_address_t zone_address, 282 memory_reader_t reader, 283 vm_range_recorder_t recorder) { 284 // Should enumerate all the pointers we have. Seems like a lot of work. 285 return KERN_FAILURE; 286} 287 288size_t mi_good_size(malloc_zone_t *zone, size_t size) { 289 // I think it's always safe to return size, but we maybe could do better. 290 return size; 291} 292 293boolean_t mi_check(malloc_zone_t *zone) { 294 UNIMPLEMENTED(); 295 return true; 296} 297 298void mi_print(malloc_zone_t *zone, boolean_t verbose) { 299 UNIMPLEMENTED(); 300 return; 301} 302 303void mi_log(malloc_zone_t *zone, void *address) { 304 // I don't think we support anything like this 305} 306 307void mi_force_lock(malloc_zone_t *zone) { 308 asan_mz_force_lock(); 309} 310 311void mi_force_unlock(malloc_zone_t *zone) { 312 asan_mz_force_unlock(); 313} 314 315void mi_statistics(malloc_zone_t *zone, malloc_statistics_t *stats) { 316 // TODO(glider): fill these correctly. 317 stats->blocks_in_use = 0; 318 stats->size_in_use = 0; 319 stats->max_size_in_use = 0; 320 stats->size_allocated = 0; 321} 322 323#if defined(MAC_OS_X_VERSION_10_6) && \ 324 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 325boolean_t mi_zone_locked(malloc_zone_t *zone) { 326 // UNIMPLEMENTED(); 327 return false; 328} 329#endif 330 331} // unnamed namespace 332 333extern int __CFRuntimeClassTableSize; 334 335namespace __asan { 336void ReplaceCFAllocator() { 337 static CFAllocatorContext asan_context = { 338 /*version*/ 0, /*info*/ &asan_zone, 339 /*retain*/ 0, /*release*/ 0, 340 /*copyDescription*/0, 341 /*allocate*/ &cf_malloc, 342 /*reallocate*/ &cf_realloc, 343 /*deallocate*/ &cf_free, 344 /*preferredSize*/ 0 }; 345 if (!cf_asan) 346 cf_asan = CFAllocatorCreate(kCFAllocatorUseContext, &asan_context); 347 if (CFAllocatorGetDefault() != cf_asan) 348 CFAllocatorSetDefault(cf_asan); 349} 350 351void ReplaceSystemMalloc() { 352 static malloc_introspection_t asan_introspection; 353 // Ok to use internal_memset, these places are not performance-critical. 354 internal_memset(&asan_introspection, 0, sizeof(asan_introspection)); 355 356 asan_introspection.enumerator = &mi_enumerator; 357 asan_introspection.good_size = &mi_good_size; 358 asan_introspection.check = &mi_check; 359 asan_introspection.print = &mi_print; 360 asan_introspection.log = &mi_log; 361 asan_introspection.force_lock = &mi_force_lock; 362 asan_introspection.force_unlock = &mi_force_unlock; 363 asan_introspection.statistics = &mi_statistics; 364 365 internal_memset(&asan_zone, 0, sizeof(malloc_zone_t)); 366 367 // Start with a version 4 zone which is used for OS X 10.4 and 10.5. 368 asan_zone.version = 4; 369 asan_zone.zone_name = "asan"; 370 asan_zone.size = &mz_size; 371 asan_zone.malloc = &mz_malloc; 372 asan_zone.calloc = &mz_calloc; 373 asan_zone.valloc = &mz_valloc; 374 asan_zone.free = &mz_free; 375 asan_zone.realloc = &mz_realloc; 376 asan_zone.destroy = &mz_destroy; 377 asan_zone.batch_malloc = 0; 378 asan_zone.batch_free = 0; 379 asan_zone.introspect = &asan_introspection; 380 381 // from AvailabilityMacros.h 382#if defined(MAC_OS_X_VERSION_10_6) && \ 383 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 384 // Switch to version 6 on OSX 10.6 to support memalign. 385 asan_zone.version = 6; 386 asan_zone.free_definite_size = 0; 387 asan_zone.memalign = &mz_memalign; 388 asan_introspection.zone_locked = &mi_zone_locked; 389 390 // Request the default purgable zone to force its creation. The 391 // current default zone is registered with the purgable zone for 392 // doing tiny and small allocs. Sadly, it assumes that the default 393 // zone is the szone implementation from OS X and will crash if it 394 // isn't. By creating the zone now, this will be true and changing 395 // the default zone won't cause a problem. (OS X 10.6 and higher.) 396 system_purgeable_zone = malloc_default_purgeable_zone(); 397#endif 398 399 // Register the ASan zone. At this point, it will not be the 400 // default zone. 401 malloc_zone_register(&asan_zone); 402 403 // Unregister and reregister the default zone. Unregistering swaps 404 // the specified zone with the last one registered which for the 405 // default zone makes the more recently registered zone the default 406 // zone. The default zone is then re-registered to ensure that 407 // allocations made from it earlier will be handled correctly. 408 // Things are not guaranteed to work that way, but it's how they work now. 409 system_malloc_zone = malloc_default_zone(); 410 malloc_zone_unregister(system_malloc_zone); 411 malloc_zone_register(system_malloc_zone); 412 // Make sure the default allocator was replaced. 413 CHECK(malloc_default_zone() == &asan_zone); 414 415 if (flags()->replace_cfallocator) { 416 // If __CFInitialize() hasn't been called yet, cf_asan will be created and 417 // installed as the default allocator after __CFInitialize() finishes (see 418 // the interceptor for __CFInitialize() above). Otherwise install cf_asan 419 // right now. On both Snow Leopard and Lion __CFInitialize() calls 420 // __CFAllocatorInitialize(), which initializes the _base._cfisa field of 421 // the default allocators we check here. 422 if (((CFRuntimeBase*)kCFAllocatorSystemDefault)->_cfisa) { 423 ReplaceCFAllocator(); 424 } 425 } 426} 427} // namespace __asan 428 429#endif // __APPLE__ 430