asan_rtl.cc revision 9cfa194cc62026fc7c6e82f7303eee8ad4d10cf4
1//===-- asan_rtl.cc ---------------------------------------------*- C++ -*-===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Main file of the ASan run-time library. 13//===----------------------------------------------------------------------===// 14#include "asan_allocator.h" 15#include "asan_interceptors.h" 16#include "asan_interface.h" 17#include "asan_internal.h" 18#include "asan_lock.h" 19#include "asan_mapping.h" 20#include "asan_procmaps.h" 21#include "asan_stack.h" 22#include "asan_stats.h" 23#include "asan_thread.h" 24#include "asan_thread_registry.h" 25 26namespace __asan { 27 28// -------------------------- Flags ------------------------- {{{1 29static const size_t kMallocContextSize = 30; 30static int FLAG_atexit; 31 32size_t FLAG_redzone; // power of two, >= 32 33size_t FLAG_quarantine_size; 34int FLAG_demangle; 35bool FLAG_symbolize; 36int FLAG_v; 37int FLAG_debug; 38bool FLAG_poison_shadow; 39int FLAG_report_globals; 40size_t FLAG_malloc_context_size = kMallocContextSize; 41uintptr_t FLAG_large_malloc; 42bool FLAG_handle_segv; 43bool FLAG_replace_str; 44bool FLAG_replace_intrin; 45bool FLAG_replace_cfallocator; // Used on Mac only. 46size_t FLAG_max_malloc_fill_size = 0; 47bool FLAG_use_fake_stack; 48int FLAG_exitcode = EXIT_FAILURE; 49bool FLAG_allow_user_poisoning; 50 51// -------------------------- Globals --------------------- {{{1 52int asan_inited; 53bool asan_init_is_running; 54 55// -------------------------- Misc ---------------- {{{1 56void ShowStatsAndAbort() { 57 __asan_print_accumulated_stats(); 58 AsanDie(); 59} 60 61static void PrintBytes(const char *before, uintptr_t *a) { 62 uint8_t *bytes = (uint8_t*)a; 63 size_t byte_num = (__WORDSIZE) / 8; 64 Printf("%s%p:", before, (uintptr_t)a); 65 for (size_t i = 0; i < byte_num; i++) { 66 Printf(" %lx%lx", bytes[i] >> 4, bytes[i] & 15); 67 } 68 Printf("\n"); 69} 70 71size_t ReadFileToBuffer(const char *file_name, char **buff, 72 size_t *buff_size, size_t max_len) { 73 const size_t kMinFileLen = kPageSize; 74 size_t read_len = 0; 75 *buff = 0; 76 *buff_size = 0; 77 // The files we usually open are not seekable, so try different buffer sizes. 78 for (size_t size = kMinFileLen; size <= max_len; size *= 2) { 79 int fd = AsanOpenReadonly(file_name); 80 if (fd < 0) return -1; 81 AsanUnmapOrDie(*buff, *buff_size); 82 *buff = (char*)AsanMmapSomewhereOrDie(size, __FUNCTION__); 83 *buff_size = size; 84 // Read up to one page at a time. 85 read_len = 0; 86 bool reached_eof = false; 87 while (read_len + kPageSize <= size) { 88 size_t just_read = AsanRead(fd, *buff + read_len, kPageSize); 89 if (just_read == 0) { 90 reached_eof = true; 91 break; 92 } 93 read_len += just_read; 94 } 95 AsanClose(fd); 96 if (reached_eof) // We've read the whole file. 97 break; 98 } 99 return read_len; 100} 101 102// ---------------------- mmap -------------------- {{{1 103void OutOfMemoryMessageAndDie(const char *mem_type, size_t size) { 104 Report("ERROR: AddressSanitizer failed to allocate " 105 "0x%lx (%ld) bytes of %s\n", 106 size, size, mem_type); 107 PRINT_CURRENT_STACK(); 108 ShowStatsAndAbort(); 109} 110 111// Reserve memory range [beg, end]. 112static void ReserveShadowMemoryRange(uintptr_t beg, uintptr_t end) { 113 CHECK((beg % kPageSize) == 0); 114 CHECK(((end + 1) % kPageSize) == 0); 115 size_t size = end - beg + 1; 116 void *res = AsanMmapFixedNoReserve(beg, size); 117 CHECK(res == (void*)beg && "ReserveShadowMemoryRange failed"); 118} 119 120// ---------------------- LowLevelAllocator ------------- {{{1 121void *LowLevelAllocator::Allocate(size_t size) { 122 CHECK((size & (size - 1)) == 0 && "size must be a power of two"); 123 if (allocated_end_ - allocated_current_ < size) { 124 size_t size_to_allocate = Max(size, kPageSize); 125 allocated_current_ = 126 (char*)AsanMmapSomewhereOrDie(size_to_allocate, __FUNCTION__); 127 allocated_end_ = allocated_current_ + size_to_allocate; 128 PoisonShadow((uintptr_t)allocated_current_, size_to_allocate, 129 kAsanInternalHeapMagic); 130 } 131 CHECK(allocated_end_ - allocated_current_ >= size); 132 void *res = allocated_current_; 133 allocated_current_ += size; 134 return res; 135} 136 137// ---------------------- DescribeAddress -------------------- {{{1 138static bool DescribeStackAddress(uintptr_t addr, uintptr_t access_size) { 139 AsanThread *t = asanThreadRegistry().FindThreadByStackAddress(addr); 140 if (!t) return false; 141 const intptr_t kBufSize = 4095; 142 char buf[kBufSize]; 143 uintptr_t offset = 0; 144 const char *frame_descr = t->GetFrameNameByAddr(addr, &offset); 145 // This string is created by the compiler and has the following form: 146 // "FunctioName n alloc_1 alloc_2 ... alloc_n" 147 // where alloc_i looks like "offset size len ObjectName ". 148 CHECK(frame_descr); 149 // Report the function name and the offset. 150 const char *name_end = real_strchr(frame_descr, ' '); 151 CHECK(name_end); 152 buf[0] = 0; 153 internal_strncat(buf, frame_descr, 154 Min(kBufSize, 155 static_cast<intptr_t>(name_end - frame_descr))); 156 Printf("Address %p is located at offset %ld " 157 "in frame <%s> of T%d's stack:\n", 158 addr, offset, buf, t->tid()); 159 // Report the number of stack objects. 160 char *p; 161 size_t n_objects = strtol(name_end, &p, 10); 162 CHECK(n_objects > 0); 163 Printf(" This frame has %ld object(s):\n", n_objects); 164 // Report all objects in this frame. 165 for (size_t i = 0; i < n_objects; i++) { 166 size_t beg, size; 167 intptr_t len; 168 beg = strtol(p, &p, 10); 169 size = strtol(p, &p, 10); 170 len = strtol(p, &p, 10); 171 if (beg <= 0 || size <= 0 || len < 0 || *p != ' ') { 172 Printf("AddressSanitizer can't parse the stack frame descriptor: |%s|\n", 173 frame_descr); 174 break; 175 } 176 p++; 177 buf[0] = 0; 178 internal_strncat(buf, p, Min(kBufSize, len)); 179 p += len; 180 Printf(" [%ld, %ld) '%s'\n", beg, beg + size, buf); 181 } 182 Printf("HINT: this may be a false positive if your program uses " 183 "some custom stack unwind mechanism\n" 184 " (longjmp and C++ exceptions *are* supported)\n"); 185 t->summary()->Announce(); 186 return true; 187} 188 189__attribute__((noinline)) 190static void DescribeAddress(uintptr_t addr, uintptr_t access_size) { 191 // Check if this is a global. 192 if (DescribeAddrIfGlobal(addr)) 193 return; 194 195 if (DescribeStackAddress(addr, access_size)) 196 return; 197 198 // finally, check if this is a heap. 199 DescribeHeapAddress(addr, access_size); 200} 201 202// -------------------------- Run-time entry ------------------- {{{1 203// exported functions 204#define ASAN_REPORT_ERROR(type, is_write, size) \ 205extern "C" void __asan_report_ ## type ## size(uintptr_t addr) \ 206 __attribute__((visibility("default"))) __attribute__((noinline)); \ 207extern "C" void __asan_report_ ## type ## size(uintptr_t addr) { \ 208 GET_BP_PC_SP; \ 209 __asan_report_error(pc, bp, sp, addr, is_write, size); \ 210} 211 212ASAN_REPORT_ERROR(load, false, 1) 213ASAN_REPORT_ERROR(load, false, 2) 214ASAN_REPORT_ERROR(load, false, 4) 215ASAN_REPORT_ERROR(load, false, 8) 216ASAN_REPORT_ERROR(load, false, 16) 217ASAN_REPORT_ERROR(store, true, 1) 218ASAN_REPORT_ERROR(store, true, 2) 219ASAN_REPORT_ERROR(store, true, 4) 220ASAN_REPORT_ERROR(store, true, 8) 221ASAN_REPORT_ERROR(store, true, 16) 222 223// Force the linker to keep the symbols for various ASan interface functions. 224// We want to keep those in the executable in order to let the instrumented 225// dynamic libraries access the symbol even if it is not used by the executable 226// itself. This should help if the build system is removing dead code at link 227// time. 228static void force_interface_symbols() { 229 volatile int fake_condition = 0; // prevent dead condition elimination. 230 if (fake_condition) { 231 __asan_report_load1(NULL); 232 __asan_report_load2(NULL); 233 __asan_report_load4(NULL); 234 __asan_report_load8(NULL); 235 __asan_report_load16(NULL); 236 __asan_report_store1(NULL); 237 __asan_report_store2(NULL); 238 __asan_report_store4(NULL); 239 __asan_report_store8(NULL); 240 __asan_report_store16(NULL); 241 __asan_register_global(0, 0, NULL); 242 __asan_register_globals(NULL, 0); 243 __asan_unregister_globals(NULL, 0); 244 } 245} 246 247// -------------------------- Init ------------------- {{{1 248static int64_t IntFlagValue(const char *flags, const char *flag, 249 int64_t default_val) { 250 if (!flags) return default_val; 251 const char *str = internal_strstr(flags, flag); 252 if (!str) return default_val; 253 return atoll(str + internal_strlen(flag)); 254} 255 256static void asan_atexit() { 257 Printf("AddressSanitizer exit stats:\n"); 258 __asan_print_accumulated_stats(); 259} 260 261void CheckFailed(const char *cond, const char *file, int line) { 262 Report("CHECK failed: %s at %s:%d\n", cond, file, line); 263 PRINT_CURRENT_STACK(); 264 ShowStatsAndAbort(); 265} 266 267} // namespace __asan 268 269// ---------------------- Interface ---------------- {{{1 270using namespace __asan; // NOLINT 271 272int __asan_set_error_exit_code(int exit_code) { 273 int old = FLAG_exitcode; 274 FLAG_exitcode = exit_code; 275 return old; 276} 277 278void __asan_report_error(uintptr_t pc, uintptr_t bp, uintptr_t sp, 279 uintptr_t addr, bool is_write, size_t access_size) { 280 // Do not print more than one report, otherwise they will mix up. 281 static int num_calls = 0; 282 if (AtomicInc(&num_calls) > 1) return; 283 284 Printf("=================================================================\n"); 285 const char *bug_descr = "unknown-crash"; 286 if (AddrIsInMem(addr)) { 287 uint8_t *shadow_addr = (uint8_t*)MemToShadow(addr); 288 // If we are accessing 16 bytes, look at the second shadow byte. 289 if (*shadow_addr == 0 && access_size > SHADOW_GRANULARITY) 290 shadow_addr++; 291 // If we are in the partial right redzone, look at the next shadow byte. 292 if (*shadow_addr > 0 && *shadow_addr < 128) 293 shadow_addr++; 294 switch (*shadow_addr) { 295 case kAsanHeapLeftRedzoneMagic: 296 case kAsanHeapRightRedzoneMagic: 297 bug_descr = "heap-buffer-overflow"; 298 break; 299 case kAsanHeapFreeMagic: 300 bug_descr = "heap-use-after-free"; 301 break; 302 case kAsanStackLeftRedzoneMagic: 303 bug_descr = "stack-buffer-underflow"; 304 break; 305 case kAsanStackMidRedzoneMagic: 306 case kAsanStackRightRedzoneMagic: 307 case kAsanStackPartialRedzoneMagic: 308 bug_descr = "stack-buffer-overflow"; 309 break; 310 case kAsanStackAfterReturnMagic: 311 bug_descr = "stack-use-after-return"; 312 break; 313 case kAsanUserPoisonedMemoryMagic: 314 bug_descr = "use-after-poison"; 315 break; 316 case kAsanGlobalRedzoneMagic: 317 bug_descr = "global-buffer-overflow"; 318 break; 319 } 320 } 321 322 AsanThread *curr_thread = asanThreadRegistry().GetCurrent(); 323 int curr_tid = asanThreadRegistry().GetCurrentTidOrMinusOne(); 324 325 if (curr_thread) { 326 // We started reporting an error message. Stop using the fake stack 327 // in case we will call an instrumented function from a symbolizer. 328 curr_thread->fake_stack().StopUsingFakeStack(); 329 } 330 331 Report("ERROR: AddressSanitizer %s on address " 332 "%p at pc 0x%lx bp 0x%lx sp 0x%lx\n", 333 bug_descr, addr, pc, bp, sp); 334 335 Printf("%s of size %d at %p thread T%d\n", 336 access_size ? (is_write ? "WRITE" : "READ") : "ACCESS", 337 access_size, addr, curr_tid); 338 339 if (FLAG_debug) { 340 PrintBytes("PC: ", (uintptr_t*)pc); 341 } 342 343 GET_STACK_TRACE_WITH_PC_AND_BP(kStackTraceMax, pc, bp); 344 stack.PrintStack(); 345 346 CHECK(AddrIsInMem(addr)); 347 348 DescribeAddress(addr, access_size); 349 350 uintptr_t shadow_addr = MemToShadow(addr); 351 Report("ABORTING\n"); 352 __asan_print_accumulated_stats(); 353 Printf("Shadow byte and word:\n"); 354 Printf(" %p: %x\n", shadow_addr, *(unsigned char*)shadow_addr); 355 uintptr_t aligned_shadow = shadow_addr & ~(kWordSize - 1); 356 PrintBytes(" ", (uintptr_t*)(aligned_shadow)); 357 Printf("More shadow bytes:\n"); 358 PrintBytes(" ", (uintptr_t*)(aligned_shadow-4*kWordSize)); 359 PrintBytes(" ", (uintptr_t*)(aligned_shadow-3*kWordSize)); 360 PrintBytes(" ", (uintptr_t*)(aligned_shadow-2*kWordSize)); 361 PrintBytes(" ", (uintptr_t*)(aligned_shadow-1*kWordSize)); 362 PrintBytes("=>", (uintptr_t*)(aligned_shadow+0*kWordSize)); 363 PrintBytes(" ", (uintptr_t*)(aligned_shadow+1*kWordSize)); 364 PrintBytes(" ", (uintptr_t*)(aligned_shadow+2*kWordSize)); 365 PrintBytes(" ", (uintptr_t*)(aligned_shadow+3*kWordSize)); 366 PrintBytes(" ", (uintptr_t*)(aligned_shadow+4*kWordSize)); 367 AsanDie(); 368} 369 370void __asan_init() { 371 if (asan_inited) return; 372 asan_init_is_running = true; 373 374 // Make sure we are not statically linked. 375 AsanDoesNotSupportStaticLinkage(); 376 377 // flags 378 const char *options = AsanGetEnv("ASAN_OPTIONS"); 379 FLAG_malloc_context_size = 380 IntFlagValue(options, "malloc_context_size=", kMallocContextSize); 381 CHECK(FLAG_malloc_context_size <= kMallocContextSize); 382 383 FLAG_max_malloc_fill_size = 384 IntFlagValue(options, "max_malloc_fill_size=", 0); 385 386 FLAG_v = IntFlagValue(options, "verbosity=", 0); 387 388 FLAG_redzone = IntFlagValue(options, "redzone=", 128); 389 CHECK(FLAG_redzone >= 32); 390 CHECK((FLAG_redzone & (FLAG_redzone - 1)) == 0); 391 392 FLAG_atexit = IntFlagValue(options, "atexit=", 0); 393 FLAG_poison_shadow = IntFlagValue(options, "poison_shadow=", 1); 394 FLAG_report_globals = IntFlagValue(options, "report_globals=", 1); 395 FLAG_handle_segv = IntFlagValue(options, "handle_segv=", ASAN_NEEDS_SEGV); 396 FLAG_symbolize = IntFlagValue(options, "symbolize=", 1); 397 FLAG_demangle = IntFlagValue(options, "demangle=", 1); 398 FLAG_debug = IntFlagValue(options, "debug=", 0); 399 FLAG_replace_cfallocator = IntFlagValue(options, "replace_cfallocator=", 1); 400 FLAG_replace_str = IntFlagValue(options, "replace_str=", 1); 401 FLAG_replace_intrin = IntFlagValue(options, "replace_intrin=", 1); 402 FLAG_use_fake_stack = IntFlagValue(options, "use_fake_stack=", 1); 403 FLAG_exitcode = IntFlagValue(options, "exitcode=", EXIT_FAILURE); 404 FLAG_allow_user_poisoning = IntFlagValue(options, 405 "allow_user_poisoning=", 1); 406 407 if (FLAG_atexit) { 408 atexit(asan_atexit); 409 } 410 411 FLAG_quarantine_size = 412 IntFlagValue(options, "quarantine_size=", 1UL << 28); 413 414 // interceptors 415 InitializeAsanInterceptors(); 416 417 ReplaceSystemMalloc(); 418 InstallSignalHandlers(); 419 420 if (FLAG_v) { 421 Printf("|| `[%p, %p]` || HighMem ||\n", kHighMemBeg, kHighMemEnd); 422 Printf("|| `[%p, %p]` || HighShadow ||\n", 423 kHighShadowBeg, kHighShadowEnd); 424 Printf("|| `[%p, %p]` || ShadowGap ||\n", 425 kShadowGapBeg, kShadowGapEnd); 426 Printf("|| `[%p, %p]` || LowShadow ||\n", 427 kLowShadowBeg, kLowShadowEnd); 428 Printf("|| `[%p, %p]` || LowMem ||\n", kLowMemBeg, kLowMemEnd); 429 Printf("MemToShadow(shadow): %p %p %p %p\n", 430 MEM_TO_SHADOW(kLowShadowBeg), 431 MEM_TO_SHADOW(kLowShadowEnd), 432 MEM_TO_SHADOW(kHighShadowBeg), 433 MEM_TO_SHADOW(kHighShadowEnd)); 434 Printf("red_zone=%ld\n", FLAG_redzone); 435 Printf("malloc_context_size=%ld\n", (int)FLAG_malloc_context_size); 436 437 Printf("SHADOW_SCALE: %lx\n", SHADOW_SCALE); 438 Printf("SHADOW_GRANULARITY: %lx\n", SHADOW_GRANULARITY); 439 Printf("SHADOW_OFFSET: %lx\n", SHADOW_OFFSET); 440 CHECK(SHADOW_SCALE >= 3 && SHADOW_SCALE <= 7); 441 } 442 443 if (__WORDSIZE == 64) { 444 // Disable core dumper -- it makes little sense to dump 16T+ core. 445 AsanDisableCoreDumper(); 446 } 447 448 { 449 if (kLowShadowBeg != kLowShadowEnd) { 450 // mmap the low shadow plus one page. 451 ReserveShadowMemoryRange(kLowShadowBeg - kPageSize, kLowShadowEnd); 452 } 453 // mmap the high shadow. 454 ReserveShadowMemoryRange(kHighShadowBeg, kHighShadowEnd); 455 // protect the gap 456 void *prot = AsanMprotect(kShadowGapBeg, kShadowGapEnd - kShadowGapBeg + 1); 457 CHECK(prot == (void*)kShadowGapBeg); 458 } 459 460 // On Linux AsanThread::ThreadStart() calls malloc() that's why asan_inited 461 // should be set to 1 prior to initializing the threads. 462 asan_inited = 1; 463 asan_init_is_running = false; 464 465 asanThreadRegistry().Init(); 466 asanThreadRegistry().GetMain()->ThreadStart(); 467 force_interface_symbols(); // no-op. 468 469 if (FLAG_v) { 470 Report("AddressSanitizer Init done\n"); 471 } 472} 473 474#if defined(ASAN_USE_PREINIT_ARRAY) 475// On Linux, we force __asan_init to be called before anyone else 476// by placing it into .preinit_array section. 477// FIXME: do we have anything like this on Mac? 478__attribute__((section(".preinit_array"))) 479 typeof(__asan_init) *__asan_preinit =__asan_init; 480#endif 481