asan_rtl.cc revision 95f630ae40cef78fb03b18110eff43bcf8d1c040
1//===-- asan_rtl.cc -------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Main file of the ASan run-time library. 13//===----------------------------------------------------------------------===// 14#include "asan_allocator.h" 15#include "asan_interceptors.h" 16#include "asan_internal.h" 17#include "asan_mapping.h" 18#include "asan_report.h" 19#include "asan_stack.h" 20#include "asan_stats.h" 21#include "asan_thread.h" 22#include "asan_thread_registry.h" 23#include "sanitizer/asan_interface.h" 24#include "sanitizer_common/sanitizer_atomic.h" 25#include "sanitizer_common/sanitizer_flags.h" 26#include "sanitizer_common/sanitizer_libc.h" 27#include "sanitizer_common/sanitizer_symbolizer.h" 28 29namespace __asan { 30 31static void AsanDie() { 32 static atomic_uint32_t num_calls; 33 if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) { 34 // Don't die twice - run a busy loop. 35 while (1) { } 36 } 37 if (flags()->sleep_before_dying) { 38 Report("Sleeping for %d second(s)\n", flags()->sleep_before_dying); 39 SleepForSeconds(flags()->sleep_before_dying); 40 } 41 if (flags()->unmap_shadow_on_exit) 42 UnmapOrDie((void*)kLowShadowBeg, kHighShadowEnd - kLowShadowBeg); 43 if (death_callback) 44 death_callback(); 45 if (flags()->abort_on_error) 46 Abort(); 47 Exit(flags()->exitcode); 48} 49 50static void AsanCheckFailed(const char *file, int line, const char *cond, 51 u64 v1, u64 v2) { 52 Report("AddressSanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n", 53 file, line, cond, (uptr)v1, (uptr)v2); 54 // FIXME: check for infinite recursion without a thread-local counter here. 55 PRINT_CURRENT_STACK(); 56 Die(); 57} 58 59// -------------------------- Flags ------------------------- {{{1 60static const int kDeafultMallocContextSize = 30; 61 62static Flags asan_flags; 63 64Flags *flags() { 65 return &asan_flags; 66} 67 68static const char *MaybeCallAsanDefaultOptions() { 69 return (&__asan_default_options) ? __asan_default_options() : ""; 70} 71 72static void ParseFlagsFromString(Flags *f, const char *str) { 73 ParseFlag(str, &f->quarantine_size, "quarantine_size"); 74 ParseFlag(str, &f->symbolize, "symbolize"); 75 ParseFlag(str, &f->verbosity, "verbosity"); 76 ParseFlag(str, &f->redzone, "redzone"); 77 CHECK(f->redzone >= 16); 78 CHECK(IsPowerOfTwo(f->redzone)); 79 80 ParseFlag(str, &f->debug, "debug"); 81 ParseFlag(str, &f->report_globals, "report_globals"); 82 ParseFlag(str, &f->check_initialization_order, "initialization_order"); 83 ParseFlag(str, &f->malloc_context_size, "malloc_context_size"); 84 CHECK((uptr)f->malloc_context_size <= kStackTraceMax); 85 86 ParseFlag(str, &f->replace_str, "replace_str"); 87 ParseFlag(str, &f->replace_intrin, "replace_intrin"); 88 ParseFlag(str, &f->replace_cfallocator, "replace_cfallocator"); 89 ParseFlag(str, &f->mac_ignore_invalid_free, "mac_ignore_invalid_free"); 90 ParseFlag(str, &f->use_fake_stack, "use_fake_stack"); 91 ParseFlag(str, &f->max_malloc_fill_size, "max_malloc_fill_size"); 92 ParseFlag(str, &f->exitcode, "exitcode"); 93 ParseFlag(str, &f->allow_user_poisoning, "allow_user_poisoning"); 94 ParseFlag(str, &f->sleep_before_dying, "sleep_before_dying"); 95 ParseFlag(str, &f->handle_segv, "handle_segv"); 96 ParseFlag(str, &f->use_sigaltstack, "use_sigaltstack"); 97 ParseFlag(str, &f->check_malloc_usable_size, "check_malloc_usable_size"); 98 ParseFlag(str, &f->unmap_shadow_on_exit, "unmap_shadow_on_exit"); 99 ParseFlag(str, &f->abort_on_error, "abort_on_error"); 100 ParseFlag(str, &f->print_stats, "print_stats"); 101 ParseFlag(str, &f->print_legend, "print_legend"); 102 ParseFlag(str, &f->atexit, "atexit"); 103 ParseFlag(str, &f->disable_core, "disable_core"); 104 ParseFlag(str, &f->strip_path_prefix, "strip_path_prefix"); 105 ParseFlag(str, &f->allow_reexec, "allow_reexec"); 106 ParseFlag(str, &f->print_full_thread_history, "print_full_thread_history"); 107 ParseFlag(str, &f->log_path, "log_path"); 108 ParseFlag(str, &f->fast_unwind_on_fatal, "fast_unwind_on_fatal"); 109 ParseFlag(str, &f->fast_unwind_on_malloc, "fast_unwind_on_malloc"); 110 ParseFlag(str, &f->poison_heap, "poison_heap"); 111 ParseFlag(str, &f->alloc_dealloc_mismatch, "alloc_dealloc_mismatch"); 112 ParseFlag(str, &f->use_stack_depot, "use_stack_depot"); 113} 114 115void InitializeFlags(Flags *f, const char *env) { 116 internal_memset(f, 0, sizeof(*f)); 117 118 f->quarantine_size = (ASAN_LOW_MEMORY) ? 1UL << 26 : 1UL << 28; 119 f->symbolize = false; 120 f->verbosity = 0; 121 f->redzone = ASAN_ALLOCATOR_VERSION == 2 ? 16 : (ASAN_LOW_MEMORY) ? 64 : 128; 122 f->debug = false; 123 f->report_globals = 1; 124 f->check_initialization_order = true; 125 f->malloc_context_size = kDeafultMallocContextSize; 126 f->replace_str = true; 127 f->replace_intrin = true; 128 f->replace_cfallocator = true; 129 f->mac_ignore_invalid_free = false; 130 f->use_fake_stack = true; 131 f->max_malloc_fill_size = 0; 132 f->exitcode = ASAN_DEFAULT_FAILURE_EXITCODE; 133 f->allow_user_poisoning = true; 134 f->sleep_before_dying = 0; 135 f->handle_segv = ASAN_NEEDS_SEGV; 136 f->use_sigaltstack = false; 137 f->check_malloc_usable_size = true; 138 f->unmap_shadow_on_exit = false; 139 f->abort_on_error = false; 140 f->print_stats = false; 141 f->print_legend = true; 142 f->atexit = false; 143 f->disable_core = (SANITIZER_WORDSIZE == 64); 144 f->strip_path_prefix = ""; 145 f->allow_reexec = true; 146 f->print_full_thread_history = true; 147 f->log_path = 0; 148 f->fast_unwind_on_fatal = false; 149 f->fast_unwind_on_malloc = true; 150 f->poison_heap = true; 151 // Turn off alloc/dealloc mismatch checker on Mac for now. 152 // TODO(glider): Fix known issues and enable this back. 153 f->alloc_dealloc_mismatch = (ASAN_MAC == 0); 154 f->use_stack_depot = true; // Only affects allocator2. 155 156 // Override from user-specified string. 157 ParseFlagsFromString(f, MaybeCallAsanDefaultOptions()); 158 if (flags()->verbosity) { 159 Report("Using the defaults from __asan_default_options: %s\n", 160 MaybeCallAsanDefaultOptions()); 161 } 162 163 // Override from command line. 164 ParseFlagsFromString(f, env); 165} 166 167// -------------------------- Globals --------------------- {{{1 168int asan_inited; 169bool asan_init_is_running; 170void (*death_callback)(void); 171uptr kHighMemEnd; 172 173// -------------------------- Misc ---------------- {{{1 174void ShowStatsAndAbort() { 175 __asan_print_accumulated_stats(); 176 Die(); 177} 178 179// ---------------------- mmap -------------------- {{{1 180// Reserve memory range [beg, end]. 181static void ReserveShadowMemoryRange(uptr beg, uptr end) { 182 CHECK((beg % GetPageSizeCached()) == 0); 183 CHECK(((end + 1) % GetPageSizeCached()) == 0); 184 uptr size = end - beg + 1; 185 void *res = MmapFixedNoReserve(beg, size); 186 if (res != (void*)beg) { 187 Report("ReserveShadowMemoryRange failed while trying to map 0x%zx bytes. " 188 "Perhaps you're using ulimit -v\n", size); 189 Abort(); 190 } 191} 192 193// --------------- LowLevelAllocateCallbac ---------- {{{1 194static void OnLowLevelAllocate(uptr ptr, uptr size) { 195 PoisonShadow(ptr, size, kAsanInternalHeapMagic); 196} 197 198// -------------------------- Run-time entry ------------------- {{{1 199// exported functions 200#define ASAN_REPORT_ERROR(type, is_write, size) \ 201extern "C" NOINLINE INTERFACE_ATTRIBUTE \ 202void __asan_report_ ## type ## size(uptr addr); \ 203void __asan_report_ ## type ## size(uptr addr) { \ 204 GET_CALLER_PC_BP_SP; \ 205 __asan_report_error(pc, bp, sp, addr, is_write, size); \ 206} 207 208ASAN_REPORT_ERROR(load, false, 1) 209ASAN_REPORT_ERROR(load, false, 2) 210ASAN_REPORT_ERROR(load, false, 4) 211ASAN_REPORT_ERROR(load, false, 8) 212ASAN_REPORT_ERROR(load, false, 16) 213ASAN_REPORT_ERROR(store, true, 1) 214ASAN_REPORT_ERROR(store, true, 2) 215ASAN_REPORT_ERROR(store, true, 4) 216ASAN_REPORT_ERROR(store, true, 8) 217ASAN_REPORT_ERROR(store, true, 16) 218 219// Force the linker to keep the symbols for various ASan interface functions. 220// We want to keep those in the executable in order to let the instrumented 221// dynamic libraries access the symbol even if it is not used by the executable 222// itself. This should help if the build system is removing dead code at link 223// time. 224static NOINLINE void force_interface_symbols() { 225 volatile int fake_condition = 0; // prevent dead condition elimination. 226 // __asan_report_* functions are noreturn, so we need a switch to prevent 227 // the compiler from removing any of them. 228 switch (fake_condition) { 229 case 1: __asan_report_load1(0); break; 230 case 2: __asan_report_load2(0); break; 231 case 3: __asan_report_load4(0); break; 232 case 4: __asan_report_load8(0); break; 233 case 5: __asan_report_load16(0); break; 234 case 6: __asan_report_store1(0); break; 235 case 7: __asan_report_store2(0); break; 236 case 8: __asan_report_store4(0); break; 237 case 9: __asan_report_store8(0); break; 238 case 10: __asan_report_store16(0); break; 239 case 12: __asan_register_globals(0, 0); break; 240 case 13: __asan_unregister_globals(0, 0); break; 241 case 14: __asan_set_death_callback(0); break; 242 case 15: __asan_set_error_report_callback(0); break; 243 case 16: __asan_handle_no_return(); break; 244 case 17: __asan_address_is_poisoned(0); break; 245 case 18: __asan_get_allocated_size(0); break; 246 case 19: __asan_get_current_allocated_bytes(); break; 247 case 20: __asan_get_estimated_allocated_size(0); break; 248 case 21: __asan_get_free_bytes(); break; 249 case 22: __asan_get_heap_size(); break; 250 case 23: __asan_get_ownership(0); break; 251 case 24: __asan_get_unmapped_bytes(); break; 252 case 25: __asan_poison_memory_region(0, 0); break; 253 case 26: __asan_unpoison_memory_region(0, 0); break; 254 case 27: __asan_set_error_exit_code(0); break; 255 case 28: __asan_stack_free(0, 0, 0); break; 256 case 29: __asan_stack_malloc(0, 0); break; 257 case 30: __asan_before_dynamic_init(0, 0); break; 258 case 31: __asan_after_dynamic_init(); break; 259 case 32: __asan_poison_stack_memory(0, 0); break; 260 case 33: __asan_unpoison_stack_memory(0, 0); break; 261 case 34: __asan_region_is_poisoned(0, 0); break; 262 case 35: __asan_describe_address(0); break; 263 } 264} 265 266static void asan_atexit() { 267 Printf("AddressSanitizer exit stats:\n"); 268 __asan_print_accumulated_stats(); 269} 270 271static void InitializeHighMemEnd() { 272#if SANITIZER_WORDSIZE == 64 273# if defined(__powerpc64__) 274 // FIXME: 275 // On PowerPC64 we have two different address space layouts: 44- and 46-bit. 276 // We somehow need to figure our which one we are using now and choose 277 // one of 0x00000fffffffffffUL and 0x00003fffffffffffUL. 278 // Note that with 'ulimit -s unlimited' the stack is moved away from the top 279 // of the address space, so simply checking the stack address is not enough. 280 kHighMemEnd = (1ULL << 44) - 1; // 0x00000fffffffffffUL 281# else 282 kHighMemEnd = (1ULL << 47) - 1; // 0x00007fffffffffffUL; 283# endif 284#else // SANITIZER_WORDSIZE == 32 285 kHighMemEnd = (1ULL << 32) - 1; // 0xffffffff; 286#endif // SANITIZER_WORDSIZE 287} 288 289} // namespace __asan 290 291// ---------------------- Interface ---------------- {{{1 292using namespace __asan; // NOLINT 293 294#if !SANITIZER_SUPPORTS_WEAK_HOOKS 295extern "C" { 296SANITIZER_WEAK_ATTRIBUTE SANITIZER_INTERFACE_ATTRIBUTE 297const char* __asan_default_options() { return ""; } 298} // extern "C" 299#endif 300 301int NOINLINE __asan_set_error_exit_code(int exit_code) { 302 int old = flags()->exitcode; 303 flags()->exitcode = exit_code; 304 return old; 305} 306 307void NOINLINE __asan_handle_no_return() { 308 int local_stack; 309 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 310 CHECK(curr_thread); 311 uptr PageSize = GetPageSizeCached(); 312 uptr top = curr_thread->stack_top(); 313 uptr bottom = ((uptr)&local_stack - PageSize) & ~(PageSize-1); 314 PoisonShadow(bottom, top - bottom, 0); 315} 316 317void NOINLINE __asan_set_death_callback(void (*callback)(void)) { 318 death_callback = callback; 319} 320 321void __asan_init() { 322 if (asan_inited) return; 323 CHECK(!asan_init_is_running && "ASan init calls itself!"); 324 asan_init_is_running = true; 325 InitializeHighMemEnd(); 326 327 // Make sure we are not statically linked. 328 AsanDoesNotSupportStaticLinkage(); 329 330 // Install tool-specific callbacks in sanitizer_common. 331 SetDieCallback(AsanDie); 332 SetCheckFailedCallback(AsanCheckFailed); 333 SetPrintfAndReportCallback(AppendToErrorMessageBuffer); 334 335 // Initialize flags. This must be done early, because most of the 336 // initialization steps look at flags(). 337 const char *options = GetEnv("ASAN_OPTIONS"); 338 InitializeFlags(flags(), options); 339 __sanitizer_set_report_path(flags()->log_path); 340 341 if (flags()->verbosity && options) { 342 Report("Parsed ASAN_OPTIONS: %s\n", options); 343 } 344 345 // Re-exec ourselves if we need to set additional env or command line args. 346 MaybeReexec(); 347 348 // Setup internal allocator callback. 349 SetLowLevelAllocateCallback(OnLowLevelAllocate); 350 351 if (flags()->atexit) { 352 Atexit(asan_atexit); 353 } 354 355 // interceptors 356 InitializeAsanInterceptors(); 357 358 ReplaceSystemMalloc(); 359 ReplaceOperatorsNewAndDelete(); 360 361 if (flags()->verbosity) { 362 Printf("|| `[%p, %p]` || HighMem ||\n", 363 (void*)kHighMemBeg, (void*)kHighMemEnd); 364 Printf("|| `[%p, %p]` || HighShadow ||\n", 365 (void*)kHighShadowBeg, (void*)kHighShadowEnd); 366 Printf("|| `[%p, %p]` || ShadowGap ||\n", 367 (void*)kShadowGapBeg, (void*)kShadowGapEnd); 368 Printf("|| `[%p, %p]` || LowShadow ||\n", 369 (void*)kLowShadowBeg, (void*)kLowShadowEnd); 370 Printf("|| `[%p, %p]` || LowMem ||\n", 371 (void*)kLowMemBeg, (void*)kLowMemEnd); 372 Printf("MemToShadow(shadow): %p %p %p %p\n", 373 (void*)MEM_TO_SHADOW(kLowShadowBeg), 374 (void*)MEM_TO_SHADOW(kLowShadowEnd), 375 (void*)MEM_TO_SHADOW(kHighShadowBeg), 376 (void*)MEM_TO_SHADOW(kHighShadowEnd)); 377 Printf("red_zone=%zu\n", (uptr)flags()->redzone); 378 Printf("malloc_context_size=%zu\n", (uptr)flags()->malloc_context_size); 379 380 Printf("SHADOW_SCALE: %zx\n", (uptr)SHADOW_SCALE); 381 Printf("SHADOW_GRANULARITY: %zx\n", (uptr)SHADOW_GRANULARITY); 382 Printf("SHADOW_OFFSET: %zx\n", (uptr)SHADOW_OFFSET); 383 CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7); 384 } 385 386 if (flags()->disable_core) { 387 DisableCoreDumper(); 388 } 389 390 uptr shadow_start = kLowShadowBeg; 391 if (kLowShadowBeg > 0) shadow_start -= GetMmapGranularity(); 392 uptr shadow_end = kHighShadowEnd; 393 if (MemoryRangeIsAvailable(shadow_start, shadow_end)) { 394 if (kLowShadowBeg != kLowShadowEnd) { 395 // mmap the low shadow plus at least one page. 396 ReserveShadowMemoryRange(kLowShadowBeg - GetMmapGranularity(), 397 kLowShadowEnd); 398 } 399 // mmap the high shadow. 400 ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd); 401 // protect the gap 402 void *prot = Mprotect(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1); 403 CHECK(prot == (void*)kShadowGapBeg); 404 } else { 405 Report("Shadow memory range interleaves with an existing memory mapping. " 406 "ASan cannot proceed correctly. ABORTING.\n"); 407 DumpProcessMap(); 408 Die(); 409 } 410 411 InstallSignalHandlers(); 412 // Start symbolizer process if necessary. 413 if (flags()->symbolize) { 414 const char *external_symbolizer = GetEnv("ASAN_SYMBOLIZER_PATH"); 415 if (external_symbolizer) { 416 InitializeExternalSymbolizer(external_symbolizer); 417 } 418 } 419 420 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited 421 // should be set to 1 prior to initializing the threads. 422 asan_inited = 1; 423 asan_init_is_running = false; 424 425 asanThreadRegistry().Init(); 426 asanThreadRegistry().GetMain()->ThreadStart(); 427 force_interface_symbols(); // no-op. 428 429 if (flags()->verbosity) { 430 Report("AddressSanitizer Init done\n"); 431 } 432} 433 434#if defined(ASAN_USE_PREINIT_ARRAY) 435 // On Linux, we force __asan_init to be called before anyone else 436 // by placing it into .preinit_array section. 437 // FIXME: do we have anything like this on Mac? 438 __attribute__((section(".preinit_array"))) 439 typeof(__asan_init) *__asan_preinit =__asan_init; 440#elif defined(_WIN32) && defined(_DLL) 441 // On Windows, when using dynamic CRT (/MD), we can put a pointer 442 // to __asan_init into the global list of C initializers. 443 // See crt0dat.c in the CRT sources for the details. 444 #pragma section(".CRT$XIB", long, read) // NOLINT 445 __declspec(allocate(".CRT$XIB")) void (*__asan_preinit)() = __asan_init; 446#endif 447