asan_rtl.cc revision 26c1596c6824925908b0a9d3b37d6ac340409b13 
1//===-- asan_rtl.cc ---------------------------------------------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12// Main file of the ASan run-time library.
13//===----------------------------------------------------------------------===//
14#include "asan_allocator.h"
15#include "asan_interceptors.h"
16#include "asan_interface.h"
17#include "asan_internal.h"
18#include "asan_lock.h"
19#include "asan_mac.h"
20#include "asan_mapping.h"
21#include "asan_procmaps.h"
22#include "asan_stack.h"
23#include "asan_stats.h"
24#include "asan_thread.h"
25#include "asan_thread_registry.h"
26
27#include <new>
28#include <dlfcn.h>
29#include <fcntl.h>
30#include <pthread.h>
31#include <signal.h>
32#include <stdarg.h>
33#include <stdint.h>
34#include <stdio.h>
35#include <stdlib.h>
36#include <string.h>
37#include <sys/stat.h>
38#include <sys/types.h>
39#ifndef ANDROID
40#include <sys/ucontext.h>
41#endif
42// must not include <setjmp.h> on Linux
43
44namespace __asan {
45
46// -------------------------- Flags ------------------------- {{{1
47static const size_t kMallocContextSize = 30;
48static int    FLAG_atexit;
49bool   FLAG_fast_unwind = true;
50
51size_t FLAG_redzone;  // power of two, >= 32
52size_t FLAG_quarantine_size;
53int    FLAG_demangle;
54bool   FLAG_symbolize;
55int    FLAG_v;
56int    FLAG_debug;
57bool   FLAG_poison_shadow;
58int    FLAG_report_globals;
59size_t FLAG_malloc_context_size = kMallocContextSize;
60uintptr_t FLAG_large_malloc;
61bool   FLAG_lazy_shadow;
62bool   FLAG_handle_segv;
63bool   FLAG_replace_str;
64bool   FLAG_replace_intrin;
65bool   FLAG_replace_cfallocator;  // Used on Mac only.
66size_t FLAG_max_malloc_fill_size = 0;
67bool   FLAG_use_fake_stack;
68int    FLAG_exitcode = EXIT_FAILURE;
69bool   FLAG_allow_user_poisoning;
70
71// -------------------------- Globals --------------------- {{{1
72int asan_inited;
73bool asan_init_is_running;
74
75// -------------------------- Interceptors ---------------- {{{1
76typedef int (*sigaction_f)(int signum, const struct sigaction *act,
77                           struct sigaction *oldact);
78typedef sig_t (*signal_f)(int signum, sig_t handler);
79typedef void (*longjmp_f)(void *env, int val);
80typedef longjmp_f _longjmp_f;
81typedef longjmp_f siglongjmp_f;
82typedef void (*__cxa_throw_f)(void *, void *, void *);
83typedef int (*pthread_create_f)(pthread_t *thread, const pthread_attr_t *attr,
84                                void *(*start_routine) (void *), void *arg);
85#ifdef __APPLE__
86dispatch_async_f_f real_dispatch_async_f;
87dispatch_sync_f_f real_dispatch_sync_f;
88dispatch_after_f_f real_dispatch_after_f;
89dispatch_barrier_async_f_f real_dispatch_barrier_async_f;
90dispatch_group_async_f_f real_dispatch_group_async_f;
91pthread_workqueue_additem_np_f real_pthread_workqueue_additem_np;
92#endif
93
94sigaction_f             real_sigaction;
95signal_f                real_signal;
96longjmp_f               real_longjmp;
97_longjmp_f              real__longjmp;
98siglongjmp_f            real_siglongjmp;
99__cxa_throw_f           real___cxa_throw;
100pthread_create_f        real_pthread_create;
101
102// -------------------------- Misc ---------------- {{{1
103void ShowStatsAndAbort() {
104  __asan_print_accumulated_stats();
105  ASAN_DIE;
106}
107
108static void PrintBytes(const char *before, uintptr_t *a) {
109  uint8_t *bytes = (uint8_t*)a;
110  size_t byte_num = (__WORDSIZE) / 8;
111  Printf("%s%p:", before, (uintptr_t)a);
112  for (size_t i = 0; i < byte_num; i++) {
113    Printf(" %lx%lx", bytes[i] >> 4, bytes[i] & 15);
114  }
115  Printf("\n");
116}
117
118ssize_t ReadFileToBuffer(const char *file_name, char **buff,
119                         size_t *buff_size, size_t max_len) {
120  const size_t kMinFileLen = kPageSize;
121  ssize_t read_len = -1;
122  *buff = 0;
123  *buff_size = 0;
124  // The files we usually open are not seekable, so try different buffer sizes.
125  for (size_t size = kMinFileLen; size <= max_len; size *= 2) {
126    int fd = AsanOpenReadonly(file_name);
127    if (fd < 0) return -1;
128    AsanUnmapOrDie(*buff, *buff_size);
129    *buff = (char*)AsanMmapSomewhereOrDie(size, __FUNCTION__);
130    *buff_size = size;
131    read_len = AsanRead(fd, *buff, size);
132    AsanClose(fd);
133    if (read_len < size)  // We've read the whole file.
134      break;
135  }
136  return read_len;
137}
138
139// Like getenv, but reads env directly from /proc and does not use libc.
140// This function should be called first inside __asan_init.
141static const char* GetEnvFromProcSelfEnviron(const char* name) {
142  static char *environ;
143  static ssize_t len;
144  static bool inited;
145  if (!inited) {
146    inited = true;
147    size_t environ_size;
148    len = ReadFileToBuffer("/proc/self/environ",
149                           &environ, &environ_size, 1 << 20);
150  }
151  if (!environ || len <= 0) return NULL;
152  size_t namelen = internal_strlen(name);
153  const char *p = environ;
154  while (*p != '\0') {  // will happen at the \0\0 that terminates the buffer
155    // proc file has the format NAME=value\0NAME=value\0NAME=value\0...
156    const char* endp =
157        (char*)internal_memchr(p, '\0', len - (p - environ));
158    if (endp == NULL)  // this entry isn't NUL terminated
159      return NULL;
160    else if (!internal_memcmp(p, name, namelen) && p[namelen] == '=')  // Match.
161      return p + namelen + 1;  // point after =
162    p = endp + 1;
163  }
164  return NULL;  // Not found.
165}
166
167// ---------------------- Thread ------------------------- {{{1
168static void *asan_thread_start(void *arg) {
169  AsanThread *t= (AsanThread*)arg;
170  asanThreadRegistry().SetCurrent(t);
171  return t->ThreadStart();
172}
173
174// ---------------------- mmap -------------------- {{{1
175void OutOfMemoryMessageAndDie(const char *mem_type, size_t size) {
176  Report("ERROR: AddressSanitizer failed to allocate "
177         "0x%lx (%ld) bytes of %s\n",
178         size, size, mem_type);
179  PRINT_CURRENT_STACK();
180  ShowStatsAndAbort();
181}
182
183// Reserve memory range [beg, end].
184static void ReserveShadowMemoryRange(uintptr_t beg, uintptr_t end) {
185  CHECK((beg % kPageSize) == 0);
186  CHECK(((end + 1) % kPageSize) == 0);
187  size_t size = end - beg + 1;
188  void *res = AsanMmapFixedNoReserve(beg, size);
189  CHECK(res == (void*)beg && "ReserveShadowMemoryRange failed");
190}
191
192// ---------------------- LowLevelAllocator ------------- {{{1
193void *LowLevelAllocator::Allocate(size_t size) {
194  CHECK((size & (size - 1)) == 0 && "size must be a power of two");
195  if (allocated_end_ - allocated_current_ < size) {
196    size_t size_to_allocate = Max(size, kPageSize);
197    allocated_current_ =
198        (char*)AsanMmapSomewhereOrDie(size_to_allocate, __FUNCTION__);
199    allocated_end_ = allocated_current_ + size_to_allocate;
200    PoisonShadow((uintptr_t)allocated_current_, size_to_allocate,
201                 kAsanInternalHeapMagic);
202  }
203  CHECK(allocated_end_ - allocated_current_ >= size);
204  void *res = allocated_current_;
205  allocated_current_ += size;
206  return res;
207}
208
209// ---------------------- DescribeAddress -------------------- {{{1
210static bool DescribeStackAddress(uintptr_t addr, uintptr_t access_size) {
211  AsanThread *t = asanThreadRegistry().FindThreadByStackAddress(addr);
212  if (!t) return false;
213  const intptr_t kBufSize = 4095;
214  char buf[kBufSize];
215  uintptr_t offset = 0;
216  const char *frame_descr = t->GetFrameNameByAddr(addr, &offset);
217  // This string is created by the compiler and has the following form:
218  // "FunctioName n alloc_1 alloc_2 ... alloc_n"
219  // where alloc_i looks like "offset size len ObjectName ".
220  CHECK(frame_descr);
221  // Report the function name and the offset.
222  const char *name_end = real_strchr(frame_descr, ' ');
223  CHECK(name_end);
224  buf[0] = 0;
225  strncat(buf, frame_descr,
226          Min(kBufSize, static_cast<intptr_t>(name_end - frame_descr)));
227  Printf("Address %p is located at offset %ld "
228         "in frame <%s> of T%d's stack:\n",
229         addr, offset, buf, t->tid());
230  // Report the number of stack objects.
231  char *p;
232  size_t n_objects = strtol(name_end, &p, 10);
233  CHECK(n_objects > 0);
234  Printf("  This frame has %ld object(s):\n", n_objects);
235  // Report all objects in this frame.
236  for (size_t i = 0; i < n_objects; i++) {
237    size_t beg, size;
238    intptr_t len;
239    beg  = strtol(p, &p, 10);
240    size = strtol(p, &p, 10);
241    len  = strtol(p, &p, 10);
242    if (beg <= 0 || size <= 0 || len < 0 || *p != ' ') {
243      Printf("AddressSanitizer can't parse the stack frame descriptor: |%s|\n",
244             frame_descr);
245      break;
246    }
247    p++;
248    buf[0] = 0;
249    strncat(buf, p, Min(kBufSize, len));
250    p += len;
251    Printf("    [%ld, %ld) '%s'\n", beg, beg + size, buf);
252  }
253  Printf("HINT: this may be a false positive if your program uses "
254         "some custom stack unwind mechanism\n"
255         "      (longjmp and C++ exceptions *are* supported)\n");
256  t->summary()->Announce();
257  return true;
258}
259
260__attribute__((noinline))
261static void DescribeAddress(uintptr_t addr, uintptr_t access_size) {
262  // Check if this is a global.
263  if (DescribeAddrIfGlobal(addr))
264    return;
265
266  if (DescribeStackAddress(addr, access_size))
267    return;
268
269  // finally, check if this is a heap.
270  DescribeHeapAddress(addr, access_size);
271}
272
273// -------------------------- Run-time entry ------------------- {{{1
274void GetPcSpBpAx(void *context,
275                 uintptr_t *pc, uintptr_t *sp, uintptr_t *bp, uintptr_t *ax) {
276#ifndef ANDROID
277  ucontext_t *ucontext = (ucontext_t*)context;
278#endif
279#ifdef __APPLE__
280# if __WORDSIZE == 64
281  *pc = ucontext->uc_mcontext->__ss.__rip;
282  *bp = ucontext->uc_mcontext->__ss.__rbp;
283  *sp = ucontext->uc_mcontext->__ss.__rsp;
284  *ax = ucontext->uc_mcontext->__ss.__rax;
285# else
286  *pc = ucontext->uc_mcontext->__ss.__eip;
287  *bp = ucontext->uc_mcontext->__ss.__ebp;
288  *sp = ucontext->uc_mcontext->__ss.__esp;
289  *ax = ucontext->uc_mcontext->__ss.__eax;
290# endif  // __WORDSIZE
291#else  // assume linux
292# if defined (ANDROID)
293  *pc = *sp = *bp = *ax = 0;
294# elif defined(__arm__)
295  *pc = ucontext->uc_mcontext.arm_pc;
296  *bp = ucontext->uc_mcontext.arm_fp;
297  *sp = ucontext->uc_mcontext.arm_sp;
298  *ax = ucontext->uc_mcontext.arm_r0;
299# elif __WORDSIZE == 64
300  *pc = ucontext->uc_mcontext.gregs[REG_RIP];
301  *bp = ucontext->uc_mcontext.gregs[REG_RBP];
302  *sp = ucontext->uc_mcontext.gregs[REG_RSP];
303  *ax = ucontext->uc_mcontext.gregs[REG_RAX];
304# else
305  *pc = ucontext->uc_mcontext.gregs[REG_EIP];
306  *bp = ucontext->uc_mcontext.gregs[REG_EBP];
307  *sp = ucontext->uc_mcontext.gregs[REG_ESP];
308  *ax = ucontext->uc_mcontext.gregs[REG_EAX];
309# endif  // __WORDSIZE
310#endif
311}
312
313static void     ASAN_OnSIGSEGV(int, siginfo_t *siginfo, void *context) {
314  uintptr_t addr = (uintptr_t)siginfo->si_addr;
315  if (AddrIsInShadow(addr) && FLAG_lazy_shadow) {
316    // We traped on access to a shadow address. Just map a large chunk around
317    // this address.
318    const uintptr_t chunk_size = kPageSize << 10;  // 4M
319    uintptr_t chunk = addr & ~(chunk_size - 1);
320    AsanMmapFixedReserve(chunk, chunk_size);
321    return;
322  }
323  // Write the first message using the bullet-proof write.
324  if (13 != AsanWrite(2, "ASAN:SIGSEGV\n", 13)) ASAN_DIE;
325  uintptr_t pc, sp, bp, ax;
326  GetPcSpBpAx(context, &pc, &sp, &bp, &ax);
327  Report("ERROR: AddressSanitizer crashed on unknown address %p"
328         " (pc %p sp %p bp %p ax %p T%d)\n",
329         addr, pc, sp, bp, ax,
330         asanThreadRegistry().GetCurrentTidOrMinusOne());
331  Printf("AddressSanitizer can not provide additional info. ABORTING\n");
332  GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, false, pc, bp);
333  stack.PrintStack();
334  ShowStatsAndAbort();
335}
336
337// exported functions
338#define ASAN_REPORT_ERROR(type, is_write, size)                     \
339extern "C" void __asan_report_ ## type ## size(uintptr_t addr)      \
340  __attribute__((visibility("default"))) __attribute__((noinline)); \
341extern "C" void __asan_report_ ## type ## size(uintptr_t addr) {    \
342  GET_BP_PC_SP;                                                     \
343  __asan_report_error(pc, bp, sp, addr, is_write, size);            \
344}
345
346ASAN_REPORT_ERROR(load, false, 1)
347ASAN_REPORT_ERROR(load, false, 2)
348ASAN_REPORT_ERROR(load, false, 4)
349ASAN_REPORT_ERROR(load, false, 8)
350ASAN_REPORT_ERROR(load, false, 16)
351ASAN_REPORT_ERROR(store, true, 1)
352ASAN_REPORT_ERROR(store, true, 2)
353ASAN_REPORT_ERROR(store, true, 4)
354ASAN_REPORT_ERROR(store, true, 8)
355ASAN_REPORT_ERROR(store, true, 16)
356
357// Force the linker to keep the symbols for various ASan interface functions.
358// We want to keep those in the executable in order to let the instrumented
359// dynamic libraries access the symbol even if it is not used by the executable
360// itself. This should help if the build system is removing dead code at link
361// time.
362static void force_interface_symbols() {
363  volatile int fake_condition = 0;  // prevent dead condition elimination.
364  if (fake_condition) {
365    __asan_report_load1(NULL);
366    __asan_report_load2(NULL);
367    __asan_report_load4(NULL);
368    __asan_report_load8(NULL);
369    __asan_report_load16(NULL);
370    __asan_report_store1(NULL);
371    __asan_report_store2(NULL);
372    __asan_report_store4(NULL);
373    __asan_report_store8(NULL);
374    __asan_report_store16(NULL);
375    __asan_register_global(0, 0, NULL);
376    __asan_register_globals(NULL, 0);
377    __asan_unregister_globals(NULL, 0);
378  }
379}
380
381// -------------------------- Init ------------------- {{{1
382static int64_t IntFlagValue(const char *flags, const char *flag,
383                            int64_t default_val) {
384  if (!flags) return default_val;
385  const char *str = strstr(flags, flag);
386  if (!str) return default_val;
387  return atoll(str + internal_strlen(flag));
388}
389
390static void asan_atexit() {
391  Printf("AddressSanitizer exit stats:\n");
392  __asan_print_accumulated_stats();
393}
394
395void CheckFailed(const char *cond, const char *file, int line) {
396  Report("CHECK failed: %s at %s:%d, pthread_self=%p\n",
397         cond, file, line, pthread_self());
398  PRINT_CURRENT_STACK();
399  ShowStatsAndAbort();
400}
401
402}  // namespace __asan
403
404// -------------------------- Interceptors ------------------- {{{1
405using namespace __asan;  // NOLINT
406
407#define OPERATOR_NEW_BODY \
408  GET_STACK_TRACE_HERE_FOR_MALLOC;\
409  return asan_memalign(0, size, &stack);
410
411#ifdef ANDROID
412void *operator new(size_t size) { OPERATOR_NEW_BODY; }
413void *operator new[](size_t size) { OPERATOR_NEW_BODY; }
414#else
415void *operator new(size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; }
416void *operator new[](size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; }
417void *operator new(size_t size, std::nothrow_t const&) throw()
418{ OPERATOR_NEW_BODY; }
419void *operator new[](size_t size, std::nothrow_t const&) throw()
420{ OPERATOR_NEW_BODY; }
421#endif
422
423#define OPERATOR_DELETE_BODY \
424  GET_STACK_TRACE_HERE_FOR_FREE(ptr);\
425  asan_free(ptr, &stack);
426
427void operator delete(void *ptr) throw() { OPERATOR_DELETE_BODY; }
428void operator delete[](void *ptr) throw() { OPERATOR_DELETE_BODY; }
429void operator delete(void *ptr, std::nothrow_t const&) throw()
430{ OPERATOR_DELETE_BODY; }
431void operator delete[](void *ptr, std::nothrow_t const&) throw()
432{ OPERATOR_DELETE_BODY;}
433
434extern "C"
435#ifndef __APPLE__
436__attribute__((visibility("default")))
437#endif
438int WRAP(pthread_create)(pthread_t *thread, const pthread_attr_t *attr,
439                         void *(*start_routine) (void *), void *arg) {
440  GET_STACK_TRACE_HERE(kStackTraceMax, /*fast_unwind*/false);
441  AsanThread *t = (AsanThread*)asan_malloc(sizeof(AsanThread), &stack);
442  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
443  CHECK(curr_thread || asanThreadRegistry().IsCurrentThreadDying());
444  new(t) AsanThread(asanThreadRegistry().GetCurrentTidOrMinusOne(),
445                    start_routine, arg, &stack);
446  return real_pthread_create(thread, attr, asan_thread_start, t);
447}
448
449static bool MySignal(int signum) {
450  if (FLAG_handle_segv && signum == SIGSEGV) return true;
451#ifdef __APPLE__
452  if (FLAG_handle_segv && signum == SIGBUS) return true;
453#endif
454  return false;
455}
456
457static void MaybeInstallSigaction(int signum,
458                                  void (*handler)(int, siginfo_t *, void *)) {
459  if (!MySignal(signum))
460    return;
461  struct sigaction sigact;
462  real_memset(&sigact, 0, sizeof(sigact));
463  sigact.sa_sigaction = handler;
464  sigact.sa_flags = SA_SIGINFO;
465  CHECK(0 == real_sigaction(signum, &sigact, 0));
466}
467
468extern "C"
469sig_t WRAP(signal)(int signum, sig_t handler) {
470  if (!MySignal(signum)) {
471    return real_signal(signum, handler);
472  }
473  return NULL;
474}
475
476extern "C"
477int WRAP(sigaction)(int signum, const struct sigaction *act,
478                    struct sigaction *oldact) {
479  if (!MySignal(signum)) {
480    return real_sigaction(signum, act, oldact);
481  }
482  return 0;
483}
484
485
486static void UnpoisonStackFromHereToTop() {
487  int local_stack;
488  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
489  CHECK(curr_thread);
490  uintptr_t top = curr_thread->stack_top();
491  uintptr_t bottom = ((uintptr_t)&local_stack - kPageSize) & ~(kPageSize-1);
492  PoisonShadow(bottom, top - bottom, 0);
493}
494
495extern "C" void WRAP(longjmp)(void *env, int val) {
496  UnpoisonStackFromHereToTop();
497  real_longjmp(env, val);
498}
499
500extern "C" void WRAP(_longjmp)(void *env, int val) {
501  UnpoisonStackFromHereToTop();
502  real__longjmp(env, val);
503}
504
505extern "C" void WRAP(siglongjmp)(void *env, int val) {
506  UnpoisonStackFromHereToTop();
507  real_siglongjmp(env, val);
508}
509
510extern "C" void __cxa_throw(void *a, void *b, void *c);
511
512#if ASAN_HAS_EXCEPTIONS == 1
513extern "C" void WRAP(__cxa_throw)(void *a, void *b, void *c) {
514  CHECK(&real___cxa_throw);
515  UnpoisonStackFromHereToTop();
516  real___cxa_throw(a, b, c);
517}
518#endif
519
520extern "C" {
521// intercept mlock and friends.
522// Since asan maps 16T of RAM, mlock is completely unfriendly to asan.
523// All functions return 0 (success).
524static void MlockIsUnsupported() {
525  static bool printed = 0;
526  if (printed) return;
527  printed = true;
528  Printf("INFO: AddressSanitizer ignores mlock/mlockall/munlock/munlockall\n");
529}
530int mlock(const void *addr, size_t len) {
531  MlockIsUnsupported();
532  return 0;
533}
534int munlock(const void *addr, size_t len) {
535  MlockIsUnsupported();
536  return 0;
537}
538int mlockall(int flags) {
539  MlockIsUnsupported();
540  return 0;
541}
542int munlockall(void) {
543  MlockIsUnsupported();
544  return 0;
545}
546}  // extern "C"
547
548// ---------------------- Interface ---------------- {{{1
549int __asan_set_error_exit_code(int exit_code) {
550  int old = FLAG_exitcode;
551  FLAG_exitcode = exit_code;
552  return old;
553}
554
555void __asan_report_error(uintptr_t pc, uintptr_t bp, uintptr_t sp,
556                         uintptr_t addr, bool is_write, size_t access_size) {
557  // Do not print more than one report, otherwise they will mix up.
558  static int num_calls = 0;
559  if (AtomicInc(&num_calls) > 1) return;
560
561  Printf("=================================================================\n");
562  const char *bug_descr = "unknown-crash";
563  if (AddrIsInMem(addr)) {
564    uint8_t *shadow_addr = (uint8_t*)MemToShadow(addr);
565    // If we are accessing 16 bytes, look at the second shadow byte.
566    if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY)
567      shadow_addr++;
568    // If we are in the partial right redzone, look at the next shadow byte.
569    if (*shadow_addr > 0 && *shadow_addr < 128)
570      shadow_addr++;
571    switch (*shadow_addr) {
572      case kAsanHeapLeftRedzoneMagic:
573      case kAsanHeapRightRedzoneMagic:
574        bug_descr = "heap-buffer-overflow";
575        break;
576      case kAsanHeapFreeMagic:
577        bug_descr = "heap-use-after-free";
578        break;
579      case kAsanStackLeftRedzoneMagic:
580        bug_descr = "stack-buffer-underflow";
581        break;
582      case kAsanStackMidRedzoneMagic:
583      case kAsanStackRightRedzoneMagic:
584      case kAsanStackPartialRedzoneMagic:
585        bug_descr = "stack-buffer-overflow";
586        break;
587      case kAsanStackAfterReturnMagic:
588        bug_descr = "stack-use-after-return";
589        break;
590      case kAsanUserPoisonedMemoryMagic:
591        bug_descr = "use-after-poison";
592        break;
593      case kAsanGlobalRedzoneMagic:
594        bug_descr = "global-buffer-overflow";
595        break;
596    }
597  }
598
599  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
600  int curr_tid = asanThreadRegistry().GetCurrentTidOrMinusOne();
601
602  if (curr_thread) {
603    // We started reporting an error message. Stop using the fake stack
604    // in case we will call an instrumented function from a symbolizer.
605    curr_thread->fake_stack().StopUsingFakeStack();
606  }
607
608  Report("ERROR: AddressSanitizer %s on address "
609         "%p at pc 0x%lx bp 0x%lx sp 0x%lx\n",
610         bug_descr, addr, pc, bp, sp);
611
612  Printf("%s of size %d at %p thread T%d\n",
613         access_size ? (is_write ? "WRITE" : "READ") : "ACCESS",
614         access_size, addr, curr_tid);
615
616  if (FLAG_debug) {
617    PrintBytes("PC: ", (uintptr_t*)pc);
618  }
619
620  GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax,
621                                 false,  // FLAG_fast_unwind,
622                                 pc, bp);
623  stack.PrintStack();
624
625  CHECK(AddrIsInMem(addr));
626
627  DescribeAddress(addr, access_size);
628
629  uintptr_t shadow_addr = MemToShadow(addr);
630  Report("ABORTING\n");
631  __asan_print_accumulated_stats();
632  Printf("Shadow byte and word:\n");
633  Printf("  %p: %x\n", shadow_addr, *(unsigned char*)shadow_addr);
634  uintptr_t aligned_shadow = shadow_addr & ~(kWordSize - 1);
635  PrintBytes("  ", (uintptr_t*)(aligned_shadow));
636  Printf("More shadow bytes:\n");
637  PrintBytes("  ", (uintptr_t*)(aligned_shadow-4*kWordSize));
638  PrintBytes("  ", (uintptr_t*)(aligned_shadow-3*kWordSize));
639  PrintBytes("  ", (uintptr_t*)(aligned_shadow-2*kWordSize));
640  PrintBytes("  ", (uintptr_t*)(aligned_shadow-1*kWordSize));
641  PrintBytes("=>", (uintptr_t*)(aligned_shadow+0*kWordSize));
642  PrintBytes("  ", (uintptr_t*)(aligned_shadow+1*kWordSize));
643  PrintBytes("  ", (uintptr_t*)(aligned_shadow+2*kWordSize));
644  PrintBytes("  ", (uintptr_t*)(aligned_shadow+3*kWordSize));
645  PrintBytes("  ", (uintptr_t*)(aligned_shadow+4*kWordSize));
646  ASAN_DIE;
647}
648
649void __asan_init() {
650  if (asan_inited) return;
651  asan_init_is_running = true;
652
653  // Make sure we are not statically linked.
654  AsanDoesNotSupportStaticLinkage();
655
656  // flags
657  const char *options = GetEnvFromProcSelfEnviron("ASAN_OPTIONS");
658  FLAG_malloc_context_size =
659      IntFlagValue(options, "malloc_context_size=", kMallocContextSize);
660  CHECK(FLAG_malloc_context_size <= kMallocContextSize);
661
662  FLAG_max_malloc_fill_size =
663      IntFlagValue(options, "max_malloc_fill_size=", 0);
664
665  FLAG_v = IntFlagValue(options, "verbosity=", 0);
666
667  FLAG_redzone = IntFlagValue(options, "redzone=", 128);
668  CHECK(FLAG_redzone >= 32);
669  CHECK((FLAG_redzone & (FLAG_redzone - 1)) == 0);
670
671  FLAG_atexit = IntFlagValue(options, "atexit=", 0);
672  FLAG_poison_shadow = IntFlagValue(options, "poison_shadow=", 1);
673  FLAG_report_globals = IntFlagValue(options, "report_globals=", 1);
674  FLAG_lazy_shadow = IntFlagValue(options, "lazy_shadow=", 0);
675  FLAG_handle_segv = IntFlagValue(options, "handle_segv=", ASAN_NEEDS_SEGV);
676  FLAG_symbolize = IntFlagValue(options, "symbolize=", 1);
677  FLAG_demangle = IntFlagValue(options, "demangle=", 1);
678  FLAG_debug = IntFlagValue(options, "debug=", 0);
679  FLAG_replace_cfallocator = IntFlagValue(options, "replace_cfallocator=", 1);
680  FLAG_fast_unwind = IntFlagValue(options, "fast_unwind=", 1);
681  FLAG_replace_str = IntFlagValue(options, "replace_str=", 1);
682  FLAG_replace_intrin = IntFlagValue(options, "replace_intrin=", 1);
683  FLAG_use_fake_stack = IntFlagValue(options, "use_fake_stack=", 1);
684  FLAG_exitcode = IntFlagValue(options, "exitcode=", EXIT_FAILURE);
685  FLAG_allow_user_poisoning = IntFlagValue(options,
686                                           "allow_user_poisoning=", 1);
687
688  if (FLAG_atexit) {
689    atexit(asan_atexit);
690  }
691
692  FLAG_quarantine_size =
693      IntFlagValue(options, "quarantine_size=", 1UL << 28);
694
695  // interceptors
696  InitializeAsanInterceptors();
697
698  ReplaceSystemMalloc();
699
700  INTERCEPT_FUNCTION(sigaction);
701  INTERCEPT_FUNCTION(signal);
702  INTERCEPT_FUNCTION(longjmp);
703  INTERCEPT_FUNCTION(_longjmp);
704  INTERCEPT_FUNCTION_IF_EXISTS(__cxa_throw);
705  INTERCEPT_FUNCTION(pthread_create);
706#ifdef __APPLE__
707  INTERCEPT_FUNCTION(dispatch_async_f);
708  INTERCEPT_FUNCTION(dispatch_sync_f);
709  INTERCEPT_FUNCTION(dispatch_after_f);
710  INTERCEPT_FUNCTION(dispatch_barrier_async_f);
711  INTERCEPT_FUNCTION(dispatch_group_async_f);
712  // We don't need to intercept pthread_workqueue_additem_np() to support the
713  // libdispatch API, but it helps us to debug the unsupported functions. Let's
714  // intercept it only during verbose runs.
715  if (FLAG_v >= 2) {
716    INTERCEPT_FUNCTION(pthread_workqueue_additem_np);
717  }
718#else
719  // On Darwin siglongjmp tailcalls longjmp, so we don't want to intercept it
720  // there.
721  INTERCEPT_FUNCTION(siglongjmp);
722#endif
723
724  MaybeInstallSigaction(SIGSEGV, ASAN_OnSIGSEGV);
725  MaybeInstallSigaction(SIGBUS, ASAN_OnSIGSEGV);
726
727  if (FLAG_v) {
728    Printf("|| `[%p, %p]` || HighMem    ||\n", kHighMemBeg, kHighMemEnd);
729    Printf("|| `[%p, %p]` || HighShadow ||\n",
730           kHighShadowBeg, kHighShadowEnd);
731    Printf("|| `[%p, %p]` || ShadowGap  ||\n",
732           kShadowGapBeg, kShadowGapEnd);
733    Printf("|| `[%p, %p]` || LowShadow  ||\n",
734           kLowShadowBeg, kLowShadowEnd);
735    Printf("|| `[%p, %p]` || LowMem     ||\n", kLowMemBeg, kLowMemEnd);
736    Printf("MemToShadow(shadow): %p %p %p %p\n",
737           MEM_TO_SHADOW(kLowShadowBeg),
738           MEM_TO_SHADOW(kLowShadowEnd),
739           MEM_TO_SHADOW(kHighShadowBeg),
740           MEM_TO_SHADOW(kHighShadowEnd));
741    Printf("red_zone=%ld\n", FLAG_redzone);
742    Printf("malloc_context_size=%ld\n", (int)FLAG_malloc_context_size);
743    Printf("fast_unwind=%d\n", (int)FLAG_fast_unwind);
744
745    Printf("SHADOW_SCALE: %lx\n", SHADOW_SCALE);
746    Printf("SHADOW_GRANULARITY: %lx\n", SHADOW_GRANULARITY);
747    Printf("SHADOW_OFFSET: %lx\n", SHADOW_OFFSET);
748    CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7);
749  }
750
751  if (__WORDSIZE == 64) {
752    // Disable core dumper -- it makes little sense to dump 16T+ core.
753    AsanDisableCoreDumper();
754  }
755
756  {
757    if (!FLAG_lazy_shadow) {
758      if (kLowShadowBeg != kLowShadowEnd) {
759        // mmap the low shadow plus one page.
760        ReserveShadowMemoryRange(kLowShadowBeg - kPageSize, kLowShadowEnd);
761      }
762      // mmap the high shadow.
763      ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd);
764    }
765    // protect the gap
766    void *prot = AsanMprotect(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1);
767    CHECK(prot == (void*)kShadowGapBeg);
768  }
769
770  // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
771  // should be set to 1 prior to initializing the threads.
772  asan_inited = 1;
773  asan_init_is_running = false;
774
775  asanThreadRegistry().Init();
776  asanThreadRegistry().GetMain()->ThreadStart();
777  force_interface_symbols();  // no-op.
778
779  if (FLAG_v) {
780    Report("AddressSanitizer Init done\n");
781  }
782}
783