1//===-- asan_malloc_mac.cc ------------------------------------------------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12// Mac-specific malloc interception.
13//===----------------------------------------------------------------------===//
14
15#include "sanitizer_common/sanitizer_platform.h"
16#if SANITIZER_MAC
17
18#include <AvailabilityMacros.h>
19#include <CoreFoundation/CFBase.h>
20#include <dlfcn.h>
21#include <malloc/malloc.h>
22#include <sys/mman.h>
23
24#include "asan_allocator.h"
25#include "asan_interceptors.h"
26#include "asan_internal.h"
27#include "asan_report.h"
28#include "asan_stack.h"
29#include "asan_stats.h"
30#include "sanitizer_common/sanitizer_mac.h"
31
32// Similar code is used in Google Perftools,
33// http://code.google.com/p/google-perftools.
34
35// ---------------------- Replacement functions ---------------- {{{1
36using namespace __asan;  // NOLINT
37
38// TODO(glider): do we need both zones?
39static malloc_zone_t *system_malloc_zone = 0;
40static malloc_zone_t asan_zone;
41
42INTERCEPTOR(malloc_zone_t *, malloc_create_zone,
43                             vm_size_t start_size, unsigned zone_flags) {
44  ENSURE_ASAN_INITED();
45  GET_STACK_TRACE_MALLOC;
46  uptr page_size = GetPageSizeCached();
47  uptr allocated_size = RoundUpTo(sizeof(asan_zone), page_size);
48  malloc_zone_t *new_zone =
49      (malloc_zone_t*)asan_memalign(page_size, allocated_size,
50                                    &stack, FROM_MALLOC);
51  internal_memcpy(new_zone, &asan_zone, sizeof(asan_zone));
52  new_zone->zone_name = NULL;  // The name will be changed anyway.
53  if (GetMacosVersion() >= MACOS_VERSION_LION) {
54    // Prevent the client app from overwriting the zone contents.
55    // Library functions that need to modify the zone will set PROT_WRITE on it.
56    // This matches the behavior of malloc_create_zone() on OSX 10.7 and higher.
57    mprotect(new_zone, allocated_size, PROT_READ);
58  }
59  return new_zone;
60}
61
62INTERCEPTOR(malloc_zone_t *, malloc_default_zone, void) {
63  ENSURE_ASAN_INITED();
64  return &asan_zone;
65}
66
67INTERCEPTOR(malloc_zone_t *, malloc_default_purgeable_zone, void) {
68  // FIXME: ASan should support purgeable allocations.
69  // https://code.google.com/p/address-sanitizer/issues/detail?id=139
70  ENSURE_ASAN_INITED();
71  return &asan_zone;
72}
73
74INTERCEPTOR(void, malloc_make_purgeable, void *ptr) {
75  // FIXME: ASan should support purgeable allocations. Ignoring them is fine
76  // for now.
77  ENSURE_ASAN_INITED();
78}
79
80INTERCEPTOR(int, malloc_make_nonpurgeable, void *ptr) {
81  // FIXME: ASan should support purgeable allocations. Ignoring them is fine
82  // for now.
83  ENSURE_ASAN_INITED();
84  // Must return 0 if the contents were not purged since the last call to
85  // malloc_make_purgeable().
86  return 0;
87}
88
89INTERCEPTOR(void, malloc_set_zone_name, malloc_zone_t *zone, const char *name) {
90  ENSURE_ASAN_INITED();
91  // Allocate |strlen("asan-") + 1 + internal_strlen(name)| bytes.
92  size_t buflen = 6 + (name ? internal_strlen(name) : 0);
93  InternalScopedBuffer<char> new_name(buflen);
94  if (name && zone->introspect == asan_zone.introspect) {
95    internal_snprintf(new_name.data(), buflen, "asan-%s", name);
96    name = new_name.data();
97  }
98
99  // Call the system malloc's implementation for both external and our zones,
100  // since that appropriately changes VM region protections on the zone.
101  REAL(malloc_set_zone_name)(zone, name);
102}
103
104INTERCEPTOR(void *, malloc, size_t size) {
105  ENSURE_ASAN_INITED();
106  GET_STACK_TRACE_MALLOC;
107  void *res = asan_malloc(size, &stack);
108  return res;
109}
110
111INTERCEPTOR(void, free, void *ptr) {
112  ENSURE_ASAN_INITED();
113  if (!ptr) return;
114  GET_STACK_TRACE_FREE;
115  asan_free(ptr, &stack, FROM_MALLOC);
116}
117
118INTERCEPTOR(void *, realloc, void *ptr, size_t size) {
119  ENSURE_ASAN_INITED();
120  GET_STACK_TRACE_MALLOC;
121  return asan_realloc(ptr, size, &stack);
122}
123
124INTERCEPTOR(void *, calloc, size_t nmemb, size_t size) {
125  ENSURE_ASAN_INITED();
126  GET_STACK_TRACE_MALLOC;
127  return asan_calloc(nmemb, size, &stack);
128}
129
130INTERCEPTOR(void *, valloc, size_t size) {
131  ENSURE_ASAN_INITED();
132  GET_STACK_TRACE_MALLOC;
133  return asan_memalign(GetPageSizeCached(), size, &stack, FROM_MALLOC);
134}
135
136INTERCEPTOR(size_t, malloc_good_size, size_t size) {
137  ENSURE_ASAN_INITED();
138  return asan_zone.introspect->good_size(&asan_zone, size);
139}
140
141INTERCEPTOR(int, posix_memalign, void **memptr, size_t alignment, size_t size) {
142  ENSURE_ASAN_INITED();
143  CHECK(memptr);
144  GET_STACK_TRACE_MALLOC;
145  void *result = asan_memalign(alignment, size, &stack, FROM_MALLOC);
146  if (result) {
147    *memptr = result;
148    return 0;
149  }
150  return -1;
151}
152
153namespace {
154
155// TODO(glider): the mz_* functions should be united with the Linux wrappers,
156// as they are basically copied from there.
157size_t mz_size(malloc_zone_t* zone, const void* ptr) {
158  return asan_mz_size(ptr);
159}
160
161void *mz_malloc(malloc_zone_t *zone, size_t size) {
162  if (UNLIKELY(!asan_inited)) {
163    CHECK(system_malloc_zone);
164    return malloc_zone_malloc(system_malloc_zone, size);
165  }
166  GET_STACK_TRACE_MALLOC;
167  return asan_malloc(size, &stack);
168}
169
170void *mz_calloc(malloc_zone_t *zone, size_t nmemb, size_t size) {
171  if (UNLIKELY(!asan_inited)) {
172    // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym.
173    const size_t kCallocPoolSize = 1024;
174    static uptr calloc_memory_for_dlsym[kCallocPoolSize];
175    static size_t allocated;
176    size_t size_in_words = ((nmemb * size) + kWordSize - 1) / kWordSize;
177    void *mem = (void*)&calloc_memory_for_dlsym[allocated];
178    allocated += size_in_words;
179    CHECK(allocated < kCallocPoolSize);
180    return mem;
181  }
182  GET_STACK_TRACE_MALLOC;
183  return asan_calloc(nmemb, size, &stack);
184}
185
186void *mz_valloc(malloc_zone_t *zone, size_t size) {
187  if (UNLIKELY(!asan_inited)) {
188    CHECK(system_malloc_zone);
189    return malloc_zone_valloc(system_malloc_zone, size);
190  }
191  GET_STACK_TRACE_MALLOC;
192  return asan_memalign(GetPageSizeCached(), size, &stack, FROM_MALLOC);
193}
194
195#define GET_ZONE_FOR_PTR(ptr) \
196  malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); \
197  const char *zone_name = (zone_ptr == 0) ? 0 : zone_ptr->zone_name
198
199void ALWAYS_INLINE free_common(void *context, void *ptr) {
200  if (!ptr) return;
201  GET_STACK_TRACE_FREE;
202  // FIXME: need to retire this flag.
203  if (!flags()->mac_ignore_invalid_free) {
204    asan_free(ptr, &stack, FROM_MALLOC);
205  } else {
206    GET_ZONE_FOR_PTR(ptr);
207    WarnMacFreeUnallocated((uptr)ptr, (uptr)zone_ptr, zone_name, &stack);
208    return;
209  }
210}
211
212// TODO(glider): the allocation callbacks need to be refactored.
213void mz_free(malloc_zone_t *zone, void *ptr) {
214  free_common(zone, ptr);
215}
216
217void *mz_realloc(malloc_zone_t *zone, void *ptr, size_t size) {
218  if (!ptr) {
219    GET_STACK_TRACE_MALLOC;
220    return asan_malloc(size, &stack);
221  } else {
222    if (asan_mz_size(ptr)) {
223      GET_STACK_TRACE_MALLOC;
224      return asan_realloc(ptr, size, &stack);
225    } else {
226      // We can't recover from reallocating an unknown address, because
227      // this would require reading at most |size| bytes from
228      // potentially unaccessible memory.
229      GET_STACK_TRACE_FREE;
230      GET_ZONE_FOR_PTR(ptr);
231      ReportMacMzReallocUnknown((uptr)ptr, (uptr)zone_ptr, zone_name, &stack);
232    }
233  }
234}
235
236void mz_destroy(malloc_zone_t* zone) {
237  // A no-op -- we will not be destroyed!
238  Report("mz_destroy() called -- ignoring\n");
239}
240
241  // from AvailabilityMacros.h
242#if defined(MAC_OS_X_VERSION_10_6) && \
243    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
244void *mz_memalign(malloc_zone_t *zone, size_t align, size_t size) {
245  if (UNLIKELY(!asan_inited)) {
246    CHECK(system_malloc_zone);
247    return malloc_zone_memalign(system_malloc_zone, align, size);
248  }
249  GET_STACK_TRACE_MALLOC;
250  return asan_memalign(align, size, &stack, FROM_MALLOC);
251}
252
253// This function is currently unused, and we build with -Werror.
254#if 0
255void mz_free_definite_size(malloc_zone_t* zone, void *ptr, size_t size) {
256  // TODO(glider): check that |size| is valid.
257  UNIMPLEMENTED();
258}
259#endif
260#endif
261
262kern_return_t mi_enumerator(task_t task, void *,
263                            unsigned type_mask, vm_address_t zone_address,
264                            memory_reader_t reader,
265                            vm_range_recorder_t recorder) {
266  // Should enumerate all the pointers we have.  Seems like a lot of work.
267  return KERN_FAILURE;
268}
269
270size_t mi_good_size(malloc_zone_t *zone, size_t size) {
271  // I think it's always safe to return size, but we maybe could do better.
272  return size;
273}
274
275boolean_t mi_check(malloc_zone_t *zone) {
276  UNIMPLEMENTED();
277}
278
279void mi_print(malloc_zone_t *zone, boolean_t verbose) {
280  UNIMPLEMENTED();
281}
282
283void mi_log(malloc_zone_t *zone, void *address) {
284  // I don't think we support anything like this
285}
286
287void mi_force_lock(malloc_zone_t *zone) {
288  asan_mz_force_lock();
289}
290
291void mi_force_unlock(malloc_zone_t *zone) {
292  asan_mz_force_unlock();
293}
294
295void mi_statistics(malloc_zone_t *zone, malloc_statistics_t *stats) {
296  AsanMallocStats malloc_stats;
297  FillMallocStatistics(&malloc_stats);
298  CHECK(sizeof(malloc_statistics_t) == sizeof(AsanMallocStats));
299  internal_memcpy(stats, &malloc_stats, sizeof(malloc_statistics_t));
300}
301
302#if defined(MAC_OS_X_VERSION_10_6) && \
303    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
304boolean_t mi_zone_locked(malloc_zone_t *zone) {
305  // UNIMPLEMENTED();
306  return false;
307}
308#endif
309
310}  // unnamed namespace
311
312namespace __asan {
313
314void ReplaceSystemMalloc() {
315  static malloc_introspection_t asan_introspection;
316  // Ok to use internal_memset, these places are not performance-critical.
317  internal_memset(&asan_introspection, 0, sizeof(asan_introspection));
318
319  asan_introspection.enumerator = &mi_enumerator;
320  asan_introspection.good_size = &mi_good_size;
321  asan_introspection.check = &mi_check;
322  asan_introspection.print = &mi_print;
323  asan_introspection.log = &mi_log;
324  asan_introspection.force_lock = &mi_force_lock;
325  asan_introspection.force_unlock = &mi_force_unlock;
326  asan_introspection.statistics = &mi_statistics;
327
328  internal_memset(&asan_zone, 0, sizeof(malloc_zone_t));
329
330  // Start with a version 4 zone which is used for OS X 10.4 and 10.5.
331  asan_zone.version = 4;
332  asan_zone.zone_name = "asan";
333  asan_zone.size = &mz_size;
334  asan_zone.malloc = &mz_malloc;
335  asan_zone.calloc = &mz_calloc;
336  asan_zone.valloc = &mz_valloc;
337  asan_zone.free = &mz_free;
338  asan_zone.realloc = &mz_realloc;
339  asan_zone.destroy = &mz_destroy;
340  asan_zone.batch_malloc = 0;
341  asan_zone.batch_free = 0;
342  asan_zone.introspect = &asan_introspection;
343
344  // from AvailabilityMacros.h
345#if defined(MAC_OS_X_VERSION_10_6) && \
346    MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
347  // Switch to version 6 on OSX 10.6 to support memalign.
348  asan_zone.version = 6;
349  asan_zone.free_definite_size = 0;
350  asan_zone.memalign = &mz_memalign;
351  asan_introspection.zone_locked = &mi_zone_locked;
352#endif
353
354  // Register the ASan zone.
355  malloc_zone_register(&asan_zone);
356}
357}  // namespace __asan
358
359#endif  // SANITIZER_MAC
360