asan_rtl.cc revision cb8c4dce691097718d5af41b36899b72ef4b1d84 
1//===-- asan_rtl.cc -------------------------------------------------------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12// Main file of the ASan run-time library.
13//===----------------------------------------------------------------------===//
14#include "asan_allocator.h"
15#include "asan_interceptors.h"
16#include "asan_interface.h"
17#include "asan_internal.h"
18#include "asan_lock.h"
19#include "asan_mapping.h"
20#include "asan_stack.h"
21#include "asan_stats.h"
22#include "asan_thread.h"
23#include "asan_thread_registry.h"
24#include "sanitizer_common/sanitizer_atomic.h"
25#include "sanitizer_common/sanitizer_flags.h"
26#include "sanitizer_common/sanitizer_libc.h"
27
28namespace __sanitizer {
29using namespace __asan;
30
31void Die() {
32  static atomic_uint32_t num_calls;
33  if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) {
34    // Don't die twice - run a busy loop.
35    while (1) { }
36  }
37  if (flags()->sleep_before_dying) {
38    Report("Sleeping for %zd second(s)\n", flags()->sleep_before_dying);
39    SleepForSeconds(flags()->sleep_before_dying);
40  }
41  if (flags()->unmap_shadow_on_exit)
42    UnmapOrDie((void*)kLowShadowBeg, kHighShadowEnd - kLowShadowBeg);
43  if (death_callback)
44    death_callback();
45  if (flags()->abort_on_error)
46    Abort();
47  Exit(flags()->exitcode);
48}
49
50void CheckFailed(const char *file, int line, const char *cond, u64 v1, u64 v2) {
51  AsanReport("AddressSanitizer CHECK failed: %s:%d \"%s\" (%zx, %zx)\n",
52             file, line, cond, (uptr)v1, (uptr)v2);
53  PRINT_CURRENT_STACK();
54  ShowStatsAndAbort();
55}
56
57}  // namespace __sanitizer
58
59namespace __asan {
60
61// -------------------------- Flags ------------------------- {{{1
62static const uptr kMallocContextSize = 30;
63
64static Flags asan_flags;
65
66Flags *flags() {
67  return &asan_flags;
68}
69
70// Can be overriden in frontend.
71void WEAK OverrideFlags(Flags *f) {
72  (void)f;
73}
74
75static void ParseFlagsFromString(Flags *f, const char *str) {
76  ParseFlag(str, &f->quarantine_size, "quarantine_size");
77  ParseFlag(str, &f->symbolize, "symbolize");
78  ParseFlag(str, &f->verbosity, "verbosity");
79  ParseFlag(str, &f->redzone, "redzone");
80  CHECK(f->redzone >= 16);
81  CHECK(IsPowerOfTwo(f->redzone));
82
83  ParseFlag(str, &f->debug, "debug");
84  ParseFlag(str, &f->poison_shadow, "poison_shadow");
85  ParseFlag(str, &f->report_globals, "report_globals");
86  ParseFlag(str, &f->malloc_context_size, "malloc_context_size");
87  CHECK(f->malloc_context_size <= kMallocContextSize);
88
89  ParseFlag(str, &f->replace_str, "replace_str");
90  ParseFlag(str, &f->replace_intrin, "replace_intrin");
91  ParseFlag(str, &f->replace_cfallocator, "replace_cfallocator");
92  ParseFlag(str, &f->mac_ignore_invalid_free, "mac_ignore_invalid_free");
93  ParseFlag(str, &f->use_fake_stack, "use_fake_stack");
94  ParseFlag(str, &f->max_malloc_fill_size, "max_malloc_fill_size");
95  ParseFlag(str, &f->exitcode, "exitcode");
96  ParseFlag(str, &f->allow_user_poisoning, "allow_user_poisoning");
97  ParseFlag(str, &f->sleep_before_dying, "sleep_before_dying");
98  ParseFlag(str, &f->handle_segv, "handle_segv");
99  ParseFlag(str, &f->use_sigaltstack, "use_sigaltstack");
100  // Allow the users to work around the bug in Nvidia drivers prior to 295.*.
101  ParseFlag(str, &f->check_malloc_usable_size, "check_malloc_usable_size");
102  ParseFlag(str, &f->unmap_shadow_on_exit, "unmap_shadow_on_exit");
103  ParseFlag(str, &f->abort_on_error, "abort_on_error");
104  ParseFlag(str, &f->atexit, "atexit");
105  // By default, disable core dumper on 64-bit --
106  // it makes little sense to dump 16T+ core.
107  ParseFlag(str, &f->disable_core, "disable_core");
108}
109
110void InitializeFlags(Flags *f, const char *env) {
111  internal_memset(f, 0, sizeof(*f));
112
113  f->quarantine_size = (ASAN_LOW_MEMORY) ? 1UL << 24 : 1UL << 28;
114  f->symbolize = false;
115  f->verbosity = 0;
116  f->redzone = (ASAN_LOW_MEMORY) ? 64 : 128;  // power of two, >= 32.
117  f->debug = 0;
118  f->poison_shadow = true;
119  f->report_globals = 1;
120  f->malloc_context_size = kMallocContextSize;
121  f->replace_str = true;
122  f->replace_intrin = true;
123  f->replace_cfallocator = true;  // Used on Mac only.
124  f->mac_ignore_invalid_free = false;  // Used on Mac only.
125  f->use_fake_stack = true;
126  f->max_malloc_fill_size = 0;
127  f->exitcode = ASAN_DEFAULT_FAILURE_EXITCODE;
128  f->allow_user_poisoning = true;
129  f->sleep_before_dying = 0;
130  f->handle_segv = ASAN_NEEDS_SEGV;
131  f->use_sigaltstack = false;
132  f->check_malloc_usable_size = true;
133  f->unmap_shadow_on_exit = false;
134  f->abort_on_error = false;
135  f->atexit = false;
136  f->disable_core = (__WORDSIZE == 64);
137
138  // Let a frontend override.
139  OverrideFlags(f);
140
141  // Override from user-specified string.
142#if !defined(_WIN32)
143  if (__asan_default_options) {
144    ParseFlagsFromString(f, __asan_default_options);
145    if (flags()->verbosity) {
146      Report("Using the defaults from __asan_default_options: %s\n",
147             __asan_default_options);
148    }
149  }
150#endif
151
152  // Override from command line.
153  ParseFlagsFromString(f, env);
154}
155
156// -------------------------- Globals --------------------- {{{1
157int asan_inited;
158bool asan_init_is_running;
159void (*death_callback)(void);
160static void (*error_report_callback)(const char*);
161char *error_message_buffer = 0;
162uptr error_message_buffer_pos = 0;
163uptr error_message_buffer_size = 0;
164
165// -------------------------- Misc ---------------- {{{1
166void ShowStatsAndAbort() {
167  __asan_print_accumulated_stats();
168  Die();
169}
170
171static void PrintBytes(const char *before, uptr *a) {
172  u8 *bytes = (u8*)a;
173  uptr byte_num = (__WORDSIZE) / 8;
174  AsanPrintf("%s%p:", before, (void*)a);
175  for (uptr i = 0; i < byte_num; i++) {
176    AsanPrintf(" %x%x", bytes[i] >> 4, bytes[i] & 15);
177  }
178  AsanPrintf("\n");
179}
180
181void AppendToErrorMessageBuffer(const char *buffer) {
182  if (error_message_buffer) {
183    uptr length = internal_strlen(buffer);
184    CHECK_GE(error_message_buffer_size, error_message_buffer_pos);
185    uptr remaining = error_message_buffer_size - error_message_buffer_pos;
186    internal_strncpy(error_message_buffer + error_message_buffer_pos,
187                     buffer, remaining);
188    error_message_buffer[error_message_buffer_size - 1] = '\0';
189    // FIXME: reallocate the buffer instead of truncating the message.
190    error_message_buffer_pos += remaining > length ? length : remaining;
191  }
192}
193
194// ---------------------- mmap -------------------- {{{1
195// Reserve memory range [beg, end].
196static void ReserveShadowMemoryRange(uptr beg, uptr end) {
197  CHECK((beg % kPageSize) == 0);
198  CHECK(((end + 1) % kPageSize) == 0);
199  uptr size = end - beg + 1;
200  void *res = MmapFixedNoReserve(beg, size);
201  CHECK(res == (void*)beg && "ReserveShadowMemoryRange failed");
202}
203
204// ---------------------- LowLevelAllocator ------------- {{{1
205void *LowLevelAllocator::Allocate(uptr size) {
206  CHECK((size & (size - 1)) == 0 && "size must be a power of two");
207  if (allocated_end_ - allocated_current_ < (sptr)size) {
208    uptr size_to_allocate = Max(size, kPageSize);
209    allocated_current_ =
210        (char*)MmapOrDie(size_to_allocate, __FUNCTION__);
211    allocated_end_ = allocated_current_ + size_to_allocate;
212    PoisonShadow((uptr)allocated_current_, size_to_allocate,
213                 kAsanInternalHeapMagic);
214  }
215  CHECK(allocated_end_ - allocated_current_ >= (sptr)size);
216  void *res = allocated_current_;
217  allocated_current_ += size;
218  return res;
219}
220
221// ---------------------- DescribeAddress -------------------- {{{1
222static bool DescribeStackAddress(uptr addr, uptr access_size) {
223  AsanThread *t = asanThreadRegistry().FindThreadByStackAddress(addr);
224  if (!t) return false;
225  const sptr kBufSize = 4095;
226  char buf[kBufSize];
227  uptr offset = 0;
228  const char *frame_descr = t->GetFrameNameByAddr(addr, &offset);
229  // This string is created by the compiler and has the following form:
230  // "FunctioName n alloc_1 alloc_2 ... alloc_n"
231  // where alloc_i looks like "offset size len ObjectName ".
232  CHECK(frame_descr);
233  // Report the function name and the offset.
234  const char *name_end = internal_strchr(frame_descr, ' ');
235  CHECK(name_end);
236  buf[0] = 0;
237  internal_strncat(buf, frame_descr,
238                   Min(kBufSize,
239                       static_cast<sptr>(name_end - frame_descr)));
240  AsanPrintf("Address %p is located at offset %zu "
241             "in frame <%s> of T%d's stack:\n",
242             (void*)addr, offset, buf, t->tid());
243  // Report the number of stack objects.
244  char *p;
245  uptr n_objects = internal_simple_strtoll(name_end, &p, 10);
246  CHECK(n_objects > 0);
247  AsanPrintf("  This frame has %zu object(s):\n", n_objects);
248  // Report all objects in this frame.
249  for (uptr i = 0; i < n_objects; i++) {
250    uptr beg, size;
251    sptr len;
252    beg  = internal_simple_strtoll(p, &p, 10);
253    size = internal_simple_strtoll(p, &p, 10);
254    len  = internal_simple_strtoll(p, &p, 10);
255    if (beg <= 0 || size <= 0 || len < 0 || *p != ' ') {
256      AsanPrintf("AddressSanitizer can't parse the stack frame "
257                 "descriptor: |%s|\n", frame_descr);
258      break;
259    }
260    p++;
261    buf[0] = 0;
262    internal_strncat(buf, p, Min(kBufSize, len));
263    p += len;
264    AsanPrintf("    [%zu, %zu) '%s'\n", beg, beg + size, buf);
265  }
266  AsanPrintf("HINT: this may be a false positive if your program uses "
267             "some custom stack unwind mechanism\n"
268             "      (longjmp and C++ exceptions *are* supported)\n");
269  t->summary()->Announce();
270  return true;
271}
272
273static NOINLINE void DescribeAddress(uptr addr, uptr access_size) {
274  // Check if this is a global.
275  if (DescribeAddrIfGlobal(addr))
276    return;
277
278  if (DescribeStackAddress(addr, access_size))
279    return;
280
281  // finally, check if this is a heap.
282  DescribeHeapAddress(addr, access_size);
283}
284
285// -------------------------- Run-time entry ------------------- {{{1
286// exported functions
287#define ASAN_REPORT_ERROR(type, is_write, size)                     \
288extern "C" NOINLINE INTERFACE_ATTRIBUTE                        \
289void __asan_report_ ## type ## size(uptr addr);                \
290void __asan_report_ ## type ## size(uptr addr) {               \
291  GET_CALLER_PC_BP_SP;                                              \
292  __asan_report_error(pc, bp, sp, addr, is_write, size);            \
293}
294
295ASAN_REPORT_ERROR(load, false, 1)
296ASAN_REPORT_ERROR(load, false, 2)
297ASAN_REPORT_ERROR(load, false, 4)
298ASAN_REPORT_ERROR(load, false, 8)
299ASAN_REPORT_ERROR(load, false, 16)
300ASAN_REPORT_ERROR(store, true, 1)
301ASAN_REPORT_ERROR(store, true, 2)
302ASAN_REPORT_ERROR(store, true, 4)
303ASAN_REPORT_ERROR(store, true, 8)
304ASAN_REPORT_ERROR(store, true, 16)
305
306// Force the linker to keep the symbols for various ASan interface functions.
307// We want to keep those in the executable in order to let the instrumented
308// dynamic libraries access the symbol even if it is not used by the executable
309// itself. This should help if the build system is removing dead code at link
310// time.
311static NOINLINE void force_interface_symbols() {
312  volatile int fake_condition = 0;  // prevent dead condition elimination.
313  if (fake_condition) {
314    __asan_report_load1(0);
315    __asan_report_load2(0);
316    __asan_report_load4(0);
317    __asan_report_load8(0);
318    __asan_report_load16(0);
319    __asan_report_store1(0);
320    __asan_report_store2(0);
321    __asan_report_store4(0);
322    __asan_report_store8(0);
323    __asan_report_store16(0);
324    __asan_register_global(0, 0, 0);
325    __asan_register_globals(0, 0);
326    __asan_unregister_globals(0, 0);
327    __asan_set_death_callback(0);
328    __asan_set_error_report_callback(0);
329    __asan_handle_no_return();
330  }
331}
332
333// -------------------------- Init ------------------- {{{1
334static void asan_atexit() {
335  AsanPrintf("AddressSanitizer exit stats:\n");
336  __asan_print_accumulated_stats();
337}
338
339}  // namespace __asan
340
341// ---------------------- Interface ---------------- {{{1
342using namespace __asan;  // NOLINT
343
344int __asan_set_error_exit_code(int exit_code) {
345  int old = flags()->exitcode;
346  flags()->exitcode = exit_code;
347  return old;
348}
349
350void NOINLINE __asan_handle_no_return() {
351  int local_stack;
352  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
353  CHECK(curr_thread);
354  uptr top = curr_thread->stack_top();
355  uptr bottom = ((uptr)&local_stack - kPageSize) & ~(kPageSize-1);
356  PoisonShadow(bottom, top - bottom, 0);
357}
358
359void NOINLINE __asan_set_death_callback(void (*callback)(void)) {
360  death_callback = callback;
361}
362
363void NOINLINE __asan_set_error_report_callback(void (*callback)(const char*)) {
364  error_report_callback = callback;
365  if (callback) {
366    error_message_buffer_size = 1 << 16;
367    error_message_buffer =
368        (char*)MmapOrDie(error_message_buffer_size, __FUNCTION__);
369    error_message_buffer_pos = 0;
370  }
371}
372
373void __asan_report_error(uptr pc, uptr bp, uptr sp,
374                         uptr addr, bool is_write, uptr access_size) {
375  // Do not print more than one report, otherwise they will mix up.
376  static atomic_uint32_t num_calls;
377  if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) return;
378
379  AsanPrintf("===================================================="
380             "=============\n");
381  const char *bug_descr = "unknown-crash";
382  if (AddrIsInMem(addr)) {
383    u8 *shadow_addr = (u8*)MemToShadow(addr);
384    // If we are accessing 16 bytes, look at the second shadow byte.
385    if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY)
386      shadow_addr++;
387    // If we are in the partial right redzone, look at the next shadow byte.
388    if (*shadow_addr > 0 && *shadow_addr < 128)
389      shadow_addr++;
390    switch (*shadow_addr) {
391      case kAsanHeapLeftRedzoneMagic:
392      case kAsanHeapRightRedzoneMagic:
393        bug_descr = "heap-buffer-overflow";
394        break;
395      case kAsanHeapFreeMagic:
396        bug_descr = "heap-use-after-free";
397        break;
398      case kAsanStackLeftRedzoneMagic:
399        bug_descr = "stack-buffer-underflow";
400        break;
401      case kAsanStackMidRedzoneMagic:
402      case kAsanStackRightRedzoneMagic:
403      case kAsanStackPartialRedzoneMagic:
404        bug_descr = "stack-buffer-overflow";
405        break;
406      case kAsanStackAfterReturnMagic:
407        bug_descr = "stack-use-after-return";
408        break;
409      case kAsanUserPoisonedMemoryMagic:
410        bug_descr = "use-after-poison";
411        break;
412      case kAsanGlobalRedzoneMagic:
413        bug_descr = "global-buffer-overflow";
414        break;
415    }
416  }
417
418  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
419  u32 curr_tid = asanThreadRegistry().GetCurrentTidOrInvalid();
420
421  if (curr_thread) {
422    // We started reporting an error message. Stop using the fake stack
423    // in case we will call an instrumented function from a symbolizer.
424    curr_thread->fake_stack().StopUsingFakeStack();
425  }
426
427  AsanReport("ERROR: AddressSanitizer %s on address "
428             "%p at pc 0x%zx bp 0x%zx sp 0x%zx\n",
429             bug_descr, (void*)addr, pc, bp, sp);
430
431  AsanPrintf("%s of size %zu at %p thread T%d\n",
432             access_size ? (is_write ? "WRITE" : "READ") : "ACCESS",
433             access_size, (void*)addr, curr_tid);
434
435  if (flags()->debug) {
436    PrintBytes("PC: ", (uptr*)pc);
437  }
438
439  GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, pc, bp);
440  stack.PrintStack();
441
442  CHECK(AddrIsInMem(addr));
443
444  DescribeAddress(addr, access_size);
445
446  uptr shadow_addr = MemToShadow(addr);
447  AsanReport("ABORTING\n");
448  __asan_print_accumulated_stats();
449  AsanPrintf("Shadow byte and word:\n");
450  AsanPrintf("  %p: %x\n", (void*)shadow_addr, *(unsigned char*)shadow_addr);
451  uptr aligned_shadow = shadow_addr & ~(kWordSize - 1);
452  PrintBytes("  ", (uptr*)(aligned_shadow));
453  AsanPrintf("More shadow bytes:\n");
454  PrintBytes("  ", (uptr*)(aligned_shadow-4*kWordSize));
455  PrintBytes("  ", (uptr*)(aligned_shadow-3*kWordSize));
456  PrintBytes("  ", (uptr*)(aligned_shadow-2*kWordSize));
457  PrintBytes("  ", (uptr*)(aligned_shadow-1*kWordSize));
458  PrintBytes("=>", (uptr*)(aligned_shadow+0*kWordSize));
459  PrintBytes("  ", (uptr*)(aligned_shadow+1*kWordSize));
460  PrintBytes("  ", (uptr*)(aligned_shadow+2*kWordSize));
461  PrintBytes("  ", (uptr*)(aligned_shadow+3*kWordSize));
462  PrintBytes("  ", (uptr*)(aligned_shadow+4*kWordSize));
463  if (error_report_callback) {
464    error_report_callback(error_message_buffer);
465  }
466  Die();
467}
468
469
470void __asan_init() {
471  if (asan_inited) return;
472  asan_init_is_running = true;
473
474  // Make sure we are not statically linked.
475  AsanDoesNotSupportStaticLinkage();
476
477  // Initialize flags.
478  const char *options = GetEnv("ASAN_OPTIONS");
479  InitializeFlags(flags(), options);
480
481  if (flags()->verbosity && options) {
482    Report("Parsed ASAN_OPTIONS: %s\n", options);
483  }
484
485  if (flags()->atexit) {
486    Atexit(asan_atexit);
487  }
488
489  // interceptors
490  InitializeAsanInterceptors();
491
492  ReplaceSystemMalloc();
493  ReplaceOperatorsNewAndDelete();
494
495  if (flags()->verbosity) {
496    Printf("|| `[%p, %p]` || HighMem    ||\n",
497           (void*)kHighMemBeg, (void*)kHighMemEnd);
498    Printf("|| `[%p, %p]` || HighShadow ||\n",
499           (void*)kHighShadowBeg, (void*)kHighShadowEnd);
500    Printf("|| `[%p, %p]` || ShadowGap  ||\n",
501           (void*)kShadowGapBeg, (void*)kShadowGapEnd);
502    Printf("|| `[%p, %p]` || LowShadow  ||\n",
503           (void*)kLowShadowBeg, (void*)kLowShadowEnd);
504    Printf("|| `[%p, %p]` || LowMem     ||\n",
505           (void*)kLowMemBeg, (void*)kLowMemEnd);
506    Printf("MemToShadow(shadow): %p %p %p %p\n",
507           (void*)MEM_TO_SHADOW(kLowShadowBeg),
508           (void*)MEM_TO_SHADOW(kLowShadowEnd),
509           (void*)MEM_TO_SHADOW(kHighShadowBeg),
510           (void*)MEM_TO_SHADOW(kHighShadowEnd));
511    Printf("red_zone=%zu\n", (uptr)flags()->redzone);
512    Printf("malloc_context_size=%zu\n", (uptr)flags()->malloc_context_size);
513
514    Printf("SHADOW_SCALE: %zx\n", (uptr)SHADOW_SCALE);
515    Printf("SHADOW_GRANULARITY: %zx\n", (uptr)SHADOW_GRANULARITY);
516    Printf("SHADOW_OFFSET: %zx\n", (uptr)SHADOW_OFFSET);
517    CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7);
518  }
519
520  if (flags()->disable_core) {
521    DisableCoreDumper();
522  }
523
524  uptr shadow_start = kLowShadowBeg;
525  if (kLowShadowBeg > 0) shadow_start -= kMmapGranularity;
526  uptr shadow_end = kHighShadowEnd;
527  if (MemoryRangeIsAvailable(shadow_start, shadow_end)) {
528    if (kLowShadowBeg != kLowShadowEnd) {
529      // mmap the low shadow plus at least one page.
530      ReserveShadowMemoryRange(kLowShadowBeg - kMmapGranularity, kLowShadowEnd);
531    }
532    // mmap the high shadow.
533    ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd);
534    // protect the gap
535    void *prot = Mprotect(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1);
536    CHECK(prot == (void*)kShadowGapBeg);
537  } else {
538    Report("Shadow memory range interleaves with an existing memory mapping. "
539           "ASan cannot proceed correctly. ABORTING.\n");
540    DumpProcessMap();
541    Die();
542  }
543
544  InstallSignalHandlers();
545
546  // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
547  // should be set to 1 prior to initializing the threads.
548  asan_inited = 1;
549  asan_init_is_running = false;
550
551  asanThreadRegistry().Init();
552  asanThreadRegistry().GetMain()->ThreadStart();
553  force_interface_symbols();  // no-op.
554
555  if (flags()->verbosity) {
556    Report("AddressSanitizer Init done\n");
557  }
558}
559
560#if defined(ASAN_USE_PREINIT_ARRAY)
561  // On Linux, we force __asan_init to be called before anyone else
562  // by placing it into .preinit_array section.
563  // FIXME: do we have anything like this on Mac?
564  __attribute__((section(".preinit_array")))
565    typeof(__asan_init) *__asan_preinit =__asan_init;
566#elif defined(_WIN32) && defined(_DLL)
567  // On Windows, when using dynamic CRT (/MD), we can put a pointer
568  // to __asan_init into the global list of C initializers.
569  // See crt0dat.c in the CRT sources for the details.
570  #pragma section(".CRT$XIB", long, read)  // NOLINT
571  __declspec(allocate(".CRT$XIB")) void (*__asan_preinit)() = __asan_init;
572#endif
573