asan_interface_test.cc revision 4fd95f141f78906570c15a8a3b4cf0a7b50a201d
12a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)//===-- asan_interface_test.cc ------------*- C++ -*-===// 22a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 32a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// The LLVM Compiler Infrastructure 42a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 52a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// This file is distributed under the University of Illinois Open Source 62a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// License. See LICENSE.TXT for details. 72a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 82a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)//===----------------------------------------------------------------------===// 92a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// This file is a part of AddressSanitizer, an address sanity checker. 112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)//===----------------------------------------------------------------------===// 132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include <pthread.h> 142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include <stdio.h> 152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include <string.h> 16d0247b1b59f9c528cb6df88b4f2b9afaf80d181eTorne (Richard Coles) 172a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "asan_test_config.h" 182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "asan_test_utils.h" 192a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "asan_interface.h" 202a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 212a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)TEST(AddressSanitizerInterface, GetEstimatedAllocatedSize) { 222a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(1, __asan_get_estimated_allocated_size(0)); 232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const size_t sizes[] = { 1, 30, 1<<30 }; 242a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (size_t i = 0; i < 3; i++) { 252a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(sizes[i], __asan_get_estimated_allocated_size(sizes[i])); 262a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static const char* kGetAllocatedSizeErrorMsg = 302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) "attempting to call __asan_get_allocated_size()"; 312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)TEST(AddressSanitizerInterface, GetAllocatedSizeAndOwnershipTest) { 332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const size_t kArraySize = 100; 342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) char *array = Ident((char*)malloc(kArraySize)); 352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) int *int_ptr = Ident(new int); 362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 372a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Allocated memory is owned by allocator. Allocated size should be 382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // equal to requested size. 392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(true, __asan_get_ownership(array)); 402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(kArraySize, __asan_get_allocated_size(array)); 412a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(true, __asan_get_ownership(int_ptr)); 422a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(sizeof(int), __asan_get_allocated_size(int_ptr)); 432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 442a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // We cannot call GetAllocatedSize from the memory we didn't map, 452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // and from the interior pointers (not returned by previous malloc). 462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) void *wild_addr = (void*)0x1; 472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(false, __asan_get_ownership(wild_addr)); 482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_DEATH(__asan_get_allocated_size(wild_addr), kGetAllocatedSizeErrorMsg); 492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(false, __asan_get_ownership(array + kArraySize / 2)); 502a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_DEATH(__asan_get_allocated_size(array + kArraySize / 2), 512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) kGetAllocatedSizeErrorMsg); 522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // NULL is a valid argument and is owned. 542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(true, __asan_get_ownership(NULL)); 552a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(0, __asan_get_allocated_size(NULL)); 562a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 572a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // When memory is freed, it's not owned, and call to GetAllocatedSize 582a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // is forbidden. 592a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) free(array); 602a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(false, __asan_get_ownership(array)); 612a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_DEATH(__asan_get_allocated_size(array), kGetAllocatedSizeErrorMsg); 622a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) delete int_ptr; 642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 662a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)TEST(AddressSanitizerInterface, GetCurrentAllocatedBytesTest) { 672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) size_t before_malloc, after_malloc, after_free; 682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) char *array; 692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const size_t kMallocSize = 100; 702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) before_malloc = __asan_get_current_allocated_bytes(); 712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) array = Ident((char*)malloc(kMallocSize)); 732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) after_malloc = __asan_get_current_allocated_bytes(); 742a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(before_malloc + kMallocSize, after_malloc); 752a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 762a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) free(array); 772a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) after_free = __asan_get_current_allocated_bytes(); 782a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(before_malloc, after_free); 792a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 802a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 812a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static void DoDoubleFree() { 822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) int *x = Ident(new int); 832a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) delete Ident(x); 842a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) delete Ident(x); 852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 862a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 872a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// This test is run in a separate process, so that large malloced 882a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// chunk won't remain in the free lists after the test. 892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// Note: use ASSERT_* instead of EXPECT_* here. 902a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static void RunGetHeapSizeTestAndDie() { 912a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) size_t old_heap_size, new_heap_size, heap_growth; 922a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // We unlikely have have chunk of this size in free list. 932a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) static const size_t kLargeMallocSize = 1 << 29; // 512M 942a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) old_heap_size = __asan_get_heap_size(); 952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) fprintf(stderr, "allocating %zu bytes:\n", kLargeMallocSize); 962a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) free(Ident(malloc(kLargeMallocSize))); 972a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) new_heap_size = __asan_get_heap_size(); 982a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) heap_growth = new_heap_size - old_heap_size; 992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) fprintf(stderr, "heap growth after first malloc: %zu\n", heap_growth); 1002a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASSERT_GE(heap_growth, kLargeMallocSize); 1012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASSERT_LE(heap_growth, 2 * kLargeMallocSize); 1022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1032a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Now large chunk should fall into free list, and can be 1042a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // allocated without increasing heap size. 1052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) old_heap_size = new_heap_size; 1062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) free(Ident(malloc(kLargeMallocSize))); 1072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) heap_growth = __asan_get_heap_size() - old_heap_size; 1082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) fprintf(stderr, "heap growth after second malloc: %zu\n", heap_growth); 1092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASSERT_LT(heap_growth, kLargeMallocSize); 1102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Test passed. Now die with expected double-free. 1122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DoDoubleFree(); 1132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)TEST(AddressSanitizerInterface, GetHeapSizeTest) { 1162a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_DEATH(RunGetHeapSizeTestAndDie(), "double-free"); 1172a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1192a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// Note: use ASSERT_* instead of EXPECT_* here. 1202a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static void DoLargeMallocForGetFreeBytesTestAndDie() { 1212a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) size_t old_free_bytes, new_free_bytes; 1222a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) static const size_t kLargeMallocSize = 1 << 29; // 512M 1232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // If we malloc and free a large memory chunk, it will not fall 1242a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // into quarantine and will be available for future requests. 1252a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) old_free_bytes = __asan_get_free_bytes(); 1262a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) fprintf(stderr, "allocating %zu bytes:\n", kLargeMallocSize); 1272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) fprintf(stderr, "free bytes before malloc: %zu\n", old_free_bytes); 1282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) free(Ident(malloc(kLargeMallocSize))); 1292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) new_free_bytes = __asan_get_free_bytes(); 1302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) fprintf(stderr, "free bytes after malloc and free: %zu\n", new_free_bytes); 1312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASSERT_GE(new_free_bytes, old_free_bytes + kLargeMallocSize); 1322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Test passed. 1332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DoDoubleFree(); 1342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)TEST(AddressSanitizerInterface, GetFreeBytesTest) { 1372a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) static const size_t kNumOfChunks = 100; 1382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) static const size_t kChunkSize = 100; 1392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) char *chunks[kNumOfChunks]; 1402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) size_t i; 1412a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) size_t old_free_bytes, new_free_bytes; 1422a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Allocate a small chunk. Now allocator probably has a lot of these 1432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // chunks to fulfill future requests. So, future requests will decrease 1442a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // the number of free bytes. 1452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) chunks[0] = Ident((char*)malloc(kChunkSize)); 1462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) old_free_bytes = __asan_get_free_bytes(); 1472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (i = 1; i < kNumOfChunks; i++) { 1482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) chunks[i] = Ident((char*)malloc(kChunkSize)); 1492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) new_free_bytes = __asan_get_free_bytes(); 1502a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_LT(new_free_bytes, old_free_bytes); 1512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) old_free_bytes = new_free_bytes; 1522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Deleting these chunks will move them to quarantine, number of free 1542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // bytes won't increase. 1552a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (i = 0; i < kNumOfChunks; i++) { 1562a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) free(chunks[i]); 1572a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(old_free_bytes, __asan_get_free_bytes()); 1582a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1592a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_DEATH(DoLargeMallocForGetFreeBytesTestAndDie(), "double-free"); 1602a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1612a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1622a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static const size_t kManyThreadsMallocSizes[] = {5, 1UL<<10, 1UL<<20, 357}; 1632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static const size_t kManyThreadsIterations = 250; 1642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static const size_t kManyThreadsNumThreads = 200; 1652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1662a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void *ManyThreadsWithStatsWorker(void *arg) { 1672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (size_t iter = 0; iter < kManyThreadsIterations; iter++) { 1682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (size_t size_index = 0; size_index < 4; size_index++) { 1692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) free(Ident(malloc(kManyThreadsMallocSizes[size_index]))); 1702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return 0; 1732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1742a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1752a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)TEST(AddressSanitizerInterface, ManyThreadsWithStatsStressTest) { 1762a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) size_t before_test, after_test, i; 1772a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) pthread_t threads[kManyThreadsNumThreads]; 1782a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) before_test = __asan_get_current_allocated_bytes(); 1792a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (i = 0; i < kManyThreadsNumThreads; i++) { 1802a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) pthread_create(&threads[i], 0, 181a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles) (void* (*)(void *x))ManyThreadsWithStatsWorker, (void*)i); 1822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1832a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (i = 0; i < kManyThreadsNumThreads; i++) { 1842a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) pthread_join(threads[i], 0); 1852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1862a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) after_test = __asan_get_current_allocated_bytes(); 1872a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // ASan stats also reflect memory usage of internal ASan RTL structs, 1882a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // so we can't check for equality here. 1892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_LT(after_test, before_test + (1UL<<20)); 190a36e5920737c6adbddd3e43b760e5de8431db6e0Torne (Richard Coles)} 1912a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1922a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)TEST(AddressSanitizerInterface, ExitCode) { 1932a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) int original_exit_code = __asan_set_error_exit_code(7); 1942a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EXIT(DoDoubleFree(), ::testing::ExitedWithCode(7), ""); 1952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(7, __asan_set_error_exit_code(8)); 1962a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EXIT(DoDoubleFree(), ::testing::ExitedWithCode(8), ""); 1972a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EQ(8, __asan_set_error_exit_code(original_exit_code)); 1982a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_EXIT(DoDoubleFree(), 1992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ::testing::ExitedWithCode(original_exit_code), ""); 2002a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static const char* kUseAfterPoisonErrorMessage = "use-after-poison"; 2032a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2042a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#define ACCESS(ptr, offset) Ident(*(ptr + offset)) 2052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#define DIE_ON_ACCESS(ptr, offset) \ 2072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) EXPECT_DEATH(Ident(*(ptr + offset)), kUseAfterPoisonErrorMessage) 2082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2095d1f7b1de12d16ceb2c938c56701a3e8bfa558f7Torne (Richard Coles)TEST(AddressSanitizerInterface, SimplePoisonMemoryRegionTest) { 2102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) char *array = Ident((char*)malloc(120)); 2112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // poison array[40..80) 2122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASAN_POISON_MEMORY_REGION(array + 40, 40); 2132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ACCESS(array, 39); 2142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ACCESS(array, 80); 2152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DIE_ON_ACCESS(array, 40); 2162a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DIE_ON_ACCESS(array, 60); 2172a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DIE_ON_ACCESS(array, 79); 2182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASAN_UNPOISON_MEMORY_REGION(array + 40, 40); 2192a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // access previously poisoned memory. 2202a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ACCESS(array, 40); 2212a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ACCESS(array, 79); 2222a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) free(array); 2232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2242a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2252a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)TEST(AddressSanitizerInterface, OverlappingPoisonMemoryRegionTest) { 2262a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) char *array = Ident((char*)malloc(120)); 2272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Poison [0..40) and [80..120) 2282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASAN_POISON_MEMORY_REGION(array, 40); 2292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASAN_POISON_MEMORY_REGION(array + 80, 40); 2302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DIE_ON_ACCESS(array, 20); 2312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ACCESS(array, 60); 232 DIE_ON_ACCESS(array, 100); 233 // Poison whole array - [0..120) 234 ASAN_POISON_MEMORY_REGION(array, 120); 235 DIE_ON_ACCESS(array, 60); 236 // Unpoison [24..96) 237 ASAN_UNPOISON_MEMORY_REGION(array + 24, 72); 238 DIE_ON_ACCESS(array, 23); 239 ACCESS(array, 24); 240 ACCESS(array, 60); 241 ACCESS(array, 95); 242 DIE_ON_ACCESS(array, 96); 243 free(array); 244} 245 246TEST(AddressSanitizerInterface, PushAndPopWithPoisoningTest) { 247 // Vector of capacity 20 248 char *vec = Ident((char*)malloc(20)); 249 ASAN_POISON_MEMORY_REGION(vec, 20); 250 for (size_t i = 0; i < 7; i++) { 251 // Simulate push_back. 252 ASAN_UNPOISON_MEMORY_REGION(vec + i, 1); 253 ACCESS(vec, i); 254 DIE_ON_ACCESS(vec, i + 1); 255 } 256 for (size_t i = 7; i > 0; i--) { 257 // Simulate pop_back. 258 ASAN_POISON_MEMORY_REGION(vec + i - 1, 1); 259 DIE_ON_ACCESS(vec, i - 1); 260 if (i > 1) ACCESS(vec, i - 2); 261 } 262 free(vec); 263} 264 265// Make sure that each aligned block of size "2^granularity" doesn't have 266// "true" value before "false" value. 267static void MakeShadowValid(bool *shadow, int length, int granularity) { 268 bool can_be_poisoned = true; 269 for (int i = length - 1; i >= 0; i--) { 270 can_be_poisoned &= shadow[i]; 271 shadow[i] &= can_be_poisoned; 272 if (i % (1 << granularity) == 0) { 273 can_be_poisoned = true; 274 } 275 } 276} 277 278TEST(AddressSanitizerInterface, PoisoningStressTest) { 279 const size_t kSize = 24; 280 bool expected[kSize]; 281 char *arr = Ident((char*)malloc(kSize)); 282 for (size_t l1 = 0; l1 < kSize; l1++) { 283 for (size_t s1 = 1; l1 + s1 <= kSize; s1++) { 284 for (size_t l2 = 0; l2 < kSize; l2++) { 285 for (size_t s2 = 1; l2 + s2 <= kSize; s2++) { 286 // Poison [l1, l1+s1), [l2, l2+s2) and check result. 287 ASAN_UNPOISON_MEMORY_REGION(arr, kSize); 288 ASAN_POISON_MEMORY_REGION(arr + l1, s1); 289 ASAN_POISON_MEMORY_REGION(arr + l2, s2); 290 memset(expected, false, kSize); 291 memset(expected + l1, true, s1); 292 MakeShadowValid(expected, 24, /*granularity*/ 3); 293 memset(expected + l2, true, s2); 294 MakeShadowValid(expected, 24, /*granularity*/ 3); 295 for (size_t i = 0; i < kSize; i++) { 296 ASSERT_EQ(expected[i], __asan_address_is_poisoned(arr + i)); 297 } 298 // Unpoison [l1, l1+s1) and [l2, l2+s2) and check result. 299 ASAN_POISON_MEMORY_REGION(arr, kSize); 300 ASAN_UNPOISON_MEMORY_REGION(arr + l1, s1); 301 ASAN_UNPOISON_MEMORY_REGION(arr + l2, s2); 302 memset(expected, true, kSize); 303 memset(expected + l1, false, s1); 304 MakeShadowValid(expected, 24, /*granularity*/ 3); 305 memset(expected + l2, false, s2); 306 MakeShadowValid(expected, 24, /*granularity*/ 3); 307 for (size_t i = 0; i < kSize; i++) { 308 ASSERT_EQ(expected[i], __asan_address_is_poisoned(arr + i)); 309 } 310 } 311 } 312 } 313 } 314} 315 316static const char *kInvalidPoisonMessage = "invalid-poison-memory-range"; 317static const char *kInvalidUnpoisonMessage = "invalid-unpoison-memory-range"; 318 319TEST(AddressSanitizerInterface, DISABLED_InvalidPoisonAndUnpoisonCallsTest) { 320 char *array = Ident((char*)malloc(120)); 321 ASAN_UNPOISON_MEMORY_REGION(array, 120); 322 // Try to unpoison not owned memory 323 EXPECT_DEATH(ASAN_UNPOISON_MEMORY_REGION(array, 121), 324 kInvalidUnpoisonMessage); 325 EXPECT_DEATH(ASAN_UNPOISON_MEMORY_REGION(array - 1, 120), 326 kInvalidUnpoisonMessage); 327 328 ASAN_POISON_MEMORY_REGION(array, 120); 329 // Try to poison not owned memory. 330 EXPECT_DEATH(ASAN_POISON_MEMORY_REGION(array, 121), kInvalidPoisonMessage); 331 EXPECT_DEATH(ASAN_POISON_MEMORY_REGION(array - 1, 120), 332 kInvalidPoisonMessage); 333 free(array); 334} 335