asan_malloc_mac.cc revision e954101f6602ac181a2c3accfbbad0ae51b0bf7c
1//===-- asan_rtl.cc -------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Mac-specific malloc interception. 13//===----------------------------------------------------------------------===// 14 15#ifdef __APPLE__ 16 17#include <AvailabilityMacros.h> 18#include <CoreFoundation/CFBase.h> 19#include <malloc/malloc.h> 20#include <setjmp.h> 21 22#include "asan_allocator.h" 23#include "asan_interceptors.h" 24#include "asan_internal.h" 25#include "asan_stack.h" 26 27// Similar code is used in Google Perftools, 28// http://code.google.com/p/google-perftools. 29 30// ---------------------- Replacement functions ---------------- {{{1 31using namespace __asan; // NOLINT 32 33// The free() implementation provided by OS X calls malloc_zone_from_ptr() 34// to find the owner of |ptr|. If the result is 0, an invalid free() is 35// reported. Our implementation falls back to asan_free() in this case 36// in order to print an ASan-style report. 37extern "C" 38void free(void *ptr) { 39 malloc_zone_t *zone = malloc_zone_from_ptr(ptr); 40 if (zone) { 41#if defined(MAC_OS_X_VERSION_10_6) && \ 42 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 43 if ((zone->version >= 6) && (zone->free_definite_size)) { 44 zone->free_definite_size(zone, ptr, malloc_size(ptr)); 45 } else { 46 malloc_zone_free(zone, ptr); 47 } 48#else 49 malloc_zone_free(zone, ptr); 50#endif 51 } else { 52 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 53 asan_free(ptr, &stack); 54 } 55} 56 57// TODO(glider): do we need both zones? 58static malloc_zone_t *system_malloc_zone = 0; 59static malloc_zone_t *system_purgeable_zone = 0; 60 61// We need to provide wrappers around all the libc functions. 62namespace { 63// TODO(glider): the mz_* functions should be united with the Linux wrappers, 64// as they are basically copied from there. 65size_t mz_size(malloc_zone_t* zone, const void* ptr) { 66 // Fast path: check whether this pointer belongs to the original malloc zone. 67 // We cannot just call malloc_zone_from_ptr(), because it in turn 68 // calls our mz_size(). 69 if (system_malloc_zone) { 70 if ((system_malloc_zone->size)(system_malloc_zone, ptr)) return 0; 71 } 72 return asan_mz_size(ptr); 73} 74 75void *mz_malloc(malloc_zone_t *zone, size_t size) { 76 if (!asan_inited) { 77 CHECK(system_malloc_zone); 78 return malloc_zone_malloc(system_malloc_zone, size); 79 } 80 GET_STACK_TRACE_HERE_FOR_MALLOC; 81 return asan_malloc(size, &stack); 82} 83 84void *cf_malloc(CFIndex size, CFOptionFlags hint, void *info) { 85 if (!asan_inited) { 86 CHECK(system_malloc_zone); 87 return malloc_zone_malloc(system_malloc_zone, size); 88 } 89 GET_STACK_TRACE_HERE_FOR_MALLOC; 90 return asan_malloc(size, &stack); 91} 92 93void *mz_calloc(malloc_zone_t *zone, size_t nmemb, size_t size) { 94 if (!asan_inited) { 95 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym. 96 const size_t kCallocPoolSize = 1024; 97 static uptr calloc_memory_for_dlsym[kCallocPoolSize]; 98 static size_t allocated; 99 size_t size_in_words = ((nmemb * size) + kWordSize - 1) / kWordSize; 100 void *mem = (void*)&calloc_memory_for_dlsym[allocated]; 101 allocated += size_in_words; 102 CHECK(allocated < kCallocPoolSize); 103 return mem; 104 } 105 GET_STACK_TRACE_HERE_FOR_MALLOC; 106 return asan_calloc(nmemb, size, &stack); 107} 108 109void *mz_valloc(malloc_zone_t *zone, size_t size) { 110 if (!asan_inited) { 111 CHECK(system_malloc_zone); 112 return malloc_zone_valloc(system_malloc_zone, size); 113 } 114 GET_STACK_TRACE_HERE_FOR_MALLOC; 115 return asan_memalign(kPageSize, size, &stack); 116} 117 118void print_zone_for_ptr(void *ptr) { 119 malloc_zone_t *orig_zone = malloc_zone_from_ptr(ptr); 120 if (orig_zone) { 121 if (orig_zone->zone_name) { 122 AsanPrintf("malloc_zone_from_ptr(%p) = %p, which is %s\n", 123 ptr, orig_zone, orig_zone->zone_name); 124 } else { 125 AsanPrintf("malloc_zone_from_ptr(%p) = %p, which doesn't have a name\n", 126 ptr, orig_zone); 127 } 128 } else { 129 AsanPrintf("malloc_zone_from_ptr(%p) = 0\n", ptr); 130 } 131} 132 133// TODO(glider): the allocation callbacks need to be refactored. 134void mz_free(malloc_zone_t *zone, void *ptr) { 135 if (!ptr) return; 136 malloc_zone_t *orig_zone = malloc_zone_from_ptr(ptr); 137 // For some reason Chromium calls mz_free() for pointers that belong to 138 // DefaultPurgeableMallocZone instead of asan_zone. We might want to 139 // fix this someday. 140 if (orig_zone == system_purgeable_zone) { 141 system_purgeable_zone->free(system_purgeable_zone, ptr); 142 return; 143 } 144 if (asan_mz_size(ptr)) { 145 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 146 asan_free(ptr, &stack); 147 } else { 148 // Let us just leak this memory for now. 149 AsanPrintf("mz_free(%p) -- attempting to free unallocated memory.\n" 150 "AddressSanitizer is ignoring this error on Mac OS now.\n", 151 ptr); 152 print_zone_for_ptr(ptr); 153 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 154 stack.PrintStack(); 155 return; 156 } 157} 158 159void cf_free(void *ptr, void *info) { 160 if (!ptr) return; 161 malloc_zone_t *orig_zone = malloc_zone_from_ptr(ptr); 162 // For some reason Chromium calls mz_free() for pointers that belong to 163 // DefaultPurgeableMallocZone instead of asan_zone. We might want to 164 // fix this someday. 165 if (orig_zone == system_purgeable_zone) { 166 system_purgeable_zone->free(system_purgeable_zone, ptr); 167 return; 168 } 169 if (asan_mz_size(ptr)) { 170 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 171 asan_free(ptr, &stack); 172 } else { 173 // Let us just leak this memory for now. 174 AsanPrintf("cf_free(%p) -- attempting to free unallocated memory.\n" 175 "AddressSanitizer is ignoring this error on Mac OS now.\n", 176 ptr); 177 print_zone_for_ptr(ptr); 178 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 179 stack.PrintStack(); 180 return; 181 } 182} 183 184void *mz_realloc(malloc_zone_t *zone, void *ptr, size_t size) { 185 if (!ptr) { 186 GET_STACK_TRACE_HERE_FOR_MALLOC; 187 return asan_malloc(size, &stack); 188 } else { 189 if (asan_mz_size(ptr)) { 190 GET_STACK_TRACE_HERE_FOR_MALLOC; 191 return asan_realloc(ptr, size, &stack); 192 } else { 193 // We can't recover from reallocating an unknown address, because 194 // this would require reading at most |size| bytes from 195 // potentially unaccessible memory. 196 AsanPrintf("mz_realloc(%p) -- attempting to realloc unallocated memory.\n" 197 "This is an unrecoverable problem, exiting now.\n", 198 ptr); 199 print_zone_for_ptr(ptr); 200 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 201 stack.PrintStack(); 202 ShowStatsAndAbort(); 203 return 0; // unreachable 204 } 205 } 206} 207 208void *cf_realloc(void *ptr, CFIndex size, CFOptionFlags hint, void *info) { 209 if (!ptr) { 210 GET_STACK_TRACE_HERE_FOR_MALLOC; 211 return asan_malloc(size, &stack); 212 } else { 213 if (asan_mz_size(ptr)) { 214 GET_STACK_TRACE_HERE_FOR_MALLOC; 215 return asan_realloc(ptr, size, &stack); 216 } else { 217 // We can't recover from reallocating an unknown address, because 218 // this would require reading at most |size| bytes from 219 // potentially unaccessible memory. 220 AsanPrintf("cf_realloc(%p) -- attempting to realloc unallocated memory.\n" 221 "This is an unrecoverable problem, exiting now.\n", 222 ptr); 223 print_zone_for_ptr(ptr); 224 GET_STACK_TRACE_HERE_FOR_FREE(ptr); 225 stack.PrintStack(); 226 ShowStatsAndAbort(); 227 return 0; // unreachable 228 } 229 } 230} 231 232void mz_destroy(malloc_zone_t* zone) { 233 // A no-op -- we will not be destroyed! 234 AsanPrintf("mz_destroy() called -- ignoring\n"); 235} 236 // from AvailabilityMacros.h 237#if defined(MAC_OS_X_VERSION_10_6) && \ 238 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 239void *mz_memalign(malloc_zone_t *zone, size_t align, size_t size) { 240 if (!asan_inited) { 241 CHECK(system_malloc_zone); 242 return malloc_zone_memalign(system_malloc_zone, align, size); 243 } 244 GET_STACK_TRACE_HERE_FOR_MALLOC; 245 return asan_memalign(align, size, &stack); 246} 247 248// This function is currently unused, and we build with -Werror. 249#if 0 250void mz_free_definite_size(malloc_zone_t* zone, void *ptr, size_t size) { 251 // TODO(glider): check that |size| is valid. 252 UNIMPLEMENTED(); 253} 254#endif 255#endif 256 257// malloc_introspection callbacks. I'm not clear on what all of these do. 258kern_return_t mi_enumerator(task_t task, void *, 259 unsigned type_mask, vm_address_t zone_address, 260 memory_reader_t reader, 261 vm_range_recorder_t recorder) { 262 // Should enumerate all the pointers we have. Seems like a lot of work. 263 return KERN_FAILURE; 264} 265 266size_t mi_good_size(malloc_zone_t *zone, size_t size) { 267 // I think it's always safe to return size, but we maybe could do better. 268 return size; 269} 270 271boolean_t mi_check(malloc_zone_t *zone) { 272 UNIMPLEMENTED(); 273 return true; 274} 275 276void mi_print(malloc_zone_t *zone, boolean_t verbose) { 277 UNIMPLEMENTED(); 278 return; 279} 280 281void mi_log(malloc_zone_t *zone, void *address) { 282 // I don't think we support anything like this 283} 284 285void mi_force_lock(malloc_zone_t *zone) { 286 asan_mz_force_lock(); 287} 288 289void mi_force_unlock(malloc_zone_t *zone) { 290 asan_mz_force_unlock(); 291} 292 293// This function is currently unused, and we build with -Werror. 294#if 0 295void mi_statistics(malloc_zone_t *zone, malloc_statistics_t *stats) { 296 // TODO(csilvers): figure out how to fill these out 297 // TODO(glider): port this from tcmalloc when ready. 298 stats->blocks_in_use = 0; 299 stats->size_in_use = 0; 300 stats->max_size_in_use = 0; 301 stats->size_allocated = 0; 302} 303#endif 304 305#if defined(MAC_OS_X_VERSION_10_6) && \ 306 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 307boolean_t mi_zone_locked(malloc_zone_t *zone) { 308 // UNIMPLEMENTED(); 309 return false; 310} 311#endif 312 313} // unnamed namespace 314 315extern bool kCFUseCollectableAllocator; // is GC on? 316 317namespace __asan { 318void ReplaceSystemMalloc() { 319 static malloc_introspection_t asan_introspection; 320 // Ok to use internal_memset, these places are not performance-critical. 321 internal_memset(&asan_introspection, 0, sizeof(asan_introspection)); 322 323 asan_introspection.enumerator = &mi_enumerator; 324 asan_introspection.good_size = &mi_good_size; 325 asan_introspection.check = &mi_check; 326 asan_introspection.print = &mi_print; 327 asan_introspection.log = &mi_log; 328 asan_introspection.force_lock = &mi_force_lock; 329 asan_introspection.force_unlock = &mi_force_unlock; 330 331 static malloc_zone_t asan_zone; 332 internal_memset(&asan_zone, 0, sizeof(malloc_zone_t)); 333 334 // Start with a version 4 zone which is used for OS X 10.4 and 10.5. 335 asan_zone.version = 4; 336 asan_zone.zone_name = "asan"; 337 asan_zone.size = &mz_size; 338 asan_zone.malloc = &mz_malloc; 339 asan_zone.calloc = &mz_calloc; 340 asan_zone.valloc = &mz_valloc; 341 asan_zone.free = &mz_free; 342 asan_zone.realloc = &mz_realloc; 343 asan_zone.destroy = &mz_destroy; 344 asan_zone.batch_malloc = 0; 345 asan_zone.batch_free = 0; 346 asan_zone.introspect = &asan_introspection; 347 348 // from AvailabilityMacros.h 349#if defined(MAC_OS_X_VERSION_10_6) && \ 350 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6 351 // Switch to version 6 on OSX 10.6 to support memalign. 352 asan_zone.version = 6; 353 asan_zone.free_definite_size = 0; 354 asan_zone.memalign = &mz_memalign; 355 asan_introspection.zone_locked = &mi_zone_locked; 356 357 // Request the default purgable zone to force its creation. The 358 // current default zone is registered with the purgable zone for 359 // doing tiny and small allocs. Sadly, it assumes that the default 360 // zone is the szone implementation from OS X and will crash if it 361 // isn't. By creating the zone now, this will be true and changing 362 // the default zone won't cause a problem. (OS X 10.6 and higher.) 363 system_purgeable_zone = malloc_default_purgeable_zone(); 364#endif 365 366 // Register the ASan zone. At this point, it will not be the 367 // default zone. 368 malloc_zone_register(&asan_zone); 369 370 // Unregister and reregister the default zone. Unregistering swaps 371 // the specified zone with the last one registered which for the 372 // default zone makes the more recently registered zone the default 373 // zone. The default zone is then re-registered to ensure that 374 // allocations made from it earlier will be handled correctly. 375 // Things are not guaranteed to work that way, but it's how they work now. 376 system_malloc_zone = malloc_default_zone(); 377 malloc_zone_unregister(system_malloc_zone); 378 malloc_zone_register(system_malloc_zone); 379 // Make sure the default allocator was replaced. 380 CHECK(malloc_default_zone() == &asan_zone); 381 382 if (FLAG_replace_cfallocator) { 383 static CFAllocatorContext asan_context = 384 { /*version*/ 0, /*info*/ &asan_zone, 385 /*retain*/ 0, /*release*/ 0, 386 /*copyDescription*/0, 387 /*allocate*/ &cf_malloc, 388 /*reallocate*/ &cf_realloc, 389 /*deallocate*/ &cf_free, 390 /*preferredSize*/ 0 }; 391 CFAllocatorRef cf_asan = 392 CFAllocatorCreate(kCFAllocatorUseContext, &asan_context); 393 CFAllocatorSetDefault(cf_asan); 394 } 395} 396} // namespace __asan 397 398#endif // __APPLE__ 399