asan_malloc_mac.cc revision e93be8414babdb4f4dbb31dc8b34a81809ca7c11
1//===-- asan_rtl.cc -------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Mac-specific malloc interception. 13//===----------------------------------------------------------------------===// 14 15#ifdef __APPLE__ 16 17#include <AvailabilityMacros.h> 18#include <CoreFoundation/CFBase.h> 19#include <malloc/malloc.h> 20#include <setjmp.h> 21 22#include "asan_allocator.h" 23#include "asan_interceptors.h" 24#include "asan_internal.h" 25#include "asan_stack.h" 26 27// Similar code is used in Google Perftools, 28// http://code.google.com/p/google-perftools. 29 30// ---------------------- Replacement functions ---------------- {{{1 31using namespace __asan; // NOLINT 32 33// TODO(glider): do we need both zones? 34static malloc_zone_t *system_malloc_zone = 0; 35static malloc_zone_t *system_purgeable_zone = 0; 36CFAllocatorRef cf_asan = 0; 37 38// The free() implementation provided by OS X calls malloc_zone_from_ptr() 39// to find the owner of |ptr|. If the result is 0, an invalid free() is 40// reported. Our implementation falls back to asan_free() in this case 41// in order to print an ASan-style report. 42// 43// For the objects created by _CFRuntimeCreateInstance a CFAllocatorRef is 44// placed at the beginning of the allocated chunk and the pointer returned by 45// our allocator is off by sizeof(CFAllocatorRef). This pointer can be then 46// passed directly to free(), which will lead to errors. 47// To overcome this we're checking whether |ptr-sizeof(CFAllocatorRef)| 48// contains a pointer to our CFAllocator (assuming no other allocator is used). 49// See http://code.google.com/p/address-sanitizer/issues/detail?id=70 for more 50// info. 51INTERCEPTOR(void, free, void *ptr) { 52 malloc_zone_t *zone = malloc_zone_from_ptr(ptr); 53 if (zone) { 54#if defined(MAC_OS_X_VERSION_10_6) && \ 55 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 56 if ((zone->version >= 6) && (zone->free_definite_size)) { 57 zone->free_definite_size(zone, ptr, malloc_size(ptr)); 58 } else { 59 malloc_zone_free(zone, ptr); 60 } 61#else 62 malloc_zone_free(zone, ptr); 63#endif 64 } else { 65 if (FLAG_replace_cfallocator) { 66 // Make sure we're not hitting the previous page. This may be incorrect 67 // if ASan's malloc returns an address ending with 0xFF8, which will be 68 // then padded to a page boundary with a CFAllocatorRef. 69 uptr arith_ptr = (uptr)ptr; 70 if ((arith_ptr & 0xFFF) > sizeof(CFAllocatorRef)) { 71 CFAllocatorRef *saved = 72 (CFAllocatorRef*)(arith_ptr - sizeof(CFAllocatorRef)); 73 if ((*saved == cf_asan) && asan_mz_size(saved)) ptr = (void*)saved; 74 } 75 } 76 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 77 asan_free(ptr, &stack); 78 } 79} 80 81namespace { 82// TODO(glider): the mz_* functions should be united with the Linux wrappers, 83// as they are basically copied from there. 84size_t mz_size(malloc_zone_t* zone, const void* ptr) { 85 return asan_mz_size(ptr); 86} 87 88void *mz_malloc(malloc_zone_t *zone, size_t size) { 89 if (!asan_inited) { 90 CHECK(system_malloc_zone); 91 return malloc_zone_malloc(system_malloc_zone, size); 92 } 93 GET_STACK_TRACE_HERE_FOR_MALLOC; 94 return asan_malloc(size, &stack); 95} 96 97void *cf_malloc(CFIndex size, CFOptionFlags hint, void *info) { 98 if (!asan_inited) { 99 CHECK(system_malloc_zone); 100 return malloc_zone_malloc(system_malloc_zone, size); 101 } 102 GET_STACK_TRACE_HERE_FOR_MALLOC; 103 return asan_malloc(size, &stack); 104} 105 106void *mz_calloc(malloc_zone_t *zone, size_t nmemb, size_t size) { 107 if (!asan_inited) { 108 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym. 109 const size_t kCallocPoolSize = 1024; 110 static uptr calloc_memory_for_dlsym[kCallocPoolSize]; 111 static size_t allocated; 112 size_t size_in_words = ((nmemb * size) + kWordSize - 1) / kWordSize; 113 void *mem = (void*)&calloc_memory_for_dlsym[allocated]; 114 allocated += size_in_words; 115 CHECK(allocated < kCallocPoolSize); 116 return mem; 117 } 118 GET_STACK_TRACE_HERE_FOR_MALLOC; 119 return asan_calloc(nmemb, size, &stack); 120} 121 122void *mz_valloc(malloc_zone_t *zone, size_t size) { 123 if (!asan_inited) { 124 CHECK(system_malloc_zone); 125 return malloc_zone_valloc(system_malloc_zone, size); 126 } 127 GET_STACK_TRACE_HERE_FOR_MALLOC; 128 return asan_memalign(kPageSize, size, &stack); 129} 130 131void print_zone_for_ptr(void *ptr) { 132 malloc_zone_t *orig_zone = malloc_zone_from_ptr(ptr); 133 if (orig_zone) { 134 if (orig_zone->zone_name) { 135 AsanPrintf("malloc_zone_from_ptr(%p) = %p, which is %s\n", 136 ptr, orig_zone, orig_zone->zone_name); 137 } else { 138 AsanPrintf("malloc_zone_from_ptr(%p) = %p, which doesn't have a name\n", 139 ptr, orig_zone); 140 } 141 } else { 142 AsanPrintf("malloc_zone_from_ptr(%p) = 0\n", ptr); 143 } 144} 145 146void ALWAYS_INLINE free_common(void *context, void *ptr) { 147 if (!ptr) return; 148 if (!FLAG_mac_ignore_invalid_free || asan_mz_size(ptr)) { 149 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 150 asan_free(ptr, &stack); 151 } else { 152 // Let us just leak this memory for now. 153 AsanPrintf("free_common(%p) -- attempting to free unallocated memory.\n" 154 "AddressSanitizer is ignoring this error on Mac OS now.\n", 155 ptr); 156 print_zone_for_ptr(ptr); 157 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 158 stack.PrintStack(); 159 return; 160 } 161} 162 163// TODO(glider): the allocation callbacks need to be refactored. 164void mz_free(malloc_zone_t *zone, void *ptr) { 165 free_common(zone, ptr); 166} 167 168void cf_free(void *ptr, void *info) { 169 free_common(info, ptr); 170} 171 172void *mz_realloc(malloc_zone_t *zone, void *ptr, size_t size) { 173 if (!ptr) { 174 GET_STACK_TRACE_HERE_FOR_MALLOC; 175 return asan_malloc(size, &stack); 176 } else { 177 if (asan_mz_size(ptr)) { 178 GET_STACK_TRACE_HERE_FOR_MALLOC; 179 return asan_realloc(ptr, size, &stack); 180 } else { 181 // We can't recover from reallocating an unknown address, because 182 // this would require reading at most |size| bytes from 183 // potentially unaccessible memory. 184 AsanPrintf("mz_realloc(%p) -- attempting to realloc unallocated memory.\n" 185 "This is an unrecoverable problem, exiting now.\n", 186 ptr); 187 print_zone_for_ptr(ptr); 188 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 189 stack.PrintStack(); 190 ShowStatsAndAbort(); 191 return 0; // unreachable 192 } 193 } 194} 195 196void *cf_realloc(void *ptr, CFIndex size, CFOptionFlags hint, void *info) { 197 if (!ptr) { 198 GET_STACK_TRACE_HERE_FOR_MALLOC; 199 return asan_malloc(size, &stack); 200 } else { 201 if (asan_mz_size(ptr)) { 202 GET_STACK_TRACE_HERE_FOR_MALLOC; 203 return asan_realloc(ptr, size, &stack); 204 } else { 205 // We can't recover from reallocating an unknown address, because 206 // this would require reading at most |size| bytes from 207 // potentially unaccessible memory. 208 AsanPrintf("cf_realloc(%p) -- attempting to realloc unallocated memory.\n" 209 "This is an unrecoverable problem, exiting now.\n", 210 ptr); 211 print_zone_for_ptr(ptr); 212 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 213 stack.PrintStack(); 214 ShowStatsAndAbort(); 215 return 0; // unreachable 216 } 217 } 218} 219 220void mz_destroy(malloc_zone_t* zone) { 221 // A no-op -- we will not be destroyed! 222 AsanPrintf("mz_destroy() called -- ignoring\n"); 223} 224 // from AvailabilityMacros.h 225#if defined(MAC_OS_X_VERSION_10_6) && \ 226 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 227void *mz_memalign(malloc_zone_t *zone, size_t align, size_t size) { 228 if (!asan_inited) { 229 CHECK(system_malloc_zone); 230 return malloc_zone_memalign(system_malloc_zone, align, size); 231 } 232 GET_STACK_TRACE_HERE_FOR_MALLOC; 233 return asan_memalign(align, size, &stack); 234} 235 236// This function is currently unused, and we build with -Werror. 237#if 0 238void mz_free_definite_size(malloc_zone_t* zone, void *ptr, size_t size) { 239 // TODO(glider): check that |size| is valid. 240 UNIMPLEMENTED(); 241} 242#endif 243#endif 244 245// malloc_introspection callbacks. I'm not clear on what all of these do. 246kern_return_t mi_enumerator(task_t task, void *, 247 unsigned type_mask, vm_address_t zone_address, 248 memory_reader_t reader, 249 vm_range_recorder_t recorder) { 250 // Should enumerate all the pointers we have. Seems like a lot of work. 251 return KERN_FAILURE; 252} 253 254size_t mi_good_size(malloc_zone_t *zone, size_t size) { 255 // I think it's always safe to return size, but we maybe could do better. 256 return size; 257} 258 259boolean_t mi_check(malloc_zone_t *zone) { 260 UNIMPLEMENTED(); 261 return true; 262} 263 264void mi_print(malloc_zone_t *zone, boolean_t verbose) { 265 UNIMPLEMENTED(); 266 return; 267} 268 269void mi_log(malloc_zone_t *zone, void *address) { 270 // I don't think we support anything like this 271} 272 273void mi_force_lock(malloc_zone_t *zone) { 274 asan_mz_force_lock(); 275} 276 277void mi_force_unlock(malloc_zone_t *zone) { 278 asan_mz_force_unlock(); 279} 280 281// This function is currently unused, and we build with -Werror. 282#if 0 283void mi_statistics(malloc_zone_t *zone, malloc_statistics_t *stats) { 284 // TODO(csilvers): figure out how to fill these out 285 // TODO(glider): port this from tcmalloc when ready. 286 stats->blocks_in_use = 0; 287 stats->size_in_use = 0; 288 stats->max_size_in_use = 0; 289 stats->size_allocated = 0; 290} 291#endif 292 293#if defined(MAC_OS_X_VERSION_10_6) && \ 294 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 295boolean_t mi_zone_locked(malloc_zone_t *zone) { 296 // UNIMPLEMENTED(); 297 return false; 298} 299#endif 300 301} // unnamed namespace 302 303extern bool kCFUseCollectableAllocator; // is GC on? 304 305namespace __asan { 306void ReplaceSystemMalloc() { 307 static malloc_introspection_t asan_introspection; 308 // Ok to use internal_memset, these places are not performance-critical. 309 internal_memset(&asan_introspection, 0, sizeof(asan_introspection)); 310 311 asan_introspection.enumerator = &mi_enumerator; 312 asan_introspection.good_size = &mi_good_size; 313 asan_introspection.check = &mi_check; 314 asan_introspection.print = &mi_print; 315 asan_introspection.log = &mi_log; 316 asan_introspection.force_lock = &mi_force_lock; 317 asan_introspection.force_unlock = &mi_force_unlock; 318 319 static malloc_zone_t asan_zone; 320 internal_memset(&asan_zone, 0, sizeof(malloc_zone_t)); 321 322 // Start with a version 4 zone which is used for OS X 10.4 and 10.5. 323 asan_zone.version = 4; 324 asan_zone.zone_name = "asan"; 325 asan_zone.size = &mz_size; 326 asan_zone.malloc = &mz_malloc; 327 asan_zone.calloc = &mz_calloc; 328 asan_zone.valloc = &mz_valloc; 329 asan_zone.free = &mz_free; 330 asan_zone.realloc = &mz_realloc; 331 asan_zone.destroy = &mz_destroy; 332 asan_zone.batch_malloc = 0; 333 asan_zone.batch_free = 0; 334 asan_zone.introspect = &asan_introspection; 335 336 // from AvailabilityMacros.h 337#if defined(MAC_OS_X_VERSION_10_6) && \ 338 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 339 // Switch to version 6 on OSX 10.6 to support memalign. 340 asan_zone.version = 6; 341 asan_zone.free_definite_size = 0; 342 asan_zone.memalign = &mz_memalign; 343 asan_introspection.zone_locked = &mi_zone_locked; 344 345 // Request the default purgable zone to force its creation. The 346 // current default zone is registered with the purgable zone for 347 // doing tiny and small allocs. Sadly, it assumes that the default 348 // zone is the szone implementation from OS X and will crash if it 349 // isn't. By creating the zone now, this will be true and changing 350 // the default zone won't cause a problem. (OS X 10.6 and higher.) 351 system_purgeable_zone = malloc_default_purgeable_zone(); 352#endif 353 354 // Register the ASan zone. At this point, it will not be the 355 // default zone. 356 malloc_zone_register(&asan_zone); 357 358 // Unregister and reregister the default zone. Unregistering swaps 359 // the specified zone with the last one registered which for the 360 // default zone makes the more recently registered zone the default 361 // zone. The default zone is then re-registered to ensure that 362 // allocations made from it earlier will be handled correctly. 363 // Things are not guaranteed to work that way, but it's how they work now. 364 system_malloc_zone = malloc_default_zone(); 365 malloc_zone_unregister(system_malloc_zone); 366 malloc_zone_register(system_malloc_zone); 367 // Make sure the default allocator was replaced. 368 CHECK(malloc_default_zone() == &asan_zone); 369 370 if (FLAG_replace_cfallocator) { 371 static CFAllocatorContext asan_context = 372 { /*version*/ 0, /*info*/ &asan_zone, 373 /*retain*/ 0, /*release*/ 0, 374 /*copyDescription*/0, 375 /*allocate*/ &cf_malloc, 376 /*reallocate*/ &cf_realloc, 377 /*deallocate*/ &cf_free, 378 /*preferredSize*/ 0 }; 379 cf_asan = CFAllocatorCreate(kCFAllocatorUseContext, &asan_context); 380 CFAllocatorSetDefault(cf_asan); 381 } 382} 383} // namespace __asan 384 385#endif // __APPLE__ 386