asan_rtl.cc revision 4fbbcbea41c91498ac4cfbb3d3c7e1d83d7bb380
1//===-- asan_rtl.cc -------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Main file of the ASan run-time library. 13//===----------------------------------------------------------------------===// 14#include "asan_allocator.h" 15#include "asan_interceptors.h" 16#include "asan_interface.h" 17#include "asan_internal.h" 18#include "asan_lock.h" 19#include "asan_mapping.h" 20#include "asan_stack.h" 21#include "asan_stats.h" 22#include "asan_thread.h" 23#include "asan_thread_registry.h" 24#include "sanitizer_common/sanitizer_atomic.h" 25#include "sanitizer_common/sanitizer_flags.h" 26#include "sanitizer_common/sanitizer_libc.h" 27 28namespace __sanitizer { 29using namespace __asan; 30 31void Die() { 32 static atomic_uint32_t num_calls; 33 if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) { 34 // Don't die twice - run a busy loop. 35 while (1) { } 36 } 37 if (flags()->sleep_before_dying) { 38 Report("Sleeping for %zd second(s)\n", flags()->sleep_before_dying); 39 SleepForSeconds(flags()->sleep_before_dying); 40 } 41 if (flags()->unmap_shadow_on_exit) 42 UnmapOrDie((void*)kLowShadowBeg, kHighShadowEnd - kLowShadowBeg); 43 if (death_callback) 44 death_callback(); 45 if (flags()->abort_on_error) 46 Abort(); 47 Exit(flags()->exitcode); 48} 49 50void CheckFailed(const char *file, int line, const char *cond, u64 v1, u64 v2) { 51 AsanReport("AddressSanitizer CHECK failed: %s:%d \"%s\" (%zx, %zx)\n", 52 file, line, cond, (uptr)v1, (uptr)v2); 53 PRINT_CURRENT_STACK(); 54 ShowStatsAndAbort(); 55} 56 57} // namespace __sanitizer 58 59namespace __asan { 60 61// -------------------------- Flags ------------------------- {{{1 62static const uptr kMallocContextSize = 30; 63 64static Flags asan_flags; 65 66Flags *flags() { 67 return &asan_flags; 68} 69 70// Can be overriden in frontend. 71void WEAK OverrideFlags(Flags *f) { 72 (void)f; 73} 74 75static void ParseFlagsFromString(Flags *f, const char *str) { 76 ParseFlag(str, &f->quarantine_size, "quarantine_size"); 77 ParseFlag(str, &f->symbolize, "symbolize"); 78 ParseFlag(str, &f->verbosity, "verbosity"); 79 ParseFlag(str, &f->redzone, "redzone"); 80 CHECK(f->redzone >= 16); 81 CHECK(IsPowerOfTwo(f->redzone)); 82 83 ParseFlag(str, &f->debug, "debug"); 84 ParseFlag(str, &f->report_globals, "report_globals"); 85 ParseFlag(str, &f->malloc_context_size, "malloc_context_size"); 86 CHECK(f->malloc_context_size <= kMallocContextSize); 87 88 ParseFlag(str, &f->replace_str, "replace_str"); 89 ParseFlag(str, &f->replace_intrin, "replace_intrin"); 90 ParseFlag(str, &f->replace_cfallocator, "replace_cfallocator"); 91 ParseFlag(str, &f->mac_ignore_invalid_free, "mac_ignore_invalid_free"); 92 ParseFlag(str, &f->use_fake_stack, "use_fake_stack"); 93 ParseFlag(str, &f->max_malloc_fill_size, "max_malloc_fill_size"); 94 ParseFlag(str, &f->exitcode, "exitcode"); 95 ParseFlag(str, &f->allow_user_poisoning, "allow_user_poisoning"); 96 ParseFlag(str, &f->sleep_before_dying, "sleep_before_dying"); 97 ParseFlag(str, &f->handle_segv, "handle_segv"); 98 ParseFlag(str, &f->use_sigaltstack, "use_sigaltstack"); 99 // Allow the users to work around the bug in Nvidia drivers prior to 295.*. 100 ParseFlag(str, &f->check_malloc_usable_size, "check_malloc_usable_size"); 101 ParseFlag(str, &f->unmap_shadow_on_exit, "unmap_shadow_on_exit"); 102 ParseFlag(str, &f->abort_on_error, "abort_on_error"); 103 ParseFlag(str, &f->atexit, "atexit"); 104 // By default, disable core dumper on 64-bit -- 105 // it makes little sense to dump 16T+ core. 106 ParseFlag(str, &f->disable_core, "disable_core"); 107} 108 109void InitializeFlags(Flags *f, const char *env) { 110 internal_memset(f, 0, sizeof(*f)); 111 112 f->quarantine_size = (ASAN_LOW_MEMORY) ? 1UL << 24 : 1UL << 28; 113 f->symbolize = false; 114 f->verbosity = 0; 115 f->redzone = (ASAN_LOW_MEMORY) ? 64 : 128; // power of two, >= 32. 116 f->debug = 0; 117 f->report_globals = 1; 118 f->malloc_context_size = kMallocContextSize; 119 f->replace_str = true; 120 f->replace_intrin = true; 121 f->replace_cfallocator = true; // Used on Mac only. 122 f->mac_ignore_invalid_free = false; // Used on Mac only. 123 f->use_fake_stack = true; 124 f->max_malloc_fill_size = 0; 125 f->exitcode = ASAN_DEFAULT_FAILURE_EXITCODE; 126 f->allow_user_poisoning = true; 127 f->sleep_before_dying = 0; 128 f->handle_segv = ASAN_NEEDS_SEGV; 129 f->use_sigaltstack = false; 130 f->check_malloc_usable_size = true; 131 f->unmap_shadow_on_exit = false; 132 f->abort_on_error = false; 133 f->atexit = false; 134 f->disable_core = (__WORDSIZE == 64); 135 136 // Let a frontend override. 137 OverrideFlags(f); 138 139 // Override from user-specified string. 140#if !defined(_WIN32) 141 if (__asan_default_options) { 142 ParseFlagsFromString(f, __asan_default_options); 143 if (flags()->verbosity) { 144 Report("Using the defaults from __asan_default_options: %s\n", 145 __asan_default_options); 146 } 147 } 148#endif 149 150 // Override from command line. 151 ParseFlagsFromString(f, env); 152} 153 154// -------------------------- Globals --------------------- {{{1 155int asan_inited; 156bool asan_init_is_running; 157void (*death_callback)(void); 158static void (*error_report_callback)(const char*); 159char *error_message_buffer = 0; 160uptr error_message_buffer_pos = 0; 161uptr error_message_buffer_size = 0; 162 163// -------------------------- Misc ---------------- {{{1 164void ShowStatsAndAbort() { 165 __asan_print_accumulated_stats(); 166 Die(); 167} 168 169static void PrintBytes(const char *before, uptr *a) { 170 u8 *bytes = (u8*)a; 171 uptr byte_num = (__WORDSIZE) / 8; 172 AsanPrintf("%s%p:", before, (void*)a); 173 for (uptr i = 0; i < byte_num; i++) { 174 AsanPrintf(" %x%x", bytes[i] >> 4, bytes[i] & 15); 175 } 176 AsanPrintf("\n"); 177} 178 179void AppendToErrorMessageBuffer(const char *buffer) { 180 if (error_message_buffer) { 181 uptr length = internal_strlen(buffer); 182 CHECK_GE(error_message_buffer_size, error_message_buffer_pos); 183 uptr remaining = error_message_buffer_size - error_message_buffer_pos; 184 internal_strncpy(error_message_buffer + error_message_buffer_pos, 185 buffer, remaining); 186 error_message_buffer[error_message_buffer_size - 1] = '\0'; 187 // FIXME: reallocate the buffer instead of truncating the message. 188 error_message_buffer_pos += remaining > length ? length : remaining; 189 } 190} 191 192// ---------------------- mmap -------------------- {{{1 193// Reserve memory range [beg, end]. 194static void ReserveShadowMemoryRange(uptr beg, uptr end) { 195 CHECK((beg % kPageSize) == 0); 196 CHECK(((end + 1) % kPageSize) == 0); 197 uptr size = end - beg + 1; 198 void *res = MmapFixedNoReserve(beg, size); 199 CHECK(res == (void*)beg && "ReserveShadowMemoryRange failed"); 200} 201 202// ---------------------- LowLevelAllocator ------------- {{{1 203void *LowLevelAllocator::Allocate(uptr size) { 204 CHECK((size & (size - 1)) == 0 && "size must be a power of two"); 205 if (allocated_end_ - allocated_current_ < (sptr)size) { 206 uptr size_to_allocate = Max(size, kPageSize); 207 allocated_current_ = 208 (char*)MmapOrDie(size_to_allocate, __FUNCTION__); 209 allocated_end_ = allocated_current_ + size_to_allocate; 210 PoisonShadow((uptr)allocated_current_, size_to_allocate, 211 kAsanInternalHeapMagic); 212 } 213 CHECK(allocated_end_ - allocated_current_ >= (sptr)size); 214 void *res = allocated_current_; 215 allocated_current_ += size; 216 return res; 217} 218 219// ---------------------- DescribeAddress -------------------- {{{1 220static bool DescribeStackAddress(uptr addr, uptr access_size) { 221 AsanThread *t = asanThreadRegistry().FindThreadByStackAddress(addr); 222 if (!t) return false; 223 const sptr kBufSize = 4095; 224 char buf[kBufSize]; 225 uptr offset = 0; 226 const char *frame_descr = t->GetFrameNameByAddr(addr, &offset); 227 // This string is created by the compiler and has the following form: 228 // "FunctioName n alloc_1 alloc_2 ... alloc_n" 229 // where alloc_i looks like "offset size len ObjectName ". 230 CHECK(frame_descr); 231 // Report the function name and the offset. 232 const char *name_end = internal_strchr(frame_descr, ' '); 233 CHECK(name_end); 234 buf[0] = 0; 235 internal_strncat(buf, frame_descr, 236 Min(kBufSize, 237 static_cast<sptr>(name_end - frame_descr))); 238 AsanPrintf("Address %p is located at offset %zu " 239 "in frame <%s> of T%d's stack:\n", 240 (void*)addr, offset, buf, t->tid()); 241 // Report the number of stack objects. 242 char *p; 243 uptr n_objects = internal_simple_strtoll(name_end, &p, 10); 244 CHECK(n_objects > 0); 245 AsanPrintf(" This frame has %zu object(s):\n", n_objects); 246 // Report all objects in this frame. 247 for (uptr i = 0; i < n_objects; i++) { 248 uptr beg, size; 249 sptr len; 250 beg = internal_simple_strtoll(p, &p, 10); 251 size = internal_simple_strtoll(p, &p, 10); 252 len = internal_simple_strtoll(p, &p, 10); 253 if (beg <= 0 || size <= 0 || len < 0 || *p != ' ') { 254 AsanPrintf("AddressSanitizer can't parse the stack frame " 255 "descriptor: |%s|\n", frame_descr); 256 break; 257 } 258 p++; 259 buf[0] = 0; 260 internal_strncat(buf, p, Min(kBufSize, len)); 261 p += len; 262 AsanPrintf(" [%zu, %zu) '%s'\n", beg, beg + size, buf); 263 } 264 AsanPrintf("HINT: this may be a false positive if your program uses " 265 "some custom stack unwind mechanism\n" 266 " (longjmp and C++ exceptions *are* supported)\n"); 267 t->summary()->Announce(); 268 return true; 269} 270 271static NOINLINE void DescribeAddress(uptr addr, uptr access_size) { 272 // Check if this is a global. 273 if (DescribeAddrIfGlobal(addr)) 274 return; 275 276 if (DescribeStackAddress(addr, access_size)) 277 return; 278 279 // finally, check if this is a heap. 280 DescribeHeapAddress(addr, access_size); 281} 282 283// -------------------------- Run-time entry ------------------- {{{1 284// exported functions 285#define ASAN_REPORT_ERROR(type, is_write, size) \ 286extern "C" NOINLINE INTERFACE_ATTRIBUTE \ 287void __asan_report_ ## type ## size(uptr addr); \ 288void __asan_report_ ## type ## size(uptr addr) { \ 289 GET_CALLER_PC_BP_SP; \ 290 __asan_report_error(pc, bp, sp, addr, is_write, size); \ 291} 292 293ASAN_REPORT_ERROR(load, false, 1) 294ASAN_REPORT_ERROR(load, false, 2) 295ASAN_REPORT_ERROR(load, false, 4) 296ASAN_REPORT_ERROR(load, false, 8) 297ASAN_REPORT_ERROR(load, false, 16) 298ASAN_REPORT_ERROR(store, true, 1) 299ASAN_REPORT_ERROR(store, true, 2) 300ASAN_REPORT_ERROR(store, true, 4) 301ASAN_REPORT_ERROR(store, true, 8) 302ASAN_REPORT_ERROR(store, true, 16) 303 304// Force the linker to keep the symbols for various ASan interface functions. 305// We want to keep those in the executable in order to let the instrumented 306// dynamic libraries access the symbol even if it is not used by the executable 307// itself. This should help if the build system is removing dead code at link 308// time. 309static NOINLINE void force_interface_symbols() { 310 volatile int fake_condition = 0; // prevent dead condition elimination. 311 if (fake_condition) { 312 __asan_report_load1(0); 313 __asan_report_load2(0); 314 __asan_report_load4(0); 315 __asan_report_load8(0); 316 __asan_report_load16(0); 317 __asan_report_store1(0); 318 __asan_report_store2(0); 319 __asan_report_store4(0); 320 __asan_report_store8(0); 321 __asan_report_store16(0); 322 __asan_register_global(0, 0, 0); 323 __asan_register_globals(0, 0); 324 __asan_unregister_globals(0, 0); 325 __asan_set_death_callback(0); 326 __asan_set_error_report_callback(0); 327 __asan_handle_no_return(); 328 } 329} 330 331// -------------------------- Init ------------------- {{{1 332static void asan_atexit() { 333 AsanPrintf("AddressSanitizer exit stats:\n"); 334 __asan_print_accumulated_stats(); 335} 336 337} // namespace __asan 338 339// ---------------------- Interface ---------------- {{{1 340using namespace __asan; // NOLINT 341 342int __asan_set_error_exit_code(int exit_code) { 343 int old = flags()->exitcode; 344 flags()->exitcode = exit_code; 345 return old; 346} 347 348void NOINLINE __asan_handle_no_return() { 349 int local_stack; 350 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 351 CHECK(curr_thread); 352 uptr top = curr_thread->stack_top(); 353 uptr bottom = ((uptr)&local_stack - kPageSize) & ~(kPageSize-1); 354 PoisonShadow(bottom, top - bottom, 0); 355} 356 357void NOINLINE __asan_set_death_callback(void (*callback)(void)) { 358 death_callback = callback; 359} 360 361void NOINLINE __asan_set_error_report_callback(void (*callback)(const char*)) { 362 error_report_callback = callback; 363 if (callback) { 364 error_message_buffer_size = 1 << 16; 365 error_message_buffer = 366 (char*)MmapOrDie(error_message_buffer_size, __FUNCTION__); 367 error_message_buffer_pos = 0; 368 } 369} 370 371void __asan_report_error(uptr pc, uptr bp, uptr sp, 372 uptr addr, bool is_write, uptr access_size) { 373 // Do not print more than one report, otherwise they will mix up. 374 static atomic_uint32_t num_calls; 375 if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) return; 376 377 AsanPrintf("====================================================" 378 "=============\n"); 379 const char *bug_descr = "unknown-crash"; 380 if (AddrIsInMem(addr)) { 381 u8 *shadow_addr = (u8*)MemToShadow(addr); 382 // If we are accessing 16 bytes, look at the second shadow byte. 383 if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY) 384 shadow_addr++; 385 // If we are in the partial right redzone, look at the next shadow byte. 386 if (*shadow_addr > 0 && *shadow_addr < 128) 387 shadow_addr++; 388 switch (*shadow_addr) { 389 case kAsanHeapLeftRedzoneMagic: 390 case kAsanHeapRightRedzoneMagic: 391 bug_descr = "heap-buffer-overflow"; 392 break; 393 case kAsanHeapFreeMagic: 394 bug_descr = "heap-use-after-free"; 395 break; 396 case kAsanStackLeftRedzoneMagic: 397 bug_descr = "stack-buffer-underflow"; 398 break; 399 case kAsanStackMidRedzoneMagic: 400 case kAsanStackRightRedzoneMagic: 401 case kAsanStackPartialRedzoneMagic: 402 bug_descr = "stack-buffer-overflow"; 403 break; 404 case kAsanStackAfterReturnMagic: 405 bug_descr = "stack-use-after-return"; 406 break; 407 case kAsanUserPoisonedMemoryMagic: 408 bug_descr = "use-after-poison"; 409 break; 410 case kAsanGlobalRedzoneMagic: 411 bug_descr = "global-buffer-overflow"; 412 break; 413 } 414 } 415 416 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 417 u32 curr_tid = asanThreadRegistry().GetCurrentTidOrInvalid(); 418 419 if (curr_thread) { 420 // We started reporting an error message. Stop using the fake stack 421 // in case we will call an instrumented function from a symbolizer. 422 curr_thread->fake_stack().StopUsingFakeStack(); 423 } 424 425 AsanReport("ERROR: AddressSanitizer %s on address " 426 "%p at pc 0x%zx bp 0x%zx sp 0x%zx\n", 427 bug_descr, (void*)addr, pc, bp, sp); 428 429 AsanPrintf("%s of size %zu at %p thread T%d\n", 430 access_size ? (is_write ? "WRITE" : "READ") : "ACCESS", 431 access_size, (void*)addr, curr_tid); 432 433 if (flags()->debug) { 434 PrintBytes("PC: ", (uptr*)pc); 435 } 436 437 GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, pc, bp); 438 stack.PrintStack(); 439 440 CHECK(AddrIsInMem(addr)); 441 442 DescribeAddress(addr, access_size); 443 444 uptr shadow_addr = MemToShadow(addr); 445 AsanReport("ABORTING\n"); 446 __asan_print_accumulated_stats(); 447 AsanPrintf("Shadow byte and word:\n"); 448 AsanPrintf(" %p: %x\n", (void*)shadow_addr, *(unsigned char*)shadow_addr); 449 uptr aligned_shadow = shadow_addr & ~(kWordSize - 1); 450 PrintBytes(" ", (uptr*)(aligned_shadow)); 451 AsanPrintf("More shadow bytes:\n"); 452 PrintBytes(" ", (uptr*)(aligned_shadow-4*kWordSize)); 453 PrintBytes(" ", (uptr*)(aligned_shadow-3*kWordSize)); 454 PrintBytes(" ", (uptr*)(aligned_shadow-2*kWordSize)); 455 PrintBytes(" ", (uptr*)(aligned_shadow-1*kWordSize)); 456 PrintBytes("=>", (uptr*)(aligned_shadow+0*kWordSize)); 457 PrintBytes(" ", (uptr*)(aligned_shadow+1*kWordSize)); 458 PrintBytes(" ", (uptr*)(aligned_shadow+2*kWordSize)); 459 PrintBytes(" ", (uptr*)(aligned_shadow+3*kWordSize)); 460 PrintBytes(" ", (uptr*)(aligned_shadow+4*kWordSize)); 461 if (error_report_callback) { 462 error_report_callback(error_message_buffer); 463 } 464 Die(); 465} 466 467 468void __asan_init() { 469 if (asan_inited) return; 470 asan_init_is_running = true; 471 472 // Make sure we are not statically linked. 473 AsanDoesNotSupportStaticLinkage(); 474 475 // Initialize flags. 476 const char *options = GetEnv("ASAN_OPTIONS"); 477 InitializeFlags(flags(), options); 478 479 if (flags()->verbosity && options) { 480 Report("Parsed ASAN_OPTIONS: %s\n", options); 481 } 482 483 if (flags()->atexit) { 484 Atexit(asan_atexit); 485 } 486 487 // interceptors 488 InitializeAsanInterceptors(); 489 490 ReplaceSystemMalloc(); 491 ReplaceOperatorsNewAndDelete(); 492 493 if (flags()->verbosity) { 494 Printf("|| `[%p, %p]` || HighMem ||\n", 495 (void*)kHighMemBeg, (void*)kHighMemEnd); 496 Printf("|| `[%p, %p]` || HighShadow ||\n", 497 (void*)kHighShadowBeg, (void*)kHighShadowEnd); 498 Printf("|| `[%p, %p]` || ShadowGap ||\n", 499 (void*)kShadowGapBeg, (void*)kShadowGapEnd); 500 Printf("|| `[%p, %p]` || LowShadow ||\n", 501 (void*)kLowShadowBeg, (void*)kLowShadowEnd); 502 Printf("|| `[%p, %p]` || LowMem ||\n", 503 (void*)kLowMemBeg, (void*)kLowMemEnd); 504 Printf("MemToShadow(shadow): %p %p %p %p\n", 505 (void*)MEM_TO_SHADOW(kLowShadowBeg), 506 (void*)MEM_TO_SHADOW(kLowShadowEnd), 507 (void*)MEM_TO_SHADOW(kHighShadowBeg), 508 (void*)MEM_TO_SHADOW(kHighShadowEnd)); 509 Printf("red_zone=%zu\n", (uptr)flags()->redzone); 510 Printf("malloc_context_size=%zu\n", (uptr)flags()->malloc_context_size); 511 512 Printf("SHADOW_SCALE: %zx\n", (uptr)SHADOW_SCALE); 513 Printf("SHADOW_GRANULARITY: %zx\n", (uptr)SHADOW_GRANULARITY); 514 Printf("SHADOW_OFFSET: %zx\n", (uptr)SHADOW_OFFSET); 515 CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7); 516 } 517 518 if (flags()->disable_core) { 519 DisableCoreDumper(); 520 } 521 522 uptr shadow_start = kLowShadowBeg; 523 if (kLowShadowBeg > 0) shadow_start -= kMmapGranularity; 524 uptr shadow_end = kHighShadowEnd; 525 if (MemoryRangeIsAvailable(shadow_start, shadow_end)) { 526 if (kLowShadowBeg != kLowShadowEnd) { 527 // mmap the low shadow plus at least one page. 528 ReserveShadowMemoryRange(kLowShadowBeg - kMmapGranularity, kLowShadowEnd); 529 } 530 // mmap the high shadow. 531 ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd); 532 // protect the gap 533 void *prot = Mprotect(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1); 534 CHECK(prot == (void*)kShadowGapBeg); 535 } else { 536 Report("Shadow memory range interleaves with an existing memory mapping. " 537 "ASan cannot proceed correctly. ABORTING.\n"); 538 DumpProcessMap(); 539 Die(); 540 } 541 542 InstallSignalHandlers(); 543 544 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited 545 // should be set to 1 prior to initializing the threads. 546 asan_inited = 1; 547 asan_init_is_running = false; 548 549 asanThreadRegistry().Init(); 550 asanThreadRegistry().GetMain()->ThreadStart(); 551 force_interface_symbols(); // no-op. 552 553 if (flags()->verbosity) { 554 Report("AddressSanitizer Init done\n"); 555 } 556} 557 558#if defined(ASAN_USE_PREINIT_ARRAY) 559 // On Linux, we force __asan_init to be called before anyone else 560 // by placing it into .preinit_array section. 561 // FIXME: do we have anything like this on Mac? 562 __attribute__((section(".preinit_array"))) 563 typeof(__asan_init) *__asan_preinit =__asan_init; 564#elif defined(_WIN32) && defined(_DLL) 565 // On Windows, when using dynamic CRT (/MD), we can put a pointer 566 // to __asan_init into the global list of C initializers. 567 // See crt0dat.c in the CRT sources for the details. 568 #pragma section(".CRT$XIB", long, read) // NOLINT 569 __declspec(allocate(".CRT$XIB")) void (*__asan_preinit)() = __asan_init; 570#endif 571