asan_rtl.cc revision e218beb2d14b663bd277158f386a86d0e62fef74
1//===-- asan_rtl.cc -------------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Main file of the ASan run-time library. 13//===----------------------------------------------------------------------===// 14#include "asan_allocator.h" 15#include "asan_interceptors.h" 16#include "asan_interface.h" 17#include "asan_internal.h" 18#include "asan_lock.h" 19#include "asan_mapping.h" 20#include "asan_report.h" 21#include "asan_stack.h" 22#include "asan_stats.h" 23#include "asan_thread.h" 24#include "asan_thread_registry.h" 25#include "sanitizer_common/sanitizer_atomic.h" 26#include "sanitizer_common/sanitizer_flags.h" 27#include "sanitizer_common/sanitizer_libc.h" 28 29namespace __sanitizer { 30using namespace __asan; 31 32void Die() { 33 static atomic_uint32_t num_calls; 34 if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) { 35 // Don't die twice - run a busy loop. 36 while (1) { } 37 } 38 if (flags()->sleep_before_dying) { 39 Report("Sleeping for %d second(s)\n", flags()->sleep_before_dying); 40 SleepForSeconds(flags()->sleep_before_dying); 41 } 42 if (flags()->unmap_shadow_on_exit) 43 UnmapOrDie((void*)kLowShadowBeg, kHighShadowEnd - kLowShadowBeg); 44 if (death_callback) 45 death_callback(); 46 if (flags()->abort_on_error) 47 Abort(); 48 Exit(flags()->exitcode); 49} 50 51void CheckFailed(const char *file, int line, const char *cond, u64 v1, u64 v2) { 52 AsanReport("AddressSanitizer CHECK failed: %s:%d \"%s\" (0x%zx, 0x%zx)\n", 53 file, line, cond, (uptr)v1, (uptr)v2); 54 PRINT_CURRENT_STACK(); 55 ShowStatsAndAbort(); 56} 57 58} // namespace __sanitizer 59 60namespace __asan { 61 62// -------------------------- Flags ------------------------- {{{1 63static const int kMallocContextSize = 30; 64 65static Flags asan_flags; 66 67Flags *flags() { 68 return &asan_flags; 69} 70 71static void ParseFlagsFromString(Flags *f, const char *str) { 72 ParseFlag(str, &f->quarantine_size, "quarantine_size"); 73 ParseFlag(str, &f->symbolize, "symbolize"); 74 ParseFlag(str, &f->verbosity, "verbosity"); 75 ParseFlag(str, &f->redzone, "redzone"); 76 CHECK(f->redzone >= 16); 77 CHECK(IsPowerOfTwo(f->redzone)); 78 79 ParseFlag(str, &f->debug, "debug"); 80 ParseFlag(str, &f->report_globals, "report_globals"); 81 ParseFlag(str, &f->malloc_context_size, "malloc_context_size"); 82 CHECK(f->malloc_context_size <= kMallocContextSize); 83 84 ParseFlag(str, &f->replace_str, "replace_str"); 85 ParseFlag(str, &f->replace_intrin, "replace_intrin"); 86 ParseFlag(str, &f->replace_cfallocator, "replace_cfallocator"); 87 ParseFlag(str, &f->mac_ignore_invalid_free, "mac_ignore_invalid_free"); 88 ParseFlag(str, &f->use_fake_stack, "use_fake_stack"); 89 ParseFlag(str, &f->max_malloc_fill_size, "max_malloc_fill_size"); 90 ParseFlag(str, &f->exitcode, "exitcode"); 91 ParseFlag(str, &f->allow_user_poisoning, "allow_user_poisoning"); 92 ParseFlag(str, &f->sleep_before_dying, "sleep_before_dying"); 93 ParseFlag(str, &f->handle_segv, "handle_segv"); 94 ParseFlag(str, &f->use_sigaltstack, "use_sigaltstack"); 95 ParseFlag(str, &f->check_malloc_usable_size, "check_malloc_usable_size"); 96 ParseFlag(str, &f->unmap_shadow_on_exit, "unmap_shadow_on_exit"); 97 ParseFlag(str, &f->abort_on_error, "abort_on_error"); 98 ParseFlag(str, &f->atexit, "atexit"); 99 ParseFlag(str, &f->disable_core, "disable_core"); 100 ParseFlag(str, &f->strip_path_prefix, "strip_path_prefix"); 101} 102 103extern "C" { 104const char* WEAK __asan_default_options() { return ""; } 105} // extern "C" 106 107void InitializeFlags(Flags *f, const char *env) { 108 internal_memset(f, 0, sizeof(*f)); 109 110 f->quarantine_size = (ASAN_LOW_MEMORY) ? 1UL << 24 : 1UL << 28; 111 f->symbolize = false; 112 f->verbosity = 0; 113 f->redzone = (ASAN_LOW_MEMORY) ? 64 : 128; 114 f->debug = false; 115 f->report_globals = 1; 116 f->malloc_context_size = kMallocContextSize; 117 f->replace_str = true; 118 f->replace_intrin = true; 119 f->replace_cfallocator = true; 120 f->mac_ignore_invalid_free = false; 121 f->use_fake_stack = true; 122 f->max_malloc_fill_size = 0; 123 f->exitcode = ASAN_DEFAULT_FAILURE_EXITCODE; 124 f->allow_user_poisoning = true; 125 f->sleep_before_dying = 0; 126 f->handle_segv = ASAN_NEEDS_SEGV; 127 f->use_sigaltstack = false; 128 f->check_malloc_usable_size = true; 129 f->unmap_shadow_on_exit = false; 130 f->abort_on_error = false; 131 f->atexit = false; 132 f->disable_core = (__WORDSIZE == 64); 133 f->strip_path_prefix = ""; 134 135 // Override from user-specified string. 136 ParseFlagsFromString(f, __asan_default_options()); 137 if (flags()->verbosity) { 138 Report("Using the defaults from __asan_default_options: %s\n", 139 __asan_default_options()); 140 } 141 142 // Override from command line. 143 ParseFlagsFromString(f, env); 144} 145 146// -------------------------- Globals --------------------- {{{1 147int asan_inited; 148bool asan_init_is_running; 149void (*death_callback)(void); 150static void (*error_report_callback)(const char*); 151char *error_message_buffer = 0; 152uptr error_message_buffer_pos = 0; 153uptr error_message_buffer_size = 0; 154 155// -------------------------- Misc ---------------- {{{1 156void ShowStatsAndAbort() { 157 __asan_print_accumulated_stats(); 158 Die(); 159} 160 161static void PrintBytes(const char *before, uptr *a) { 162 u8 *bytes = (u8*)a; 163 uptr byte_num = (__WORDSIZE) / 8; 164 AsanPrintf("%s%p:", before, (void*)a); 165 for (uptr i = 0; i < byte_num; i++) { 166 AsanPrintf(" %x%x", bytes[i] >> 4, bytes[i] & 15); 167 } 168 AsanPrintf("\n"); 169} 170 171void AppendToErrorMessageBuffer(const char *buffer) { 172 if (error_message_buffer) { 173 uptr length = internal_strlen(buffer); 174 CHECK_GE(error_message_buffer_size, error_message_buffer_pos); 175 uptr remaining = error_message_buffer_size - error_message_buffer_pos; 176 internal_strncpy(error_message_buffer + error_message_buffer_pos, 177 buffer, remaining); 178 error_message_buffer[error_message_buffer_size - 1] = '\0'; 179 // FIXME: reallocate the buffer instead of truncating the message. 180 error_message_buffer_pos += remaining > length ? length : remaining; 181 } 182} 183 184// ---------------------- mmap -------------------- {{{1 185// Reserve memory range [beg, end]. 186static void ReserveShadowMemoryRange(uptr beg, uptr end) { 187 CHECK((beg % kPageSize) == 0); 188 CHECK(((end + 1) % kPageSize) == 0); 189 uptr size = end - beg + 1; 190 void *res = MmapFixedNoReserve(beg, size); 191 CHECK(res == (void*)beg && "ReserveShadowMemoryRange failed"); 192} 193 194// ---------------------- LowLevelAllocator ------------- {{{1 195void *LowLevelAllocator::Allocate(uptr size) { 196 CHECK((size & (size - 1)) == 0 && "size must be a power of two"); 197 if (allocated_end_ - allocated_current_ < (sptr)size) { 198 uptr size_to_allocate = Max(size, kPageSize); 199 allocated_current_ = 200 (char*)MmapOrDie(size_to_allocate, __FUNCTION__); 201 allocated_end_ = allocated_current_ + size_to_allocate; 202 PoisonShadow((uptr)allocated_current_, size_to_allocate, 203 kAsanInternalHeapMagic); 204 } 205 CHECK(allocated_end_ - allocated_current_ >= (sptr)size); 206 void *res = allocated_current_; 207 allocated_current_ += size; 208 return res; 209} 210 211// -------------------------- Run-time entry ------------------- {{{1 212// exported functions 213#define ASAN_REPORT_ERROR(type, is_write, size) \ 214extern "C" NOINLINE INTERFACE_ATTRIBUTE \ 215void __asan_report_ ## type ## size(uptr addr); \ 216void __asan_report_ ## type ## size(uptr addr) { \ 217 GET_CALLER_PC_BP_SP; \ 218 __asan_report_error(pc, bp, sp, addr, is_write, size); \ 219} 220 221ASAN_REPORT_ERROR(load, false, 1) 222ASAN_REPORT_ERROR(load, false, 2) 223ASAN_REPORT_ERROR(load, false, 4) 224ASAN_REPORT_ERROR(load, false, 8) 225ASAN_REPORT_ERROR(load, false, 16) 226ASAN_REPORT_ERROR(store, true, 1) 227ASAN_REPORT_ERROR(store, true, 2) 228ASAN_REPORT_ERROR(store, true, 4) 229ASAN_REPORT_ERROR(store, true, 8) 230ASAN_REPORT_ERROR(store, true, 16) 231 232// Force the linker to keep the symbols for various ASan interface functions. 233// We want to keep those in the executable in order to let the instrumented 234// dynamic libraries access the symbol even if it is not used by the executable 235// itself. This should help if the build system is removing dead code at link 236// time. 237static NOINLINE void force_interface_symbols() { 238 volatile int fake_condition = 0; // prevent dead condition elimination. 239 if (fake_condition) { 240 __asan_report_load1(0); 241 __asan_report_load2(0); 242 __asan_report_load4(0); 243 __asan_report_load8(0); 244 __asan_report_load16(0); 245 __asan_report_store1(0); 246 __asan_report_store2(0); 247 __asan_report_store4(0); 248 __asan_report_store8(0); 249 __asan_report_store16(0); 250 __asan_register_global(0, 0, 0); 251 __asan_register_globals(0, 0); 252 __asan_unregister_globals(0, 0); 253 __asan_set_death_callback(0); 254 __asan_set_error_report_callback(0); 255 __asan_handle_no_return(); 256 } 257} 258 259// -------------------------- Init ------------------- {{{1 260static void asan_atexit() { 261 AsanPrintf("AddressSanitizer exit stats:\n"); 262 __asan_print_accumulated_stats(); 263} 264 265} // namespace __asan 266 267// ---------------------- Interface ---------------- {{{1 268using namespace __asan; // NOLINT 269 270int __asan_set_error_exit_code(int exit_code) { 271 int old = flags()->exitcode; 272 flags()->exitcode = exit_code; 273 return old; 274} 275 276void NOINLINE __asan_handle_no_return() { 277 int local_stack; 278 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 279 CHECK(curr_thread); 280 uptr top = curr_thread->stack_top(); 281 uptr bottom = ((uptr)&local_stack - kPageSize) & ~(kPageSize-1); 282 PoisonShadow(bottom, top - bottom, 0); 283} 284 285void NOINLINE __asan_set_death_callback(void (*callback)(void)) { 286 death_callback = callback; 287} 288 289void NOINLINE __asan_set_error_report_callback(void (*callback)(const char*)) { 290 error_report_callback = callback; 291 if (callback) { 292 error_message_buffer_size = 1 << 16; 293 error_message_buffer = 294 (char*)MmapOrDie(error_message_buffer_size, __FUNCTION__); 295 error_message_buffer_pos = 0; 296 } 297} 298 299void __asan_report_error(uptr pc, uptr bp, uptr sp, 300 uptr addr, bool is_write, uptr access_size) { 301 static atomic_uint32_t num_calls; 302 if (atomic_fetch_add(&num_calls, 1, memory_order_relaxed) != 0) { 303 // Do not print more than one report, otherwise they will mix up. 304 // We can not return here because the function is marked as never-return. 305 AsanPrintf("AddressSanitizer: while reporting a bug found another one." 306 "Ignoring.\n"); 307 SleepForSeconds(5); 308 Die(); 309 } 310 311 AsanPrintf("====================================================" 312 "=============\n"); 313 const char *bug_descr = "unknown-crash"; 314 if (AddrIsInMem(addr)) { 315 u8 *shadow_addr = (u8*)MemToShadow(addr); 316 // If we are accessing 16 bytes, look at the second shadow byte. 317 if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY) 318 shadow_addr++; 319 // If we are in the partial right redzone, look at the next shadow byte. 320 if (*shadow_addr > 0 && *shadow_addr < 128) 321 shadow_addr++; 322 switch (*shadow_addr) { 323 case kAsanHeapLeftRedzoneMagic: 324 case kAsanHeapRightRedzoneMagic: 325 bug_descr = "heap-buffer-overflow"; 326 break; 327 case kAsanHeapFreeMagic: 328 bug_descr = "heap-use-after-free"; 329 break; 330 case kAsanStackLeftRedzoneMagic: 331 bug_descr = "stack-buffer-underflow"; 332 break; 333 case kAsanStackMidRedzoneMagic: 334 case kAsanStackRightRedzoneMagic: 335 case kAsanStackPartialRedzoneMagic: 336 bug_descr = "stack-buffer-overflow"; 337 break; 338 case kAsanStackAfterReturnMagic: 339 bug_descr = "stack-use-after-return"; 340 break; 341 case kAsanUserPoisonedMemoryMagic: 342 bug_descr = "use-after-poison"; 343 break; 344 case kAsanGlobalRedzoneMagic: 345 bug_descr = "global-buffer-overflow"; 346 break; 347 } 348 } 349 350 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 351 u32 curr_tid = asanThreadRegistry().GetCurrentTidOrInvalid(); 352 353 if (curr_thread) { 354 // We started reporting an error message. Stop using the fake stack 355 // in case we will call an instrumented function from a symbolizer. 356 curr_thread->fake_stack().StopUsingFakeStack(); 357 } 358 359 AsanReport("ERROR: AddressSanitizer %s on address " 360 "%p at pc 0x%zx bp 0x%zx sp 0x%zx\n", 361 bug_descr, (void*)addr, pc, bp, sp); 362 363 AsanPrintf("%s of size %zu at %p thread T%d\n", 364 access_size ? (is_write ? "WRITE" : "READ") : "ACCESS", 365 access_size, (void*)addr, curr_tid); 366 367 if (flags()->debug) { 368 PrintBytes("PC: ", (uptr*)pc); 369 } 370 371 GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, pc, bp); 372 stack.PrintStack(); 373 374 DescribeAddress(addr, access_size); 375 376 if (AddrIsInMem(addr)) { 377 uptr shadow_addr = MemToShadow(addr); 378 AsanReport("ABORTING\n"); 379 __asan_print_accumulated_stats(); 380 AsanPrintf("Shadow byte and word:\n"); 381 AsanPrintf(" %p: %x\n", (void*)shadow_addr, *(unsigned char*)shadow_addr); 382 uptr aligned_shadow = shadow_addr & ~(kWordSize - 1); 383 PrintBytes(" ", (uptr*)(aligned_shadow)); 384 AsanPrintf("More shadow bytes:\n"); 385 PrintBytes(" ", (uptr*)(aligned_shadow-4*kWordSize)); 386 PrintBytes(" ", (uptr*)(aligned_shadow-3*kWordSize)); 387 PrintBytes(" ", (uptr*)(aligned_shadow-2*kWordSize)); 388 PrintBytes(" ", (uptr*)(aligned_shadow-1*kWordSize)); 389 PrintBytes("=>", (uptr*)(aligned_shadow+0*kWordSize)); 390 PrintBytes(" ", (uptr*)(aligned_shadow+1*kWordSize)); 391 PrintBytes(" ", (uptr*)(aligned_shadow+2*kWordSize)); 392 PrintBytes(" ", (uptr*)(aligned_shadow+3*kWordSize)); 393 PrintBytes(" ", (uptr*)(aligned_shadow+4*kWordSize)); 394 } 395 if (error_report_callback) { 396 error_report_callback(error_message_buffer); 397 } 398 Die(); 399} 400 401 402void __asan_init() { 403 if (asan_inited) return; 404 asan_init_is_running = true; 405 406 // Make sure we are not statically linked. 407 AsanDoesNotSupportStaticLinkage(); 408 409 // Initialize flags. 410 const char *options = GetEnv("ASAN_OPTIONS"); 411 InitializeFlags(flags(), options); 412 413 if (flags()->verbosity && options) { 414 Report("Parsed ASAN_OPTIONS: %s\n", options); 415 } 416 417 if (flags()->atexit) { 418 Atexit(asan_atexit); 419 } 420 421 // interceptors 422 InitializeAsanInterceptors(); 423 424 ReplaceSystemMalloc(); 425 ReplaceOperatorsNewAndDelete(); 426 427 if (flags()->verbosity) { 428 Printf("|| `[%p, %p]` || HighMem ||\n", 429 (void*)kHighMemBeg, (void*)kHighMemEnd); 430 Printf("|| `[%p, %p]` || HighShadow ||\n", 431 (void*)kHighShadowBeg, (void*)kHighShadowEnd); 432 Printf("|| `[%p, %p]` || ShadowGap ||\n", 433 (void*)kShadowGapBeg, (void*)kShadowGapEnd); 434 Printf("|| `[%p, %p]` || LowShadow ||\n", 435 (void*)kLowShadowBeg, (void*)kLowShadowEnd); 436 Printf("|| `[%p, %p]` || LowMem ||\n", 437 (void*)kLowMemBeg, (void*)kLowMemEnd); 438 Printf("MemToShadow(shadow): %p %p %p %p\n", 439 (void*)MEM_TO_SHADOW(kLowShadowBeg), 440 (void*)MEM_TO_SHADOW(kLowShadowEnd), 441 (void*)MEM_TO_SHADOW(kHighShadowBeg), 442 (void*)MEM_TO_SHADOW(kHighShadowEnd)); 443 Printf("red_zone=%zu\n", (uptr)flags()->redzone); 444 Printf("malloc_context_size=%zu\n", (uptr)flags()->malloc_context_size); 445 446 Printf("SHADOW_SCALE: %zx\n", (uptr)SHADOW_SCALE); 447 Printf("SHADOW_GRANULARITY: %zx\n", (uptr)SHADOW_GRANULARITY); 448 Printf("SHADOW_OFFSET: %zx\n", (uptr)SHADOW_OFFSET); 449 CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7); 450 } 451 452 if (flags()->disable_core) { 453 DisableCoreDumper(); 454 } 455 456 uptr shadow_start = kLowShadowBeg; 457 if (kLowShadowBeg > 0) shadow_start -= kMmapGranularity; 458 uptr shadow_end = kHighShadowEnd; 459 if (MemoryRangeIsAvailable(shadow_start, shadow_end)) { 460 if (kLowShadowBeg != kLowShadowEnd) { 461 // mmap the low shadow plus at least one page. 462 ReserveShadowMemoryRange(kLowShadowBeg - kMmapGranularity, kLowShadowEnd); 463 } 464 // mmap the high shadow. 465 ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd); 466 // protect the gap 467 void *prot = Mprotect(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1); 468 CHECK(prot == (void*)kShadowGapBeg); 469 } else { 470 Report("Shadow memory range interleaves with an existing memory mapping. " 471 "ASan cannot proceed correctly. ABORTING.\n"); 472 DumpProcessMap(); 473 Die(); 474 } 475 476 InstallSignalHandlers(); 477 478 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited 479 // should be set to 1 prior to initializing the threads. 480 asan_inited = 1; 481 asan_init_is_running = false; 482 483 asanThreadRegistry().Init(); 484 asanThreadRegistry().GetMain()->ThreadStart(); 485 force_interface_symbols(); // no-op. 486 487 if (flags()->verbosity) { 488 Report("AddressSanitizer Init done\n"); 489 } 490} 491 492#if defined(ASAN_USE_PREINIT_ARRAY) 493 // On Linux, we force __asan_init to be called before anyone else 494 // by placing it into .preinit_array section. 495 // FIXME: do we have anything like this on Mac? 496 __attribute__((section(".preinit_array"))) 497 typeof(__asan_init) *__asan_preinit =__asan_init; 498#elif defined(_WIN32) && defined(_DLL) 499 // On Windows, when using dynamic CRT (/MD), we can put a pointer 500 // to __asan_init into the global list of C initializers. 501 // See crt0dat.c in the CRT sources for the details. 502 #pragma section(".CRT$XIB", long, read) // NOLINT 503 __declspec(allocate(".CRT$XIB")) void (*__asan_preinit)() = __asan_init; 504#endif 505