1//=-- lsan_common_linux.cc ------------------------------------------------===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file is a part of LeakSanitizer.
11// Implementation of common leak checking functionality. Linux-specific code.
12//
13//===----------------------------------------------------------------------===//
14
15#include "sanitizer_common/sanitizer_platform.h"
16#include "lsan_common.h"
17
18#if CAN_SANITIZE_LEAKS && SANITIZER_LINUX
19#include <link.h>
20
21#include "sanitizer_common/sanitizer_common.h"
22#include "sanitizer_common/sanitizer_flags.h"
23#include "sanitizer_common/sanitizer_linux.h"
24#include "sanitizer_common/sanitizer_stackdepot.h"
25
26namespace __lsan {
27
28static const char kLinkerName[] = "ld";
29// We request 2 modules matching "ld", so we can print a warning if there's more
30// than one match. But only the first one is actually used.
31static char linker_placeholder[2 * sizeof(LoadedModule)] ALIGNED(64);
32static LoadedModule *linker = 0;
33
34static bool IsLinker(const char* full_name) {
35  return LibraryNameIs(full_name, kLinkerName);
36}
37
38void InitializePlatformSpecificModules() {
39  internal_memset(linker_placeholder, 0, sizeof(linker_placeholder));
40  uptr num_matches = GetListOfModules(
41      reinterpret_cast<LoadedModule *>(linker_placeholder), 2, IsLinker);
42  if (num_matches == 1) {
43    linker = reinterpret_cast<LoadedModule *>(linker_placeholder);
44    return;
45  }
46  if (num_matches == 0)
47    VReport(1, "LeakSanitizer: Dynamic linker not found. "
48            "TLS will not be handled correctly.\n");
49  else if (num_matches > 1)
50    VReport(1, "LeakSanitizer: Multiple modules match \"%s\". "
51            "TLS will not be handled correctly.\n", kLinkerName);
52  linker = 0;
53}
54
55static int ProcessGlobalRegionsCallback(struct dl_phdr_info *info, size_t size,
56                                        void *data) {
57  Frontier *frontier = reinterpret_cast<Frontier *>(data);
58  for (uptr j = 0; j < info->dlpi_phnum; j++) {
59    const ElfW(Phdr) *phdr = &(info->dlpi_phdr[j]);
60    // We're looking for .data and .bss sections, which reside in writeable,
61    // loadable segments.
62    if (!(phdr->p_flags & PF_W) || (phdr->p_type != PT_LOAD) ||
63        (phdr->p_memsz == 0))
64      continue;
65    uptr begin = info->dlpi_addr + phdr->p_vaddr;
66    uptr end = begin + phdr->p_memsz;
67    uptr allocator_begin = 0, allocator_end = 0;
68    GetAllocatorGlobalRange(&allocator_begin, &allocator_end);
69    if (begin <= allocator_begin && allocator_begin < end) {
70      CHECK_LE(allocator_begin, allocator_end);
71      CHECK_LT(allocator_end, end);
72      if (begin < allocator_begin)
73        ScanRangeForPointers(begin, allocator_begin, frontier, "GLOBAL",
74                             kReachable);
75      if (allocator_end < end)
76        ScanRangeForPointers(allocator_end, end, frontier, "GLOBAL",
77                             kReachable);
78    } else {
79      ScanRangeForPointers(begin, end, frontier, "GLOBAL", kReachable);
80    }
81  }
82  return 0;
83}
84
85// Scans global variables for heap pointers.
86void ProcessGlobalRegions(Frontier *frontier) {
87  if (!flags()->use_globals) return;
88  dl_iterate_phdr(ProcessGlobalRegionsCallback, frontier);
89}
90
91static uptr GetCallerPC(u32 stack_id, StackDepotReverseMap *map) {
92  CHECK(stack_id);
93  StackTrace stack = map->Get(stack_id);
94  // The top frame is our malloc/calloc/etc. The next frame is the caller.
95  if (stack.size >= 2)
96    return stack.trace[1];
97  return 0;
98}
99
100struct ProcessPlatformAllocParam {
101  Frontier *frontier;
102  StackDepotReverseMap *stack_depot_reverse_map;
103};
104
105// ForEachChunk callback. Identifies unreachable chunks which must be treated as
106// reachable. Marks them as reachable and adds them to the frontier.
107static void ProcessPlatformSpecificAllocationsCb(uptr chunk, void *arg) {
108  CHECK(arg);
109  ProcessPlatformAllocParam *param =
110      reinterpret_cast<ProcessPlatformAllocParam *>(arg);
111  chunk = GetUserBegin(chunk);
112  LsanMetadata m(chunk);
113  if (m.allocated() && m.tag() != kReachable) {
114    u32 stack_id = m.stack_trace_id();
115    uptr caller_pc = 0;
116    if (stack_id > 0)
117      caller_pc = GetCallerPC(stack_id, param->stack_depot_reverse_map);
118    // If caller_pc is unknown, this chunk may be allocated in a coroutine. Mark
119    // it as reachable, as we can't properly report its allocation stack anyway.
120    if (caller_pc == 0 || linker->containsAddress(caller_pc)) {
121      m.set_tag(kReachable);
122      param->frontier->push_back(chunk);
123    }
124  }
125}
126
127// Handles dynamically allocated TLS blocks by treating all chunks allocated
128// from ld-linux.so as reachable.
129// Dynamic TLS blocks contain the TLS variables of dynamically loaded modules.
130// They are allocated with a __libc_memalign() call in allocate_and_init()
131// (elf/dl-tls.c). Glibc won't tell us the address ranges occupied by those
132// blocks, but we can make sure they come from our own allocator by intercepting
133// __libc_memalign(). On top of that, there is no easy way to reach them. Their
134// addresses are stored in a dynamically allocated array (the DTV) which is
135// referenced from the static TLS. Unfortunately, we can't just rely on the DTV
136// being reachable from the static TLS, and the dynamic TLS being reachable from
137// the DTV. This is because the initial DTV is allocated before our interception
138// mechanism kicks in, and thus we don't recognize it as allocated memory. We
139// can't special-case it either, since we don't know its size.
140// Our solution is to include in the root set all allocations made from
141// ld-linux.so (which is where allocate_and_init() is implemented). This is
142// guaranteed to include all dynamic TLS blocks (and possibly other allocations
143// which we don't care about).
144void ProcessPlatformSpecificAllocations(Frontier *frontier) {
145  if (!flags()->use_tls) return;
146  if (!linker) return;
147  StackDepotReverseMap stack_depot_reverse_map;
148  ProcessPlatformAllocParam arg = {frontier, &stack_depot_reverse_map};
149  ForEachChunk(ProcessPlatformSpecificAllocationsCb, &arg);
150}
151
152struct DoStopTheWorldParam {
153  StopTheWorldCallback callback;
154  void *argument;
155};
156
157static int DoStopTheWorldCallback(struct dl_phdr_info *info, size_t size,
158                                  void *data) {
159  DoStopTheWorldParam *param = reinterpret_cast<DoStopTheWorldParam *>(data);
160  StopTheWorld(param->callback, param->argument);
161  return 1;
162}
163
164// LSan calls dl_iterate_phdr() from the tracer task. This may deadlock: if one
165// of the threads is frozen while holding the libdl lock, the tracer will hang
166// in dl_iterate_phdr() forever.
167// Luckily, (a) the lock is reentrant and (b) libc can't distinguish between the
168// tracer task and the thread that spawned it. Thus, if we run the tracer task
169// while holding the libdl lock in the parent thread, we can safely reenter it
170// in the tracer. The solution is to run stoptheworld from a dl_iterate_phdr()
171// callback in the parent thread.
172void DoStopTheWorld(StopTheWorldCallback callback, void *argument) {
173  DoStopTheWorldParam param = {callback, argument};
174  dl_iterate_phdr(DoStopTheWorldCallback, &param);
175}
176
177}  // namespace __lsan
178#endif  // CAN_SANITIZE_LEAKS && SANITIZER_LINUX
179