asan_rtl.cc revision b89567ce41bef82cf92a9c741c78b632c07b2781 
1//===-- asan_rtl.cc ---------------------------------------------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of AddressSanitizer, an address sanity checker.
11//
12// Main file of the ASan run-time library.
13//===----------------------------------------------------------------------===//
14#include "asan_allocator.h"
15#include "asan_interceptors.h"
16#include "asan_interface.h"
17#include "asan_internal.h"
18#include "asan_lock.h"
19#ifdef __APPLE__
20#include "asan_mac.h"
21#endif
22#include "asan_mapping.h"
23#include "asan_stack.h"
24#include "asan_stats.h"
25#include "asan_thread.h"
26#include "asan_thread_registry.h"
27
28#include <new>
29#include <dlfcn.h>
30#include <execinfo.h>
31#include <fcntl.h>
32#include <pthread.h>
33#include <signal.h>
34#include <stdarg.h>
35#include <stdint.h>
36#include <stdio.h>
37#include <stdlib.h>
38#include <string.h>
39#include <sys/mman.h>
40#include <sys/stat.h>
41#include <sys/types.h>
42#include <sys/ucontext.h>
43#include <sys/time.h>
44#include <sys/resource.h>
45#include <unistd.h>
46// must not include <setjmp.h> on Linux
47
48#ifndef ASAN_NEEDS_SEGV
49# define ASAN_NEEDS_SEGV 1
50#endif
51
52namespace __asan {
53
54// -------------------------- Flags ------------------------- {{{1
55static const size_t kMallocContextSize = 30;
56static int    FLAG_atexit;
57bool   FLAG_fast_unwind = true;
58
59size_t FLAG_redzone;  // power of two, >= 32
60bool   FLAG_mt;  // set to 0 if you have only one thread.
61size_t FLAG_quarantine_size;
62int    FLAG_demangle;
63bool   FLAG_symbolize;
64int    FLAG_v;
65int    FLAG_debug;
66bool   FLAG_poison_shadow;
67int    FLAG_report_globals;
68size_t FLAG_malloc_context_size = kMallocContextSize;
69uintptr_t FLAG_large_malloc;
70bool   FLAG_lazy_shadow;
71bool   FLAG_handle_segv;
72bool   FLAG_handle_sigill;
73bool   FLAG_replace_str;
74bool   FLAG_replace_intrin;
75bool   FLAG_replace_cfallocator;  // Used on Mac only.
76bool   FLAG_stats;
77size_t FLAG_max_malloc_fill_size = 0;
78bool   FLAG_use_fake_stack;
79int    FLAG_exitcode = EXIT_FAILURE;
80bool   FLAG_allow_user_poisoning;
81
82// -------------------------- Globals --------------------- {{{1
83int asan_inited;
84bool asan_init_is_running;
85
86// -------------------------- Interceptors ---------------- {{{1
87typedef int (*sigaction_f)(int signum, const struct sigaction *act,
88                           struct sigaction *oldact);
89typedef sig_t (*signal_f)(int signum, sig_t handler);
90typedef void (*longjmp_f)(void *env, int val);
91typedef longjmp_f _longjmp_f;
92typedef longjmp_f siglongjmp_f;
93typedef void (*__cxa_throw_f)(void *, void *, void *);
94typedef int (*pthread_create_f)(pthread_t *thread, const pthread_attr_t *attr,
95                                void *(*start_routine) (void *), void *arg);
96#ifdef __APPLE__
97dispatch_async_f_f real_dispatch_async_f;
98dispatch_sync_f_f real_dispatch_sync_f;
99dispatch_after_f_f real_dispatch_after_f;
100dispatch_barrier_async_f_f real_dispatch_barrier_async_f;
101dispatch_group_async_f_f real_dispatch_group_async_f;
102pthread_workqueue_additem_np_f real_pthread_workqueue_additem_np;
103#endif
104
105sigaction_f             real_sigaction;
106signal_f                real_signal;
107longjmp_f               real_longjmp;
108_longjmp_f              real__longjmp;
109siglongjmp_f            real_siglongjmp;
110__cxa_throw_f           real___cxa_throw;
111pthread_create_f        real_pthread_create;
112
113// -------------------------- Misc ---------------- {{{1
114void ShowStatsAndAbort() {
115  __asan_print_accumulated_stats();
116  ASAN_DIE;
117}
118
119static void PrintBytes(const char *before, uintptr_t *a) {
120  uint8_t *bytes = (uint8_t*)a;
121  size_t byte_num = (__WORDSIZE) / 8;
122  Printf("%s%p:", before, (uintptr_t)a);
123  for (size_t i = 0; i < byte_num; i++) {
124    Printf(" %lx%lx", bytes[i] >> 4, bytes[i] & 15);
125  }
126  Printf("\n");
127}
128
129// ---------------------- Thread ------------------------- {{{1
130static void *asan_thread_start(void *arg) {
131  AsanThread *t= (AsanThread*)arg;
132  asanThreadRegistry().SetCurrent(t);
133  return t->ThreadStart();
134}
135
136// ---------------------- mmap -------------------- {{{1
137static void OutOfMemoryMessage(const char *mem_type, size_t size) {
138  Report("ERROR: AddressSanitizer failed to allocate "
139         "0x%lx (%ld) bytes of %s\n",
140         size, size, mem_type);
141}
142
143static char *mmap_pages(size_t start_page, size_t n_pages, const char *mem_type,
144                        bool abort_on_failure = true) {
145  void *res = asan_mmap((void*)start_page, kPageSize * n_pages,
146                   PROT_READ | PROT_WRITE,
147                   MAP_PRIVATE | MAP_ANON | MAP_FIXED | MAP_NORESERVE, 0, 0);
148  // Printf("%p => %p\n", (void*)start_page, res);
149  char *ch = (char*)res;
150  if (res == (void*)-1L && abort_on_failure) {
151    OutOfMemoryMessage(mem_type, n_pages * kPageSize);
152    ShowStatsAndAbort();
153  }
154  CHECK(res == (void*)start_page || res == (void*)-1L);
155  return ch;
156}
157
158// mmap range [beg, end]
159static char *mmap_range(uintptr_t beg, uintptr_t end, const char *mem_type) {
160  CHECK((beg % kPageSize) == 0);
161  CHECK(((end + 1) % kPageSize) == 0);
162  // Printf("mmap_range %p %p %ld\n", beg, end, (end - beg) / kPageSize);
163  return mmap_pages(beg, (end - beg + 1) / kPageSize, mem_type);
164}
165
166// protect range [beg, end]
167static void protect_range(uintptr_t beg, uintptr_t end) {
168  CHECK((beg % kPageSize) == 0);
169  CHECK(((end+1) % kPageSize) == 0);
170  // Printf("protect_range %p %p %ld\n", beg, end, (end - beg) / kPageSize);
171  void *res = asan_mmap((void*)beg, end - beg + 1,
172                   PROT_NONE,
173                   MAP_PRIVATE | MAP_ANON | MAP_FIXED | MAP_NORESERVE, 0, 0);
174  CHECK(res == (void*)beg);
175}
176
177// ---------------------- LowLevelAllocator ------------- {{{1
178void *LowLevelAllocator::Allocate(size_t size) {
179  CHECK((size & (size - 1)) == 0 && "size must be a power of two");
180  if (allocated_end_ - allocated_current_ < size) {
181    size_t size_to_allocate = Max(size, kPageSize);
182    allocated_current_ = (char*)asan_mmap(0, size_to_allocate,
183                                          PROT_READ | PROT_WRITE,
184                                          MAP_PRIVATE | MAP_ANON, -1, 0);
185    CHECK((allocated_current_ != (char*)-1) && "Can't mmap");
186    allocated_end_ = allocated_current_ + size_to_allocate;
187  }
188  CHECK(allocated_end_ - allocated_current_ >= size);
189  void *res = allocated_current_;
190  allocated_current_ += size;
191  return res;
192}
193
194// ---------------------- DescribeAddress -------------------- {{{1
195static bool DescribeStackAddress(uintptr_t addr, uintptr_t access_size) {
196  AsanThread *t = asanThreadRegistry().FindThreadByStackAddress(addr);
197  if (!t) return false;
198  const intptr_t kBufSize = 4095;
199  char buf[kBufSize];
200  uintptr_t offset = 0;
201  const char *frame_descr = t->GetFrameNameByAddr(addr, &offset);
202  // This string is created by the compiler and has the following form:
203  // "FunctioName n alloc_1 alloc_2 ... alloc_n"
204  // where alloc_i looks like "offset size len ObjectName ".
205  CHECK(frame_descr);
206  // Report the function name and the offset.
207  const char *name_end = real_strchr(frame_descr, ' ');
208  CHECK(name_end);
209  buf[0] = 0;
210  strncat(buf, frame_descr,
211          Min(kBufSize, static_cast<intptr_t>(name_end - frame_descr)));
212  Printf("Address %p is located at offset %ld "
213         "in frame <%s> of T%d's stack:\n",
214         addr, offset, buf, t->tid());
215  // Report the number of stack objects.
216  char *p;
217  size_t n_objects = strtol(name_end, &p, 10);
218  CHECK(n_objects > 0);
219  Printf("  This frame has %ld object(s):\n", n_objects);
220  // Report all objects in this frame.
221  for (size_t i = 0; i < n_objects; i++) {
222    size_t beg, size;
223    intptr_t len;
224    beg  = strtol(p, &p, 10);
225    size = strtol(p, &p, 10);
226    len  = strtol(p, &p, 10);
227    if (beg <= 0 || size <= 0 || len < 0 || *p != ' ') {
228      Printf("AddressSanitizer can't parse the stack frame descriptor: |%s|\n",
229             frame_descr);
230      break;
231    }
232    p++;
233    buf[0] = 0;
234    strncat(buf, p, Min(kBufSize, len));
235    p += len;
236    Printf("    [%ld, %ld) '%s'\n", beg, beg + size, buf);
237  }
238  Printf("HINT: this may be a false positive if your program uses "
239         "some custom stack unwind mechanism\n"
240         "      (longjmp and C++ exceptions *are* supported)\n");
241  t->summary()->Announce();
242  return true;
243}
244
245__attribute__((noinline))
246static void DescribeAddress(uintptr_t addr, uintptr_t access_size) {
247  // Check if this is a global.
248  if (DescribeAddrIfGlobal(addr))
249    return;
250
251  if (DescribeStackAddress(addr, access_size))
252    return;
253
254  // finally, check if this is a heap.
255  DescribeHeapAddress(addr, access_size);
256}
257
258// -------------------------- Run-time entry ------------------- {{{1
259void GetPcSpBpAx(void *context,
260                 uintptr_t *pc, uintptr_t *sp, uintptr_t *bp, uintptr_t *ax) {
261  ucontext_t *ucontext = (ucontext_t*)context;
262#ifdef __APPLE__
263# if __WORDSIZE == 64
264  *pc = ucontext->uc_mcontext->__ss.__rip;
265  *bp = ucontext->uc_mcontext->__ss.__rbp;
266  *sp = ucontext->uc_mcontext->__ss.__rsp;
267  *ax = ucontext->uc_mcontext->__ss.__rax;
268# else
269  *pc = ucontext->uc_mcontext->__ss.__eip;
270  *bp = ucontext->uc_mcontext->__ss.__ebp;
271  *sp = ucontext->uc_mcontext->__ss.__esp;
272  *ax = ucontext->uc_mcontext->__ss.__eax;
273# endif  // __WORDSIZE
274#else  // assume linux
275# if defined(__arm__)
276  *pc = ucontext->uc_mcontext.arm_pc;
277  *bp = ucontext->uc_mcontext.arm_fp;
278  *sp = ucontext->uc_mcontext.arm_sp;
279  *ax = ucontext->uc_mcontext.arm_r0;
280# elif __WORDSIZE == 64
281  *pc = ucontext->uc_mcontext.gregs[REG_RIP];
282  *bp = ucontext->uc_mcontext.gregs[REG_RBP];
283  *sp = ucontext->uc_mcontext.gregs[REG_RSP];
284  *ax = ucontext->uc_mcontext.gregs[REG_RAX];
285# else
286  *pc = ucontext->uc_mcontext.gregs[REG_EIP];
287  *bp = ucontext->uc_mcontext.gregs[REG_EBP];
288  *sp = ucontext->uc_mcontext.gregs[REG_ESP];
289  *ax = ucontext->uc_mcontext.gregs[REG_EAX];
290# endif  // __WORDSIZE
291#endif
292}
293
294static void     ASAN_OnSIGSEGV(int, siginfo_t *siginfo, void *context) {
295  uintptr_t addr = (uintptr_t)siginfo->si_addr;
296  if (AddrIsInShadow(addr) && FLAG_lazy_shadow) {
297    // We traped on access to a shadow address. Just map a large chunk around
298    // this address.
299    const uintptr_t chunk_size = kPageSize << 10;  // 4M
300    uintptr_t chunk = addr & ~(chunk_size - 1);
301    asan_mmap((void*)chunk, chunk_size,
302                   PROT_READ | PROT_WRITE,
303                   MAP_PRIVATE | MAP_ANON | MAP_FIXED, 0, 0);
304    return;
305  }
306  // Write the first message using the bullet-proof write.
307  if (13 != asan_write(2, "ASAN:SIGSEGV\n", 13)) ASAN_DIE;
308  uintptr_t pc, sp, bp, ax;
309  GetPcSpBpAx(context, &pc, &sp, &bp, &ax);
310  Report("ERROR: AddressSanitizer crashed on unknown address %p"
311         " (pc %p sp %p bp %p ax %p T%d)\n",
312         addr, pc, sp, bp, ax,
313         asanThreadRegistry().GetCurrentTidOrMinusOne());
314  Printf("AddressSanitizer can not provide additional info. ABORTING\n");
315  GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, false, pc, bp);
316  stack.PrintStack();
317  ShowStatsAndAbort();
318}
319
320static void     ASAN_OnSIGILL(int, siginfo_t *siginfo, void *context) {
321  // Write the first message using the bullet-proof write.
322  if (12 != asan_write(2, "ASAN:SIGILL\n", 12)) ASAN_DIE;
323  uintptr_t pc, sp, bp, ax;
324  GetPcSpBpAx(context, &pc, &sp, &bp, &ax);
325
326  uintptr_t addr = ax;
327
328  uint8_t *insn = (uint8_t*)pc;
329  CHECK(insn[0] == 0x0f && insn[1] == 0x0b);  // ud2
330  unsigned access_size_and_type = insn[2] - 0x50;
331  CHECK(access_size_and_type < 16);
332  bool is_write = access_size_and_type & 8;
333  int access_size = 1 << (access_size_and_type & 7);
334  __asan_report_error(pc, bp, sp, addr, is_write, access_size);
335}
336
337// exported functions
338#define ASAN_REPORT_ERROR(type, is_write, size) \
339extern "C" void __asan_report_ ## type ## size(uintptr_t addr)   \
340  __attribute__((visibility("default")));                        \
341extern "C" void __asan_report_ ## type ## size(uintptr_t addr) { \
342  GET_BP_PC_SP;                                                  \
343  __asan_report_error(pc, bp, sp, addr, is_write, size);  \
344}
345
346ASAN_REPORT_ERROR(load, false, 1)
347ASAN_REPORT_ERROR(load, false, 2)
348ASAN_REPORT_ERROR(load, false, 4)
349ASAN_REPORT_ERROR(load, false, 8)
350ASAN_REPORT_ERROR(load, false, 16)
351ASAN_REPORT_ERROR(store, true, 1)
352ASAN_REPORT_ERROR(store, true, 2)
353ASAN_REPORT_ERROR(store, true, 4)
354ASAN_REPORT_ERROR(store, true, 8)
355ASAN_REPORT_ERROR(store, true, 16)
356
357// Force the linker to keep the symbols for various ASan interface functions.
358// We want to keep those in the executable in order to let the instrumented
359// dynamic libraries access the symbol even if it is not used by the executable
360// itself. This should help if the build system is removing dead code at link
361// time.
362extern "C"
363void __asan_force_interface_symbols() {
364  volatile int fake_condition = 0;  // prevent dead condition elimination.
365  if (fake_condition) {
366    __asan_report_load1(NULL);
367    __asan_report_load2(NULL);
368    __asan_report_load4(NULL);
369    __asan_report_load8(NULL);
370    __asan_report_load16(NULL);
371    __asan_report_store1(NULL);
372    __asan_report_store2(NULL);
373    __asan_report_store4(NULL);
374    __asan_report_store8(NULL);
375    __asan_report_store16(NULL);
376    __asan_register_global(0, 0, NULL);
377    __asan_register_globals(NULL, 0);
378  }
379}
380
381// -------------------------- Init ------------------- {{{1
382static int64_t IntFlagValue(const char *flags, const char *flag,
383                            int64_t default_val) {
384  if (!flags) return default_val;
385  const char *str = strstr(flags, flag);
386  if (!str) return default_val;
387  return atoll(str + internal_strlen(flag));
388}
389
390static void asan_atexit() {
391  Printf("AddressSanitizer exit stats:\n");
392  __asan_print_accumulated_stats();
393}
394
395void CheckFailed(const char *cond, const char *file, int line) {
396  Report("CHECK failed: %s at %s:%d, pthread_self=%p\n",
397         cond, file, line, pthread_self());
398  PRINT_CURRENT_STACK();
399  ShowStatsAndAbort();
400}
401
402}  // namespace __asan
403
404// -------------------------- Interceptors ------------------- {{{1
405using namespace __asan;  // NOLINT
406
407#define OPERATOR_NEW_BODY \
408  GET_STACK_TRACE_HERE_FOR_MALLOC;\
409  return asan_memalign(0, size, &stack);
410
411void *operator new(size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; }
412void *operator new[](size_t size) throw(std::bad_alloc) { OPERATOR_NEW_BODY; }
413void *operator new(size_t size, std::nothrow_t const&) throw()
414{ OPERATOR_NEW_BODY; }
415void *operator new[](size_t size, std::nothrow_t const&) throw()
416{ OPERATOR_NEW_BODY; }
417
418#define OPERATOR_DELETE_BODY \
419  GET_STACK_TRACE_HERE_FOR_FREE(ptr);\
420  asan_free(ptr, &stack);
421
422void operator delete(void *ptr) throw() { OPERATOR_DELETE_BODY; }
423void operator delete[](void *ptr) throw() { OPERATOR_DELETE_BODY; }
424void operator delete(void *ptr, std::nothrow_t const&) throw()
425{ OPERATOR_DELETE_BODY; }
426void operator delete[](void *ptr, std::nothrow_t const&) throw()
427{ OPERATOR_DELETE_BODY;}
428
429extern "C"
430#ifndef __APPLE__
431__attribute__((visibility("default")))
432#endif
433int WRAP(pthread_create)(pthread_t *thread, const pthread_attr_t *attr,
434                         void *(*start_routine) (void *), void *arg) {
435  GET_STACK_TRACE_HERE(kStackTraceMax, /*fast_unwind*/false);
436  AsanThread *t = (AsanThread*)asan_malloc(sizeof(AsanThread), &stack);
437  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
438  CHECK(curr_thread || asanThreadRegistry().IsCurrentThreadDying());
439  new(t) AsanThread(asanThreadRegistry().GetCurrentTidOrMinusOne(),
440                    start_routine, arg, &stack);
441  return real_pthread_create(thread, attr, asan_thread_start, t);
442}
443
444static bool MySignal(int signum) {
445  if (FLAG_handle_sigill && signum == SIGILL) return true;
446  if (FLAG_handle_segv && signum == SIGSEGV) return true;
447#ifdef __APPLE__
448  if (FLAG_handle_segv && signum == SIGBUS) return true;
449#endif
450  return false;
451}
452
453static void MaybeInstallSigaction(int signum,
454                                  void (*handler)(int, siginfo_t *, void *)) {
455  if (!MySignal(signum))
456    return;
457  struct sigaction sigact;
458  real_memset(&sigact, 0, sizeof(sigact));
459  sigact.sa_sigaction = handler;
460  sigact.sa_flags = SA_SIGINFO;
461  CHECK(0 == real_sigaction(signum, &sigact, 0));
462}
463
464extern "C"
465sig_t WRAP(signal)(int signum, sig_t handler) {
466  if (!MySignal(signum)) {
467    return real_signal(signum, handler);
468  }
469  return NULL;
470}
471
472extern "C"
473int WRAP(sigaction)(int signum, const struct sigaction *act,
474                    struct sigaction *oldact) {
475  if (!MySignal(signum)) {
476    return real_sigaction(signum, act, oldact);
477  }
478  return 0;
479}
480
481
482static void UnpoisonStackFromHereToTop() {
483  int local_stack;
484  AsanThread *curr_thread = asanThreadRegistry().GetCurrent();
485  CHECK(curr_thread);
486  uintptr_t top = curr_thread->stack_top();
487  uintptr_t bottom = ((uintptr_t)&local_stack - kPageSize) & ~(kPageSize-1);
488  PoisonShadow(bottom, top - bottom, 0);
489}
490
491extern "C" void WRAP(longjmp)(void *env, int val) {
492  UnpoisonStackFromHereToTop();
493  real_longjmp(env, val);
494}
495
496extern "C" void WRAP(_longjmp)(void *env, int val) {
497  UnpoisonStackFromHereToTop();
498  real__longjmp(env, val);
499}
500
501extern "C" void WRAP(siglongjmp)(void *env, int val) {
502  UnpoisonStackFromHereToTop();
503  real_siglongjmp(env, val);
504}
505
506extern "C" void __cxa_throw(void *a, void *b, void *c);
507
508#if ASAN_HAS_EXCEPTIONS
509extern "C" void WRAP(__cxa_throw)(void *a, void *b, void *c) {
510  UnpoisonStackFromHereToTop();
511  real___cxa_throw(a, b, c);
512}
513#endif
514
515extern "C" {
516// intercept mlock and friends.
517// Since asan maps 16T of RAM, mlock is completely unfriendly to asan.
518// All functions return 0 (success).
519static void MlockIsUnsupported() {
520  static bool printed = 0;
521  if (printed) return;
522  printed = true;
523  Printf("INFO: AddressSanitizer ignores mlock/mlockall/munlock/munlockall\n");
524}
525int mlock(const void *addr, size_t len) {
526  MlockIsUnsupported();
527  return 0;
528}
529int munlock(const void *addr, size_t len) {
530  MlockIsUnsupported();
531  return 0;
532}
533int mlockall(int flags) {
534  MlockIsUnsupported();
535  return 0;
536}
537int munlockall(void) {
538  MlockIsUnsupported();
539  return 0;
540}
541}  // extern "C"
542
543// ---------------------- Interface ---------------- {{{1
544int __asan_set_error_exit_code(int exit_code) {
545  int old = FLAG_exitcode;
546  FLAG_exitcode = exit_code;
547  return old;
548}
549
550void __asan_report_error(uintptr_t pc, uintptr_t bp, uintptr_t sp,
551                         uintptr_t addr, bool is_write, size_t access_size) {
552  // Do not print more than one report, otherwise they will mix up.
553  static int num_calls = 0;
554  if (AtomicInc(&num_calls) > 1) return;
555
556  Printf("=================================================================\n");
557  const char *bug_descr = "unknown-crash";
558  if (AddrIsInMem(addr)) {
559    uint8_t *shadow_addr = (uint8_t*)MemToShadow(addr);
560    uint8_t shadow_byte = shadow_addr[0];
561    if (shadow_byte > 0 && shadow_byte < 128) {
562      // we are in the partial right redzone, look at the next shadow byte.
563      shadow_byte = shadow_addr[1];
564    }
565    switch (shadow_byte) {
566      case kAsanHeapLeftRedzoneMagic:
567      case kAsanHeapRightRedzoneMagic:
568        bug_descr = "heap-buffer-overflow";
569        break;
570      case kAsanHeapFreeMagic:
571        bug_descr = "heap-use-after-free";
572        break;
573      case kAsanStackLeftRedzoneMagic:
574        bug_descr = "stack-buffer-underflow";
575        break;
576      case kAsanStackMidRedzoneMagic:
577      case kAsanStackRightRedzoneMagic:
578      case kAsanStackPartialRedzoneMagic:
579        bug_descr = "stack-buffer-overflow";
580        break;
581      case kAsanStackAfterReturnMagic:
582        bug_descr = "stack-use-after-return";
583        break;
584      case kAsanUserPoisonedMemoryMagic:
585        bug_descr = "use-after-poison";
586        break;
587      case kAsanGlobalRedzoneMagic:
588        bug_descr = "global-buffer-overflow";
589        break;
590    }
591  }
592
593  Report("ERROR: AddressSanitizer %s on address "
594         "%p at pc 0x%lx bp 0x%lx sp 0x%lx\n",
595         bug_descr, addr, pc, bp, sp);
596
597  Printf("%s of size %d at %p thread T%d\n",
598         access_size ? (is_write ? "WRITE" : "READ") : "ACCESS",
599         access_size, addr, asanThreadRegistry().GetCurrentTidOrMinusOne());
600
601  if (FLAG_debug) {
602    PrintBytes("PC: ", (uintptr_t*)pc);
603  }
604
605  GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax,
606                                 false,  // FLAG_fast_unwind,
607                                 pc, bp);
608  stack.PrintStack();
609
610  CHECK(AddrIsInMem(addr));
611
612  DescribeAddress(addr, access_size);
613
614  uintptr_t shadow_addr = MemToShadow(addr);
615  Report("ABORTING\n");
616  __asan_print_accumulated_stats();
617  Printf("Shadow byte and word:\n");
618  Printf("  %p: %x\n", shadow_addr, *(unsigned char*)shadow_addr);
619  uintptr_t aligned_shadow = shadow_addr & ~(kWordSize - 1);
620  PrintBytes("  ", (uintptr_t*)(aligned_shadow));
621  Printf("More shadow bytes:\n");
622  PrintBytes("  ", (uintptr_t*)(aligned_shadow-4*kWordSize));
623  PrintBytes("  ", (uintptr_t*)(aligned_shadow-3*kWordSize));
624  PrintBytes("  ", (uintptr_t*)(aligned_shadow-2*kWordSize));
625  PrintBytes("  ", (uintptr_t*)(aligned_shadow-1*kWordSize));
626  PrintBytes("=>", (uintptr_t*)(aligned_shadow+0*kWordSize));
627  PrintBytes("  ", (uintptr_t*)(aligned_shadow+1*kWordSize));
628  PrintBytes("  ", (uintptr_t*)(aligned_shadow+2*kWordSize));
629  PrintBytes("  ", (uintptr_t*)(aligned_shadow+3*kWordSize));
630  PrintBytes("  ", (uintptr_t*)(aligned_shadow+4*kWordSize));
631  ASAN_DIE;
632}
633
634void __asan_init() {
635  if (asan_inited) return;
636  asan_init_is_running = true;
637
638  // Make sure we are not statically linked.
639  AsanDoesNotSupportStaticLinkage();
640
641  // flags
642  const char *options = getenv("ASAN_OPTIONS");
643  FLAG_malloc_context_size =
644      IntFlagValue(options, "malloc_context_size=", kMallocContextSize);
645  CHECK(FLAG_malloc_context_size <= kMallocContextSize);
646
647  FLAG_max_malloc_fill_size =
648      IntFlagValue(options, "max_malloc_fill_size=", 0);
649
650  FLAG_v = IntFlagValue(options, "verbosity=", 0);
651
652  FLAG_redzone = IntFlagValue(options, "redzone=", 128);
653  CHECK(FLAG_redzone >= 32);
654  CHECK((FLAG_redzone & (FLAG_redzone - 1)) == 0);
655
656  FLAG_atexit = IntFlagValue(options, "atexit=", 0);
657  FLAG_poison_shadow = IntFlagValue(options, "poison_shadow=", 1);
658  FLAG_report_globals = IntFlagValue(options, "report_globals=", 1);
659  FLAG_lazy_shadow = IntFlagValue(options, "lazy_shadow=", 0);
660  FLAG_handle_segv = IntFlagValue(options, "handle_segv=",
661                                         ASAN_NEEDS_SEGV);
662  FLAG_handle_sigill = IntFlagValue(options, "handle_sigill=", 0);
663  FLAG_stats = IntFlagValue(options, "stats=", 0);
664  FLAG_symbolize = IntFlagValue(options, "symbolize=", 1);
665  FLAG_demangle = IntFlagValue(options, "demangle=", 1);
666  FLAG_debug = IntFlagValue(options, "debug=", 0);
667  FLAG_replace_cfallocator = IntFlagValue(options, "replace_cfallocator=", 1);
668  FLAG_fast_unwind = IntFlagValue(options, "fast_unwind=", 1);
669  FLAG_mt = IntFlagValue(options, "mt=", 1);
670  FLAG_replace_str = IntFlagValue(options, "replace_str=", 1);
671  FLAG_replace_intrin = IntFlagValue(options, "replace_intrin=", 0);
672  FLAG_use_fake_stack = IntFlagValue(options, "use_fake_stack=", 1);
673  FLAG_exitcode = IntFlagValue(options, "exitcode=", EXIT_FAILURE);
674  FLAG_allow_user_poisoning = IntFlagValue(options,
675                                           "allow_user_poisoning=", 1);
676
677  if (FLAG_atexit) {
678    atexit(asan_atexit);
679  }
680
681  FLAG_quarantine_size =
682      IntFlagValue(options, "quarantine_size=", 1UL << 28);
683
684  // interceptors
685  InitializeAsanInterceptors();
686
687  ReplaceSystemMalloc();
688
689  INTERCEPT_FUNCTION(sigaction);
690  INTERCEPT_FUNCTION(signal);
691  INTERCEPT_FUNCTION(longjmp);
692  INTERCEPT_FUNCTION(_longjmp);
693  INTERCEPT_FUNCTION(__cxa_throw);
694  INTERCEPT_FUNCTION(pthread_create);
695#ifdef __APPLE__
696  INTERCEPT_FUNCTION(dispatch_async_f);
697  INTERCEPT_FUNCTION(dispatch_sync_f);
698  INTERCEPT_FUNCTION(dispatch_after_f);
699  INTERCEPT_FUNCTION(dispatch_barrier_async_f);
700  INTERCEPT_FUNCTION(dispatch_group_async_f);
701  // We don't need to intercept pthread_workqueue_additem_np() to support the
702  // libdispatch API, but it helps us to debug the unsupported functions. Let's
703  // intercept it only during verbose runs.
704  if (FLAG_v >= 2) {
705    INTERCEPT_FUNCTION(pthread_workqueue_additem_np);
706  }
707#else
708  // On Darwin siglongjmp tailcalls longjmp, so we don't want to intercept it
709  // there.
710  INTERCEPT_FUNCTION(siglongjmp);
711#endif
712
713  MaybeInstallSigaction(SIGSEGV, ASAN_OnSIGSEGV);
714  MaybeInstallSigaction(SIGBUS, ASAN_OnSIGSEGV);
715  MaybeInstallSigaction(SIGILL, ASAN_OnSIGILL);
716
717  if (FLAG_v) {
718    Printf("|| `[%p, %p]` || HighMem    ||\n", kHighMemBeg, kHighMemEnd);
719    Printf("|| `[%p, %p]` || HighShadow ||\n",
720           kHighShadowBeg, kHighShadowEnd);
721    Printf("|| `[%p, %p]` || ShadowGap  ||\n",
722           kShadowGapBeg, kShadowGapEnd);
723    Printf("|| `[%p, %p]` || LowShadow  ||\n",
724           kLowShadowBeg, kLowShadowEnd);
725    Printf("|| `[%p, %p]` || LowMem     ||\n", kLowMemBeg, kLowMemEnd);
726    Printf("MemToShadow(shadow): %p %p %p %p\n",
727           MEM_TO_SHADOW(kLowShadowBeg),
728           MEM_TO_SHADOW(kLowShadowEnd),
729           MEM_TO_SHADOW(kHighShadowBeg),
730           MEM_TO_SHADOW(kHighShadowEnd));
731    Printf("red_zone=%ld\n", FLAG_redzone);
732    Printf("malloc_context_size=%ld\n", (int)FLAG_malloc_context_size);
733    Printf("fast_unwind=%d\n", (int)FLAG_fast_unwind);
734
735    Printf("SHADOW_SCALE: %lx\n", SHADOW_SCALE);
736    Printf("SHADOW_GRANULARITY: %lx\n", SHADOW_GRANULARITY);
737    Printf("SHADOW_OFFSET: %lx\n", SHADOW_OFFSET);
738    CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7);
739  }
740
741  if (__WORDSIZE == 64) {
742    // Disable core dumper -- it makes little sense to dump 16T+ core.
743    struct rlimit nocore;
744    nocore.rlim_cur = 0;
745    nocore.rlim_max = 0;
746    setrlimit(RLIMIT_CORE, &nocore);
747  }
748
749  {
750    if (!FLAG_lazy_shadow) {
751      if (kLowShadowBeg != kLowShadowEnd) {
752        // mmap the low shadow plus one page.
753        mmap_range(kLowShadowBeg - kPageSize, kLowShadowEnd, "LowShadow");
754      }
755      // mmap the high shadow.
756      mmap_range(kHighShadowBeg, kHighShadowEnd, "HighShadow");
757    }
758    // protect the gap
759    protect_range(kShadowGapBeg, kShadowGapEnd);
760  }
761
762  // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited
763  // should be set to 1 prior to initializing the threads.
764  asan_inited = 1;
765  asan_init_is_running = false;
766
767  asanThreadRegistry().Init();
768  asanThreadRegistry().GetMain()->ThreadStart();
769  __asan_force_interface_symbols();  // no-op.
770
771  if (FLAG_v) {
772    Report("AddressSanitizer Init done\n");
773  }
774}
775