asan_rtl.cc revision 1e172b4bdec57329bf904f063a29f99cddf2d85f 
1//===-- asan_rtl.cc ---------------------------------------------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12// Main file of the ASan run-time library.
13//===----------------------------------------------------------------------===//
14#include "asan_allocator.h"
15#include "asan_interceptors.h"
16#include "asan_interface.h"
17#include "asan_internal.h"
18#include "asan_lock.h"
19#ifdef __APPLE__
20#include "asan_mac.h"
21#endif
22#include "asan_mapping.h"
23#include "asan_stack.h"
24#include "asan_stats.h"
25#include "asan_thread.h"
26#include "asan_thread_registry.h"
27
28#include <algorithm>
29#include <map>
30#include <dlfcn.h>
31#include <execinfo.h>
32#include <fcntl.h>
33#include <pthread.h>
34#include <signal.h>
35#include <stdarg.h>
36#include <stdint.h>
37#include <stdio.h>
38#include <stdlib.h>
39#include <string.h>
40#include <sys/mman.h>
41#include <sys/stat.h>
42#include <sys/types.h>
43#include <sys/ucontext.h>
44#include <sys/time.h>
45#include <sys/resource.h>
46#include <unistd.h>
47// must not include <setjmp.h> on Linux
48
49#ifndef ASAN_NEEDS_SEGV
50# define ASAN_NEEDS_SEGV 1
51#endif
52
53namespace __asan {
54
55// -------------------------- Flags ------------------------- {{{1
56static const size_t kMallocContextSize = 30;
57static int    FLAG_atexit;
58bool   FLAG_fast_unwind = true;
59
60size_t FLAG_redzone;  // power of two, >= 32
61bool   FLAG_mt;  // set to 0 if you have only one thread.
62size_t FLAG_quarantine_size;
63int    FLAG_demangle;
64bool   FLAG_symbolize;
65int    FLAG_v;
66int    FLAG_debug;
67bool   FLAG_poison_shadow;
68int    FLAG_report_globals;
69size_t FLAG_malloc_context_size = kMallocContextSize;
70uintptr_t FLAG_large_malloc;
71bool   FLAG_lazy_shadow;
72bool   FLAG_handle_segv;
73bool   FLAG_handle_sigill;
74bool   FLAG_replace_str;
75bool   FLAG_replace_intrin;
76bool   FLAG_replace_cfallocator;  // Used on Mac only.
77bool   FLAG_stats;
78size_t FLAG_max_malloc_fill_size = 0;
79bool   FLAG_use_fake_stack;
80int    FLAG_exitcode = EXIT_FAILURE;
81bool   FLAG_allow_user_poisoning;
82
83// -------------------------- Globals --------------------- {{{1
84int asan_inited;
85bool asan_init_is_running;
86
87// -------------------------- Interceptors ---------------- {{{1
88typedef int (*sigaction_f)(int signum, const struct sigaction *act,
89                           struct sigaction *oldact);
90typedef sig_t (*signal_f)(int signum, sig_t handler);
91typedef void (*longjmp_f)(void *env, int val);
92typedef longjmp_f _longjmp_f;
93typedef longjmp_f siglongjmp_f;
94typedef void (*__cxa_throw_f)(void *, void *, void *);
95typedef int (*pthread_create_f)(pthread_t *thread, const pthread_attr_t *attr,
96                                void *(*start_routine) (void *), void *arg);
97#ifdef __APPLE__
98dispatch_async_f_f real_dispatch_async_f;
99dispatch_sync_f_f real_dispatch_sync_f;
100dispatch_after_f_f real_dispatch_after_f;
101dispatch_barrier_async_f_f real_dispatch_barrier_async_f;
102dispatch_group_async_f_f real_dispatch_group_async_f;
103pthread_workqueue_additem_np_f real_pthread_workqueue_additem_np;
104#endif
105
106sigaction_f             real_sigaction;
107signal_f                real_signal;
108longjmp_f               real_longjmp;
109_longjmp_f              real__longjmp;
110siglongjmp_f            real_siglongjmp;
111__cxa_throw_f           real___cxa_throw;
112pthread_create_f        real_pthread_create;
113
114// -------------------------- Misc ---------------- {{{1
115void ShowStatsAndAbort() {
116  __asan_print_accumulated_stats();
117  ASAN_DIE;
118}
119
120static void PrintBytes(const char *before, uintptr_t *a) {
121  uint8_t *bytes = (uint8_t*)a;
122  size_t byte_num = (__WORDSIZE) / 8;
123  Printf("%s%p:", before, (uintptr_t)a);
124  for (size_t i = 0; i < byte_num; i++) {
125    Printf(" %lx%lx", bytes[i] >> 4, bytes[i] & 15);
126  }
127  Printf("\n");
128}
129
130// ---------------------- Thread ------------------------- {{{1
131static void *asan_thread_start(void *arg) {
132  AsanThread *t= (AsanThread*)arg;
133  asanThreadRegistry().SetCurrent(t);
134  return t->ThreadStart();
135}
136
137// ---------------------- mmap -------------------- {{{1
138static void OutOfMemoryMessage(const char *mem_type, size_t size) {
139  Report("ERROR: AddressSanitizer failed to allocate "
140         "0x%lx (%ld) bytes of %s\n",
141         size, size, mem_type);
142}
143
144static char *mmap_pages(size_t start_page, size_t n_pages, const char *mem_type,
145                        bool abort_on_failure = true) {
146  void *res = asan_mmap((void*)start_page, kPageSize * n_pages,
147                   PROT_READ | PROT_WRITE,
148                   MAP_PRIVATE | MAP_ANON | MAP_FIXED | MAP_NORESERVE, 0, 0);
149  // Printf("%p => %p\n", (void*)start_page, res);
150  char *ch = (char*)res;
151  if (res == (void*)-1L && abort_on_failure) {
152    OutOfMemoryMessage(mem_type, n_pages * kPageSize);
153    ShowStatsAndAbort();
154  }
155  CHECK(res == (void*)start_page || res == (void*)-1L);
156  return ch;
157}
158
159// mmap range [beg, end]
160static char *mmap_range(uintptr_t beg, uintptr_t end, const char *mem_type) {
161  CHECK((beg % kPageSize) == 0);
162  CHECK(((end + 1) % kPageSize) == 0);
163  // Printf("mmap_range %p %p %ld\n", beg, end, (end - beg) / kPageSize);
164  return mmap_pages(beg, (end - beg + 1) / kPageSize, mem_type);
165}
166
167// protect range [beg, end]
168static void protect_range(uintptr_t beg, uintptr_t end) {
169  CHECK((beg % kPageSize) == 0);
170  CHECK(((end+1) % kPageSize) == 0);
171  // Printf("protect_range %p %p %ld\n", beg, end, (end - beg) / kPageSize);
172  void *res = asan_mmap((void*)beg, end - beg + 1,
173                   PROT_NONE,
174                   MAP_PRIVATE | MAP_ANON | MAP_FIXED | MAP_NORESERVE, 0, 0);
175  CHECK(res == (void*)beg);
176}
177
178// ---------------------- DescribeAddress -------------------- {{{1
179static bool DescribeStackAddress(uintptr_t addr, uintptr_t access_size) {
180  AsanThread *t = asanThreadRegistry().FindThreadByStackAddress(addr);
181  if (!t) return false;
182  const intptr_t kBufSize = 4095;
183  char buf[kBufSize];
184  uintptr_t offset = 0;
185  const char *frame_descr = t->GetFrameNameByAddr(addr, &offset);
186  // This string is created by the compiler and has the following form:
187  // "FunctioName n alloc_1 alloc_2 ... alloc_n"
188  // where alloc_i looks like "offset size len ObjectName ".
189  CHECK(frame_descr);
190  // Report the function name and the offset.
191  const char *name_end = real_strchr(frame_descr, ' ');
192  CHECK(name_end);
193  buf[0] = 0;
194  strncat(buf, frame_descr,
195          std::min(kBufSize, static_cast<intptr_t>(name_end - frame_descr)));
196  Printf("Address %p is located at offset %ld "
197         "in frame <%s> of T%d's stack:\n",
198         addr, offset, buf, t->tid());
199  // Report the number of stack objects.
200  char *p;
201  size_t n_objects = strtol(name_end, &p, 10);
202  CHECK(n_objects > 0);
203  Printf("  This frame has %ld object(s):\n", n_objects);
204  // Report all objects in this frame.
205  for (size_t i = 0; i < n_objects; i++) {
206    size_t beg, size;
207    intptr_t len;
208    beg  = strtol(p, &p, 10);
209    size = strtol(p, &p, 10);
210    len  = strtol(p, &p, 10);
211    if (beg <= 0 || size <= 0 || len < 0 || *p != ' ') {
212      Printf("AddressSanitizer can't parse the stack frame descriptor: |%s|\n",
213             frame_descr);
214      break;
215    }
216    p++;
217    buf[0] = 0;
218    strncat(buf, p, std::min(kBufSize, len));
219    p += len;
220    Printf("    [%ld, %ld) '%s'\n", beg, beg + size, buf);
221  }
222  Printf("HINT: this may be a false positive if your program uses "
223         "some custom stack unwind mechanism\n"
224         "      (longjmp and C++ exceptions *are* supported)\n");
225  t->summary()->Announce();
226  return true;
227}
228
229__attribute__((noinline))
230static void DescribeAddress(uintptr_t addr, uintptr_t access_size) {
231  // Check if this is a global.
232  if (DescribeAddrIfGlobal(addr))
233    return;
234
235  if (DescribeStackAddress(addr, access_size))
236    return;
237
238  // finally, check if this is a heap.
239  DescribeHeapAddress(addr, access_size);
240}
241
242// -------------------------- Run-time entry ------------------- {{{1
243void GetPcSpBpAx(void *context,
244                 uintptr_t *pc, uintptr_t *sp, uintptr_t *bp, uintptr_t *ax) {
245  ucontext_t *ucontext = (ucontext_t*)context;
246#ifdef __APPLE__
247# if __WORDSIZE == 64
248  *pc = ucontext->uc_mcontext->__ss.__rip;
249  *bp = ucontext->uc_mcontext->__ss.__rbp;
250  *sp = ucontext->uc_mcontext->__ss.__rsp;
251  *ax = ucontext->uc_mcontext->__ss.__rax;
252# else
253  *pc = ucontext->uc_mcontext->__ss.__eip;
254  *bp = ucontext->uc_mcontext->__ss.__ebp;
255  *sp = ucontext->uc_mcontext->__ss.__esp;
256  *ax = ucontext->uc_mcontext->__ss.__eax;
257# endif  // __WORDSIZE
258#else  // assume linux
259# if defined(__arm__)
260  *pc = ucontext->uc_mcontext.arm_pc;
261  *bp = ucontext->uc_mcontext.arm_fp;
262  *sp = ucontext->uc_mcontext.arm_sp;
263  *ax = ucontext->uc_mcontext.arm_r0;
264# elif __WORDSIZE == 64
265  *pc = ucontext->uc_mcontext.gregs[REG_RIP];
266  *bp = ucontext->uc_mcontext.gregs[REG_RBP];
267  *sp = ucontext->uc_mcontext.gregs[REG_RSP];
268  *ax = ucontext->uc_mcontext.gregs[REG_RAX];
269# else
270  *pc = ucontext->uc_mcontext.gregs[REG_EIP];
271  *bp = ucontext->uc_mcontext.gregs[REG_EBP];
272  *sp = ucontext->uc_mcontext.gregs[REG_ESP];
273  *ax = ucontext->uc_mcontext.gregs[REG_EAX];
274# endif  // __WORDSIZE
275#endif
276}
277
278static void     ASAN_OnSIGSEGV(int, siginfo_t *siginfo, void *context) {
279  uintptr_t addr = (uintptr_t)siginfo->si_addr;
280  if (AddrIsInShadow(addr) && FLAG_lazy_shadow) {
281    // We traped on access to a shadow address. Just map a large chunk around
282    // this address.
283    const uintptr_t chunk_size = kPageSize << 10;  // 4M
284    uintptr_t chunk = addr & ~(chunk_size - 1);
285    asan_mmap((void*)chunk, chunk_size,
286                   PROT_READ | PROT_WRITE,
287                   MAP_PRIVATE | MAP_ANON | MAP_FIXED, 0, 0);
288    return;
289  }
290  // Write the first message using the bullet-proof write.
291  if (13 != asan_write(2, "ASAN:SIGSEGV\n", 13)) ASAN_DIE;
292  uintptr_t pc, sp, bp, ax;
293  GetPcSpBpAx(context, &pc, &sp, &bp, &ax);
294  Report("ERROR: AddressSanitizer crashed on unknown address %p"
295         " (pc %p sp %p bp %p ax %p T%d)\n",
296         addr, pc, sp, bp, ax,
297         asanThreadRegistry().GetCurrentTidOrMinusOne());
298  Printf("AddressSanitizer can not provide additional info. ABORTING\n");
299  GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, false, pc, bp);
300  stack.PrintStack();
301  ShowStatsAndAbort();
302}
303
304static void     ASAN_OnSIGILL(int, siginfo_t *siginfo, void *context) {
305  // Write the first message using the bullet-proof write.
306  if (12 != asan_write(2, "ASAN:SIGILL\n", 12)) ASAN_DIE;
307  uintptr_t pc, sp, bp, ax;
308  GetPcSpBpAx(context, &pc, &sp, &bp, &ax);
309
310  uintptr_t addr = ax;
311
312  uint8_t *insn = (uint8_t*)pc;
313  CHECK(insn[0] == 0x0f && insn[1] == 0x0b);  // ud2
314  unsigned access_size_and_type = insn[2] - 0x50;
315  CHECK(access_size_and_type < 16);
316  bool is_write = access_size_and_type & 8;
317  int access_size = 1 << (access_size_and_type & 7);
318  __asan_report_error(pc, bp, sp, addr, is_write, access_size);
319}
320
321// exported functions
322#define ASAN_REPORT_ERROR(type, is_write, size) \
323extern "C" void __asan_report_ ## type ## size(uintptr_t addr)   \
324  __attribute__((visibility("default")));                        \
325extern "C" void __asan_report_ ## type ## size(uintptr_t addr) { \
326  GET_BP_PC_SP;                                                  \
327  __asan_report_error(pc, bp, sp, addr, is_write, size);  \
328}
329
330ASAN_REPORT_ERROR(load, false, 1)
331ASAN_REPORT_ERROR(load, false, 2)
332ASAN_REPORT_ERROR(load, false, 4)
333ASAN_REPORT_ERROR(load, false, 8)
334ASAN_REPORT_ERROR(load, false, 16)
335ASAN_REPORT_ERROR(store, true, 1)
336ASAN_REPORT_ERROR(store, true, 2)
337ASAN_REPORT_ERROR(store, true, 4)
338ASAN_REPORT_ERROR(store, true, 8)
339ASAN_REPORT_ERROR(store, true, 16)
340
341// Force the linker to keep the symbols for various ASan interface functions.
342// We want to keep those in the executable in order to let the instrumented
343// dynamic libraries access the symbol even if it is not used by the executable
344// itself. This should help if the build system is removing dead code at link
345// time.
346extern "C"
347void __asan_force_interface_symbols() {
348  volatile int fake_condition = 0;  // prevent dead condition elimination.
349  if (fake_condition) {
350    __asan_report_load1(NULL);
351    __asan_report_load2(NULL);
352    __asan_report_load4(NULL);
353    __asan_report_load8(NULL);
354    __asan_report_load16(NULL);
355    __asan_report_store1(NULL);
356    __asan_report_store2(NULL);
357    __asan_report_store4(NULL);
358    __asan_report_store8(NULL);
359    __asan_report_store16(NULL);
360    __asan_register_global(0, 0, NULL);
361    __asan_register_globals(NULL, 0);
362  }
363}
364
365// -------------------------- Init ------------------- {{{1
366static int64_t IntFlagValue(const char *flags, const char *flag,
367                            int64_t default_val) {
368  if (!flags) return default_val;
369  const char *str = strstr(flags, flag);
370  if (!str) return default_val;
371  return atoll(str + internal_strlen(flag));
372}
373
374static void asan_atexit() {
375  Printf("AddressSanitizer exit stats:\n");
376  __asan_print_accumulated_stats();
377}
378
379void CheckFailed(const char *cond, const char *file, int line) {
380  Report("CHECK failed: %s at %s:%d, pthread_self=%p\n",
381         cond, file, line, pthread_self());
382  PRINT_CURRENT_STACK();
383  ShowStatsAndAbort();
384}
385
386}  // namespace __asan
387
388// -------------------------- Interceptors ------------------- {{{1
389using namespace __asan;  // NOLINT
390
391#define OPERATOR_NEW_BODY \
392  GET_STACK_TRACE_HERE_FOR_MALLOC;\
393  return asan_memalign(0, size, &stack);
394
395void *operator new(size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; }
396void *operator new[](size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; }
397void *operator new(size_t size, std::nothrow_t const&) throw()
398{ OPERATOR_NEW_BODY; }
399void *operator new[](size_t size, std::nothrow_t const&) throw()
400{ OPERATOR_NEW_BODY; }
401
402#define OPERATOR_DELETE_BODY \
403  GET_STACK_TRACE_HERE_FOR_FREE(ptr);\
404  asan_free(ptr, &stack);
405
406void operator delete(void *ptr) throw() { OPERATOR_DELETE_BODY; }
407void operator delete[](void *ptr) throw() { OPERATOR_DELETE_BODY; }
408void operator delete(void *ptr, std::nothrow_t const&) throw()
409{ OPERATOR_DELETE_BODY; }
410void operator delete[](void *ptr, std::nothrow_t const&) throw()
411{ OPERATOR_DELETE_BODY;}
412
413extern "C"
414#ifndef __APPLE__
415__attribute__((visibility("default")))
416#endif
417int WRAP(pthread_create)(pthread_t *thread, const pthread_attr_t *attr,
418                         void *(*start_routine) (void *), void *arg) {
419  GET_STACK_TRACE_HERE(kStackTraceMax, /*fast_unwind*/false);
420  AsanThread *t = (AsanThread*)asan_malloc(sizeof(AsanThread), &stack);
421  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
422  CHECK(curr_thread || asanThreadRegistry().IsCurrentThreadDying());
423  new(t) AsanThread(asanThreadRegistry().GetCurrentTidOrMinusOne(),
424                    start_routine, arg, &stack);
425  return real_pthread_create(thread, attr, asan_thread_start, t);
426}
427
428static bool MySignal(int signum) {
429  if (FLAG_handle_sigill && signum == SIGILL) return true;
430  if (FLAG_handle_segv && signum == SIGSEGV) return true;
431#ifdef __APPLE__
432  if (FLAG_handle_segv && signum == SIGBUS) return true;
433#endif
434  return false;
435}
436
437static void MaybeInstallSigaction(int signum,
438                                  void (*handler)(int, siginfo_t *, void *)) {
439  if (!MySignal(signum))
440    return;
441  struct sigaction sigact;
442  real_memset(&sigact, 0, sizeof(sigact));
443  sigact.sa_sigaction = handler;
444  sigact.sa_flags = SA_SIGINFO;
445  CHECK(0 == real_sigaction(signum, &sigact, 0));
446}
447
448extern "C"
449sig_t WRAP(signal)(int signum, sig_t handler) {
450  if (!MySignal(signum)) {
451    return real_signal(signum, handler);
452  }
453  return NULL;
454}
455
456extern "C"
457int WRAP(sigaction)(int signum, const struct sigaction *act,
458                    struct sigaction *oldact) {
459  if (!MySignal(signum)) {
460    return real_sigaction(signum, act, oldact);
461  }
462  return 0;
463}
464
465
466static void UnpoisonStackFromHereToTop() {
467  int local_stack;
468  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
469  CHECK(curr_thread);
470  uintptr_t top = curr_thread->stack_top();
471  uintptr_t bottom = ((uintptr_t)&local_stack - kPageSize) & ~(kPageSize-1);
472  uintptr_t top_shadow = MemToShadow(top);
473  uintptr_t bot_shadow = MemToShadow(bottom);
474  real_memset((void*)bot_shadow, 0, top_shadow - bot_shadow);
475}
476
477extern "C" void WRAP(longjmp)(void *env, int val) {
478  UnpoisonStackFromHereToTop();
479  real_longjmp(env, val);
480}
481
482extern "C" void WRAP(_longjmp)(void *env, int val) {
483  UnpoisonStackFromHereToTop();
484  real__longjmp(env, val);
485}
486
487extern "C" void WRAP(siglongjmp)(void *env, int val) {
488  UnpoisonStackFromHereToTop();
489  real_siglongjmp(env, val);
490}
491
492extern "C" void __cxa_throw(void *a, void *b, void *c);
493
494#if ASAN_HAS_EXCEPTIONS
495extern "C" void WRAP(__cxa_throw)(void *a, void *b, void *c) {
496  UnpoisonStackFromHereToTop();
497  real___cxa_throw(a, b, c);
498}
499#endif
500
501extern "C" {
502// intercept mlock and friends.
503// Since asan maps 16T of RAM, mlock is completely unfriendly to asan.
504// All functions return 0 (success).
505static void MlockIsUnsupported() {
506  static bool printed = 0;
507  if (printed) return;
508  printed = true;
509  Printf("INFO: AddressSanitizer ignores mlock/mlockall/munlock/munlockall\n");
510}
511int mlock(const void *addr, size_t len) {
512  MlockIsUnsupported();
513  return 0;
514}
515int munlock(const void *addr, size_t len) {
516  MlockIsUnsupported();
517  return 0;
518}
519int mlockall(int flags) {
520  MlockIsUnsupported();
521  return 0;
522}
523int munlockall(void) {
524  MlockIsUnsupported();
525  return 0;
526}
527}  // extern "C"
528
529// ---------------------- Interface ---------------- {{{1
530int __asan_set_error_exit_code(int exit_code) {
531  int old = FLAG_exitcode;
532  FLAG_exitcode = exit_code;
533  return old;
534}
535
536void __asan_report_error(uintptr_t pc, uintptr_t bp, uintptr_t sp,
537                         uintptr_t addr, bool is_write, size_t access_size) {
538  // Do not print more than one report, otherwise they will mix up.
539  static int num_calls = 0;
540  if (AtomicInc(&num_calls) > 1) return;
541
542  Printf("=================================================================\n");
543  const char *bug_descr = "unknown-crash";
544  if (AddrIsInMem(addr)) {
545    uint8_t *shadow_addr = (uint8_t*)MemToShadow(addr);
546    uint8_t shadow_byte = shadow_addr[0];
547    if (shadow_byte > 0 && shadow_byte < 128) {
548      // we are in the partial right redzone, look at the next shadow byte.
549      shadow_byte = shadow_addr[1];
550    }
551    switch (shadow_byte) {
552      case kAsanHeapLeftRedzoneMagic:
553      case kAsanHeapRightRedzoneMagic:
554        bug_descr = "heap-buffer-overflow";
555        break;
556      case kAsanHeapFreeMagic:
557        bug_descr = "heap-use-after-free";
558        break;
559      case kAsanStackLeftRedzoneMagic:
560        bug_descr = "stack-buffer-underflow";
561        break;
562      case kAsanStackMidRedzoneMagic:
563      case kAsanStackRightRedzoneMagic:
564      case kAsanStackPartialRedzoneMagic:
565        bug_descr = "stack-buffer-overflow";
566        break;
567      case kAsanStackAfterReturnMagic:
568        bug_descr = "stack-use-after-return";
569        break;
570      case kAsanUserPoisonedMemoryMagic:
571        bug_descr = "use-after-poison";
572        break;
573      case kAsanGlobalRedzoneMagic:
574        bug_descr = "global-buffer-overflow";
575        break;
576    }
577  }
578
579  Report("ERROR: AddressSanitizer %s on address "
580         "%p at pc 0x%lx bp 0x%lx sp 0x%lx\n",
581         bug_descr, addr, pc, bp, sp);
582
583  Printf("%s of size %d at %p thread T%d\n",
584         access_size ? (is_write ? "WRITE" : "READ") : "ACCESS",
585         access_size, addr, asanThreadRegistry().GetCurrentTidOrMinusOne());
586
587  if (FLAG_debug) {
588    PrintBytes("PC: ", (uintptr_t*)pc);
589  }
590
591  GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax,
592                                 false,  // FLAG_fast_unwind,
593                                 pc, bp);
594  stack.PrintStack();
595
596  CHECK(AddrIsInMem(addr));
597
598  DescribeAddress(addr, access_size);
599
600  uintptr_t shadow_addr = MemToShadow(addr);
601  Report("ABORTING\n");
602  __asan_print_accumulated_stats();
603  Printf("Shadow byte and word:\n");
604  Printf("  %p: %x\n", shadow_addr, *(unsigned char*)shadow_addr);
605  uintptr_t aligned_shadow = shadow_addr & ~(kWordSize - 1);
606  PrintBytes("  ", (uintptr_t*)(aligned_shadow));
607  Printf("More shadow bytes:\n");
608  PrintBytes("  ", (uintptr_t*)(aligned_shadow-4*kWordSize));
609  PrintBytes("  ", (uintptr_t*)(aligned_shadow-3*kWordSize));
610  PrintBytes("  ", (uintptr_t*)(aligned_shadow-2*kWordSize));
611  PrintBytes("  ", (uintptr_t*)(aligned_shadow-1*kWordSize));
612  PrintBytes("=>", (uintptr_t*)(aligned_shadow+0*kWordSize));
613  PrintBytes("  ", (uintptr_t*)(aligned_shadow+1*kWordSize));
614  PrintBytes("  ", (uintptr_t*)(aligned_shadow+2*kWordSize));
615  PrintBytes("  ", (uintptr_t*)(aligned_shadow+3*kWordSize));
616  PrintBytes("  ", (uintptr_t*)(aligned_shadow+4*kWordSize));
617  ASAN_DIE;
618}
619
620void __asan_init() {
621  if (asan_inited) return;
622  asan_init_is_running = true;
623
624  // Make sure we are not statically linked.
625  AsanDoesNotSupportStaticLinkage();
626
627  // flags
628  const char *options = getenv("ASAN_OPTIONS");
629  FLAG_malloc_context_size =
630      IntFlagValue(options, "malloc_context_size=", kMallocContextSize);
631  CHECK(FLAG_malloc_context_size <= kMallocContextSize);
632
633  FLAG_max_malloc_fill_size =
634      IntFlagValue(options, "max_malloc_fill_size=", 0);
635
636  FLAG_v = IntFlagValue(options, "verbosity=", 0);
637
638  FLAG_redzone = IntFlagValue(options, "redzone=", 128);
639  CHECK(FLAG_redzone >= 32);
640  CHECK((FLAG_redzone & (FLAG_redzone - 1)) == 0);
641
642  FLAG_atexit = IntFlagValue(options, "atexit=", 0);
643  FLAG_poison_shadow = IntFlagValue(options, "poison_shadow=", 1);
644  FLAG_report_globals = IntFlagValue(options, "report_globals=", 1);
645  FLAG_lazy_shadow = IntFlagValue(options, "lazy_shadow=", 0);
646  FLAG_handle_segv = IntFlagValue(options, "handle_segv=",
647                                         ASAN_NEEDS_SEGV);
648  FLAG_handle_sigill = IntFlagValue(options, "handle_sigill=", 0);
649  FLAG_stats = IntFlagValue(options, "stats=", 0);
650  FLAG_symbolize = IntFlagValue(options, "symbolize=", 1);
651  FLAG_demangle = IntFlagValue(options, "demangle=", 1);
652  FLAG_debug = IntFlagValue(options, "debug=", 0);
653  FLAG_replace_cfallocator = IntFlagValue(options, "replace_cfallocator=", 1);
654  FLAG_fast_unwind = IntFlagValue(options, "fast_unwind=", 1);
655  FLAG_mt = IntFlagValue(options, "mt=", 1);
656  FLAG_replace_str = IntFlagValue(options, "replace_str=", 1);
657  FLAG_replace_intrin = IntFlagValue(options, "replace_intrin=", 0);
658  FLAG_use_fake_stack = IntFlagValue(options, "use_fake_stack=", 1);
659  FLAG_exitcode = IntFlagValue(options, "exitcode=", EXIT_FAILURE);
660  FLAG_allow_user_poisoning = IntFlagValue(options,
661                                           "allow_user_poisoning=", 1);
662
663  if (FLAG_atexit) {
664    atexit(asan_atexit);
665  }
666
667  FLAG_quarantine_size =
668      IntFlagValue(options, "quarantine_size=", 1UL << 28);
669
670  // interceptors
671  InitializeAsanInterceptors();
672
673  ReplaceSystemMalloc();
674
675  INTERCEPT_FUNCTION(sigaction);
676  INTERCEPT_FUNCTION(signal);
677  INTERCEPT_FUNCTION(longjmp);
678  INTERCEPT_FUNCTION(_longjmp);
679  INTERCEPT_FUNCTION(__cxa_throw);
680  INTERCEPT_FUNCTION(pthread_create);
681#ifdef __APPLE__
682  INTERCEPT_FUNCTION(dispatch_async_f);
683  INTERCEPT_FUNCTION(dispatch_sync_f);
684  INTERCEPT_FUNCTION(dispatch_after_f);
685  INTERCEPT_FUNCTION(dispatch_barrier_async_f);
686  INTERCEPT_FUNCTION(dispatch_group_async_f);
687  // We don't need to intercept pthread_workqueue_additem_np() to support the
688  // libdispatch API, but it helps us to debug the unsupported functions. Let's
689  // intercept it only during verbose runs.
690  if (FLAG_v >= 2) {
691    INTERCEPT_FUNCTION(pthread_workqueue_additem_np);
692  }
693#else
694  // On Darwin siglongjmp tailcalls longjmp, so we don't want to intercept it
695  // there.
696  INTERCEPT_FUNCTION(siglongjmp);
697#endif
698
699  MaybeInstallSigaction(SIGSEGV, ASAN_OnSIGSEGV);
700  MaybeInstallSigaction(SIGBUS, ASAN_OnSIGSEGV);
701  MaybeInstallSigaction(SIGILL, ASAN_OnSIGILL);
702
703  if (FLAG_v) {
704    Printf("|| `[%p, %p]` || HighMem    ||\n", kHighMemBeg, kHighMemEnd);
705    Printf("|| `[%p, %p]` || HighShadow ||\n",
706           kHighShadowBeg, kHighShadowEnd);
707    Printf("|| `[%p, %p]` || ShadowGap  ||\n",
708           kShadowGapBeg, kShadowGapEnd);
709    Printf("|| `[%p, %p]` || LowShadow  ||\n",
710           kLowShadowBeg, kLowShadowEnd);
711    Printf("|| `[%p, %p]` || LowMem     ||\n", kLowMemBeg, kLowMemEnd);
712    Printf("MemToShadow(shadow): %p %p %p %p\n",
713           MEM_TO_SHADOW(kLowShadowBeg),
714           MEM_TO_SHADOW(kLowShadowEnd),
715           MEM_TO_SHADOW(kHighShadowBeg),
716           MEM_TO_SHADOW(kHighShadowEnd));
717    Printf("red_zone=%ld\n", FLAG_redzone);
718    Printf("malloc_context_size=%ld\n", (int)FLAG_malloc_context_size);
719    Printf("fast_unwind=%d\n", (int)FLAG_fast_unwind);
720
721    Printf("SHADOW_SCALE: %lx\n", SHADOW_SCALE);
722    Printf("SHADOW_GRANULARITY: %lx\n", SHADOW_GRANULARITY);
723    Printf("SHADOW_OFFSET: %lx\n", SHADOW_OFFSET);
724    CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7);
725  }
726
727  if (__WORDSIZE == 64) {
728    // Disable core dumper -- it makes little sense to dump 16T+ core.
729    struct rlimit nocore;
730    nocore.rlim_cur = 0;
731    nocore.rlim_max = 0;
732    setrlimit(RLIMIT_CORE, &nocore);
733  }
734
735  {
736    if (!FLAG_lazy_shadow) {
737      if (kLowShadowBeg != kLowShadowEnd) {
738        // mmap the low shadow plus one page.
739        mmap_range(kLowShadowBeg - kPageSize, kLowShadowEnd, "LowShadow");
740      }
741      // mmap the high shadow.
742      mmap_range(kHighShadowBeg, kHighShadowEnd, "HighShadow");
743    }
744    // protect the gap
745    protect_range(kShadowGapBeg, kShadowGapEnd);
746  }
747
748  // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
749  // should be set to 1 prior to initializing the threads.
750  asan_inited = 1;
751  asan_init_is_running = false;
752
753  asanThreadRegistry().Init();
754  asanThreadRegistry().GetMain()->ThreadStart();
755  __asan_force_interface_symbols();  // no-op.
756
757  if (FLAG_v) {
758    Report("AddressSanitizer r%s Init done ***\n", ASAN_REVISION);
759  }
760}
761