asan_malloc_mac.cc revision d262653fa207c6ee89700f192c5ff809a8ed6f52
1//===-- asan_rtl.cc -------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Mac-specific malloc interception. 13//===----------------------------------------------------------------------===// 14 15#ifdef __APPLE__ 16 17#include <AvailabilityMacros.h> 18#include <CoreFoundation/CFBase.h> 19#include <dlfcn.h> 20#include <malloc/malloc.h> 21#include <setjmp.h> 22 23#include "asan_allocator.h" 24#include "asan_interceptors.h" 25#include "asan_internal.h" 26#include "asan_mac.h" 27#include "asan_report.h" 28#include "asan_stack.h" 29 30// Similar code is used in Google Perftools, 31// http://code.google.com/p/google-perftools. 32 33// ---------------------- Replacement functions ---------------- {{{1 34using namespace __asan; // NOLINT 35 36// TODO(glider): do we need both zones? 37static malloc_zone_t *system_malloc_zone = 0; 38static malloc_zone_t *system_purgeable_zone = 0; 39static malloc_zone_t asan_zone; 40CFAllocatorRef cf_asan = 0; 41 42// The free() implementation provided by OS X calls malloc_zone_from_ptr() 43// to find the owner of |ptr|. If the result is 0, an invalid free() is 44// reported. Our implementation falls back to asan_free() in this case 45// in order to print an ASan-style report. 46// 47// For the objects created by _CFRuntimeCreateInstance a CFAllocatorRef is 48// placed at the beginning of the allocated chunk and the pointer returned by 49// our allocator is off by sizeof(CFAllocatorRef). This pointer can be then 50// passed directly to free(), which will lead to errors. 51// To overcome this we're checking whether |ptr-sizeof(CFAllocatorRef)| 52// contains a pointer to our CFAllocator (assuming no other allocator is used). 53// See http://code.google.com/p/address-sanitizer/issues/detail?id=70 for more 54// info. 55INTERCEPTOR(void, free, void *ptr) { 56 malloc_zone_t *zone = malloc_zone_from_ptr(ptr); 57 if (zone) { 58#if defined(MAC_OS_X_VERSION_10_6) && \ 59 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 60 if ((zone->version >= 6) && (zone->free_definite_size)) { 61 zone->free_definite_size(zone, ptr, malloc_size(ptr)); 62 } else { 63 malloc_zone_free(zone, ptr); 64 } 65#else 66 malloc_zone_free(zone, ptr); 67#endif 68 } else { 69 if (flags()->replace_cfallocator) { 70 // Make sure we're not hitting the previous page. This may be incorrect 71 // if ASan's malloc returns an address ending with 0xFF8, which will be 72 // then padded to a page boundary with a CFAllocatorRef. 73 uptr arith_ptr = (uptr)ptr; 74 if ((arith_ptr & 0xFFF) > sizeof(CFAllocatorRef)) { 75 CFAllocatorRef *saved = 76 (CFAllocatorRef*)(arith_ptr - sizeof(CFAllocatorRef)); 77 if ((*saved == cf_asan) && asan_mz_size(saved)) ptr = (void*)saved; 78 } 79 } 80 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 81 asan_free(ptr, &stack); 82 } 83} 84 85namespace __asan { 86 void ReplaceCFAllocator(); 87} 88 89// We can't always replace the default CFAllocator with cf_asan right in 90// ReplaceSystemMalloc(), because it is sometimes called before 91// __CFInitialize(), when the default allocator is invalid and replacing it may 92// crash the program. Instead we wait for the allocator to initialize and jump 93// in just after __CFInitialize(). Nobody is going to allocate memory using 94// CFAllocators before that, so we won't miss anything. 95// 96// See http://code.google.com/p/address-sanitizer/issues/detail?id=87 97// and http://opensource.apple.com/source/CF/CF-550.43/CFRuntime.c 98INTERCEPTOR(void, __CFInitialize) { 99 CHECK(flags()->replace_cfallocator); 100 CHECK(asan_inited); 101 REAL(__CFInitialize)(); 102 if (!cf_asan) ReplaceCFAllocator(); 103} 104 105namespace { 106 107// TODO(glider): the mz_* functions should be united with the Linux wrappers, 108// as they are basically copied from there. 109size_t mz_size(malloc_zone_t* zone, const void* ptr) { 110 return asan_mz_size(ptr); 111} 112 113void *mz_malloc(malloc_zone_t *zone, size_t size) { 114 if (!asan_inited) { 115 CHECK(system_malloc_zone); 116 return malloc_zone_malloc(system_malloc_zone, size); 117 } 118 GET_STACK_TRACE_HERE_FOR_MALLOC; 119 return asan_malloc(size, &stack); 120} 121 122void *cf_malloc(CFIndex size, CFOptionFlags hint, void *info) { 123 if (!asan_inited) { 124 CHECK(system_malloc_zone); 125 return malloc_zone_malloc(system_malloc_zone, size); 126 } 127 GET_STACK_TRACE_HERE_FOR_MALLOC; 128 return asan_malloc(size, &stack); 129} 130 131void *mz_calloc(malloc_zone_t *zone, size_t nmemb, size_t size) { 132 if (!asan_inited) { 133 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym. 134 const size_t kCallocPoolSize = 1024; 135 static uptr calloc_memory_for_dlsym[kCallocPoolSize]; 136 static size_t allocated; 137 size_t size_in_words = ((nmemb * size) + kWordSize - 1) / kWordSize; 138 void *mem = (void*)&calloc_memory_for_dlsym[allocated]; 139 allocated += size_in_words; 140 CHECK(allocated < kCallocPoolSize); 141 return mem; 142 } 143 GET_STACK_TRACE_HERE_FOR_MALLOC; 144 return asan_calloc(nmemb, size, &stack); 145} 146 147void *mz_valloc(malloc_zone_t *zone, size_t size) { 148 if (!asan_inited) { 149 CHECK(system_malloc_zone); 150 return malloc_zone_valloc(system_malloc_zone, size); 151 } 152 GET_STACK_TRACE_HERE_FOR_MALLOC; 153 return asan_memalign(kPageSize, size, &stack); 154} 155 156#define GET_ZONE_FOR_PTR(ptr) \ 157 malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); \ 158 const char *zone_name = (zone_ptr == 0) ? 0 : zone_ptr->zone_name 159 160void ALWAYS_INLINE free_common(void *context, void *ptr) { 161 if (!ptr) return; 162 if (!flags()->mac_ignore_invalid_free || asan_mz_size(ptr)) { 163 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 164 malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); 165 if (zone_ptr == system_purgeable_zone) { 166 // Allocations from malloc_default_purgeable_zone() done before 167 // __asan_init() may be occasionally freed via free_common(). 168 // See http://code.google.com/p/address-sanitizer/issues/detail?id=99. 169 malloc_zone_free(zone_ptr, ptr); 170 } else { 171 asan_free(ptr, &stack); 172 } 173 } else { 174 // Let us just leak this memory for now. 175 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 176 GET_ZONE_FOR_PTR(ptr); 177 WarnMacFreeUnallocated((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); 178 return; 179 } 180} 181 182// TODO(glider): the allocation callbacks need to be refactored. 183void mz_free(malloc_zone_t *zone, void *ptr) { 184 free_common(zone, ptr); 185} 186 187void cf_free(void *ptr, void *info) { 188 free_common(info, ptr); 189} 190 191void *mz_realloc(malloc_zone_t *zone, void *ptr, size_t size) { 192 if (!ptr) { 193 GET_STACK_TRACE_HERE_FOR_MALLOC; 194 return asan_malloc(size, &stack); 195 } else { 196 if (asan_mz_size(ptr)) { 197 GET_STACK_TRACE_HERE_FOR_MALLOC; 198 return asan_realloc(ptr, size, &stack); 199 } else { 200 // We can't recover from reallocating an unknown address, because 201 // this would require reading at most |size| bytes from 202 // potentially unaccessible memory. 203 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 204 GET_ZONE_FOR_PTR(ptr); 205 ReportMacMzReallocUnknown((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); 206 } 207 } 208} 209 210void *cf_realloc(void *ptr, CFIndex size, CFOptionFlags hint, void *info) { 211 if (!ptr) { 212 GET_STACK_TRACE_HERE_FOR_MALLOC; 213 return asan_malloc(size, &stack); 214 } else { 215 if (asan_mz_size(ptr)) { 216 GET_STACK_TRACE_HERE_FOR_MALLOC; 217 return asan_realloc(ptr, size, &stack); 218 } else { 219 // We can't recover from reallocating an unknown address, because 220 // this would require reading at most |size| bytes from 221 // potentially unaccessible memory. 222 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 223 GET_ZONE_FOR_PTR(ptr); 224 ReportMacCfReallocUnknown((uptr)ptr, (uptr)zone_ptr, zone_name, &stack); 225 } 226 } 227} 228 229void mz_destroy(malloc_zone_t* zone) { 230 // A no-op -- we will not be destroyed! 231 AsanPrintf("mz_destroy() called -- ignoring\n"); 232} 233 // from AvailabilityMacros.h 234#if defined(MAC_OS_X_VERSION_10_6) && \ 235 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 236void *mz_memalign(malloc_zone_t *zone, size_t align, size_t size) { 237 if (!asan_inited) { 238 CHECK(system_malloc_zone); 239 return malloc_zone_memalign(system_malloc_zone, align, size); 240 } 241 GET_STACK_TRACE_HERE_FOR_MALLOC; 242 return asan_memalign(align, size, &stack); 243} 244 245// This function is currently unused, and we build with -Werror. 246#if 0 247void mz_free_definite_size(malloc_zone_t* zone, void *ptr, size_t size) { 248 // TODO(glider): check that |size| is valid. 249 UNIMPLEMENTED(); 250} 251#endif 252#endif 253 254// malloc_introspection callbacks. I'm not clear on what all of these do. 255kern_return_t mi_enumerator(task_t task, void *, 256 unsigned type_mask, vm_address_t zone_address, 257 memory_reader_t reader, 258 vm_range_recorder_t recorder) { 259 // Should enumerate all the pointers we have. Seems like a lot of work. 260 return KERN_FAILURE; 261} 262 263size_t mi_good_size(malloc_zone_t *zone, size_t size) { 264 // I think it's always safe to return size, but we maybe could do better. 265 return size; 266} 267 268boolean_t mi_check(malloc_zone_t *zone) { 269 UNIMPLEMENTED(); 270 return true; 271} 272 273void mi_print(malloc_zone_t *zone, boolean_t verbose) { 274 UNIMPLEMENTED(); 275 return; 276} 277 278void mi_log(malloc_zone_t *zone, void *address) { 279 // I don't think we support anything like this 280} 281 282void mi_force_lock(malloc_zone_t *zone) { 283 asan_mz_force_lock(); 284} 285 286void mi_force_unlock(malloc_zone_t *zone) { 287 asan_mz_force_unlock(); 288} 289 290// This function is currently unused, and we build with -Werror. 291#if 0 292void mi_statistics(malloc_zone_t *zone, malloc_statistics_t *stats) { 293 // TODO(csilvers): figure out how to fill these out 294 // TODO(glider): port this from tcmalloc when ready. 295 stats->blocks_in_use = 0; 296 stats->size_in_use = 0; 297 stats->max_size_in_use = 0; 298 stats->size_allocated = 0; 299} 300#endif 301 302#if defined(MAC_OS_X_VERSION_10_6) && \ 303 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 304boolean_t mi_zone_locked(malloc_zone_t *zone) { 305 // UNIMPLEMENTED(); 306 return false; 307} 308#endif 309 310} // unnamed namespace 311 312extern int __CFRuntimeClassTableSize; 313 314namespace __asan { 315void ReplaceCFAllocator() { 316 static CFAllocatorContext asan_context = { 317 /*version*/ 0, /*info*/ &asan_zone, 318 /*retain*/ 0, /*release*/ 0, 319 /*copyDescription*/0, 320 /*allocate*/ &cf_malloc, 321 /*reallocate*/ &cf_realloc, 322 /*deallocate*/ &cf_free, 323 /*preferredSize*/ 0 }; 324 if (!cf_asan) 325 cf_asan = CFAllocatorCreate(kCFAllocatorUseContext, &asan_context); 326 if (CFAllocatorGetDefault() != cf_asan) 327 CFAllocatorSetDefault(cf_asan); 328} 329 330void ReplaceSystemMalloc() { 331 static malloc_introspection_t asan_introspection; 332 // Ok to use internal_memset, these places are not performance-critical. 333 internal_memset(&asan_introspection, 0, sizeof(asan_introspection)); 334 335 asan_introspection.enumerator = &mi_enumerator; 336 asan_introspection.good_size = &mi_good_size; 337 asan_introspection.check = &mi_check; 338 asan_introspection.print = &mi_print; 339 asan_introspection.log = &mi_log; 340 asan_introspection.force_lock = &mi_force_lock; 341 asan_introspection.force_unlock = &mi_force_unlock; 342 343 internal_memset(&asan_zone, 0, sizeof(malloc_zone_t)); 344 345 // Start with a version 4 zone which is used for OS X 10.4 and 10.5. 346 asan_zone.version = 4; 347 asan_zone.zone_name = "asan"; 348 asan_zone.size = &mz_size; 349 asan_zone.malloc = &mz_malloc; 350 asan_zone.calloc = &mz_calloc; 351 asan_zone.valloc = &mz_valloc; 352 asan_zone.free = &mz_free; 353 asan_zone.realloc = &mz_realloc; 354 asan_zone.destroy = &mz_destroy; 355 asan_zone.batch_malloc = 0; 356 asan_zone.batch_free = 0; 357 asan_zone.introspect = &asan_introspection; 358 359 // from AvailabilityMacros.h 360#if defined(MAC_OS_X_VERSION_10_6) && \ 361 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 362 // Switch to version 6 on OSX 10.6 to support memalign. 363 asan_zone.version = 6; 364 asan_zone.free_definite_size = 0; 365 asan_zone.memalign = &mz_memalign; 366 asan_introspection.zone_locked = &mi_zone_locked; 367 368 // Request the default purgable zone to force its creation. The 369 // current default zone is registered with the purgable zone for 370 // doing tiny and small allocs. Sadly, it assumes that the default 371 // zone is the szone implementation from OS X and will crash if it 372 // isn't. By creating the zone now, this will be true and changing 373 // the default zone won't cause a problem. (OS X 10.6 and higher.) 374 system_purgeable_zone = malloc_default_purgeable_zone(); 375#endif 376 377 // Register the ASan zone. At this point, it will not be the 378 // default zone. 379 malloc_zone_register(&asan_zone); 380 381 // Unregister and reregister the default zone. Unregistering swaps 382 // the specified zone with the last one registered which for the 383 // default zone makes the more recently registered zone the default 384 // zone. The default zone is then re-registered to ensure that 385 // allocations made from it earlier will be handled correctly. 386 // Things are not guaranteed to work that way, but it's how they work now. 387 system_malloc_zone = malloc_default_zone(); 388 malloc_zone_unregister(system_malloc_zone); 389 malloc_zone_register(system_malloc_zone); 390 // Make sure the default allocator was replaced. 391 CHECK(malloc_default_zone() == &asan_zone); 392 393 if (flags()->replace_cfallocator) { 394 // If __CFInitialize() hasn't been called yet, cf_asan will be created and 395 // installed as the default allocator after __CFInitialize() finishes (see 396 // the interceptor for __CFInitialize() above). Otherwise install cf_asan 397 // right now. On both Snow Leopard and Lion __CFInitialize() calls 398 // __CFAllocatorInitialize(), which initializes the _base._cfisa field of 399 // the default allocators we check here. 400 if (((CFRuntimeBase*)kCFAllocatorSystemDefault)->_cfisa) { 401 ReplaceCFAllocator(); 402 } 403 } 404} 405} // namespace __asan 406 407#endif // __APPLE__ 408