asan_globals.cc revision cdce50bda3603770cc4ef80cbb613c78b8e47a17
1//===-- asan_globals.cc ---------------------------------------------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file is a part of AddressSanitizer, an address sanity checker. 11// 12// Handle globals. 13//===----------------------------------------------------------------------===// 14#include "asan_interceptors.h" 15#include "asan_internal.h" 16#include "asan_mapping.h" 17#include "asan_poisoning.h" 18#include "asan_report.h" 19#include "asan_stack.h" 20#include "asan_stats.h" 21#include "asan_suppressions.h" 22#include "asan_thread.h" 23#include "sanitizer_common/sanitizer_common.h" 24#include "sanitizer_common/sanitizer_mutex.h" 25#include "sanitizer_common/sanitizer_placement_new.h" 26#include "sanitizer_common/sanitizer_stackdepot.h" 27 28namespace __asan { 29 30typedef __asan_global Global; 31 32struct ListOfGlobals { 33 const Global *g; 34 ListOfGlobals *next; 35}; 36 37static BlockingMutex mu_for_globals(LINKER_INITIALIZED); 38static LowLevelAllocator allocator_for_globals; 39static ListOfGlobals *list_of_all_globals; 40 41static const int kDynamicInitGlobalsInitialCapacity = 512; 42struct DynInitGlobal { 43 Global g; 44 bool initialized; 45}; 46typedef InternalMmapVector<DynInitGlobal> VectorOfGlobals; 47// Lazy-initialized and never deleted. 48static VectorOfGlobals *dynamic_init_globals; 49 50// We want to remember where a certain range of globals was registered. 51struct GlobalRegistrationSite { 52 u32 stack_id; 53 Global *g_first, *g_last; 54}; 55typedef InternalMmapVector<GlobalRegistrationSite> GlobalRegistrationSiteVector; 56static GlobalRegistrationSiteVector *global_registration_site_vector; 57 58ALWAYS_INLINE void PoisonShadowForGlobal(const Global *g, u8 value) { 59 FastPoisonShadow(g->beg, g->size_with_redzone, value); 60} 61 62ALWAYS_INLINE void PoisonRedZones(const Global &g) { 63 uptr aligned_size = RoundUpTo(g.size, SHADOW_GRANULARITY); 64 FastPoisonShadow(g.beg + aligned_size, g.size_with_redzone - aligned_size, 65 kAsanGlobalRedzoneMagic); 66 if (g.size != aligned_size) { 67 FastPoisonShadowPartialRightRedzone( 68 g.beg + RoundDownTo(g.size, SHADOW_GRANULARITY), 69 g.size % SHADOW_GRANULARITY, 70 SHADOW_GRANULARITY, 71 kAsanGlobalRedzoneMagic); 72 } 73} 74 75const uptr kMinimalDistanceFromAnotherGlobal = 64; 76 77static bool IsAddressNearGlobal(uptr addr, const __asan_global &g) { 78 if (addr <= g.beg - kMinimalDistanceFromAnotherGlobal) return false; 79 if (addr >= g.beg + g.size_with_redzone) return false; 80 return true; 81} 82 83static void ReportGlobal(const Global &g, const char *prefix) { 84 Report("%s Global[%p]: beg=%p size=%zu/%zu name=%s module=%s dyn_init=%zu\n", 85 prefix, &g, (void *)g.beg, g.size, g.size_with_redzone, g.name, 86 g.module_name, g.has_dynamic_init); 87 if (g.location) { 88 Report(" location (%p): name=%s[%p], %d %d\n", g.location, 89 g.location->filename, g.location->filename, g.location->line_no, 90 g.location->column_no); 91 } 92} 93 94static u32 FindRegistrationSite(const Global *g) { 95 mu_for_globals.CheckLocked(); 96 CHECK(global_registration_site_vector); 97 for (uptr i = 0, n = global_registration_site_vector->size(); i < n; i++) { 98 GlobalRegistrationSite &grs = (*global_registration_site_vector)[i]; 99 if (g >= grs.g_first && g <= grs.g_last) 100 return grs.stack_id; 101 } 102 return 0; 103} 104 105int GetGlobalsForAddress(uptr addr, Global *globals, u32 *reg_sites, 106 int max_globals) { 107 if (!flags()->report_globals) return 0; 108 BlockingMutexLock lock(&mu_for_globals); 109 int res = 0; 110 for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) { 111 const Global &g = *l->g; 112 if (flags()->report_globals >= 2) 113 ReportGlobal(g, "Search"); 114 if (IsAddressNearGlobal(addr, g)) { 115 globals[res] = g; 116 if (reg_sites) 117 reg_sites[res] = FindRegistrationSite(&g); 118 res++; 119 if (res == max_globals) break; 120 } 121 } 122 return res; 123} 124 125bool GetInfoForAddressIfGlobal(uptr addr, AddressDescription *descr) { 126 Global g = {}; 127 if (GetGlobalsForAddress(addr, &g, nullptr, 1)) { 128 internal_strncpy(descr->name, g.name, descr->name_size); 129 descr->region_address = g.beg; 130 descr->region_size = g.size; 131 descr->region_kind = "global"; 132 return true; 133 } 134 return false; 135} 136 137// Register a global variable. 138// This function may be called more than once for every global 139// so we store the globals in a map. 140static void RegisterGlobal(const Global *g) { 141 CHECK(asan_inited); 142 if (flags()->report_globals >= 2) 143 ReportGlobal(*g, "Added"); 144 CHECK(flags()->report_globals); 145 CHECK(AddrIsInMem(g->beg)); 146 CHECK(AddrIsAlignedByGranularity(g->beg)); 147 CHECK(AddrIsAlignedByGranularity(g->size_with_redzone)); 148 if (flags()->detect_odr_violation) { 149 // Try detecting ODR (One Definition Rule) violation, i.e. the situation 150 // where two globals with the same name are defined in different modules. 151 if (__asan_region_is_poisoned(g->beg, g->size_with_redzone)) { 152 // This check may not be enough: if the first global is much larger 153 // the entire redzone of the second global may be within the first global. 154 for (ListOfGlobals *l = list_of_all_globals; l; l = l->next) { 155 if (g->beg == l->g->beg && 156 (flags()->detect_odr_violation >= 2 || g->size != l->g->size) && 157 !IsODRViolationSuppressed(g->name)) 158 ReportODRViolation(g, FindRegistrationSite(g), 159 l->g, FindRegistrationSite(l->g)); 160 } 161 } 162 } 163 if (CanPoisonMemory()) 164 PoisonRedZones(*g); 165 ListOfGlobals *l = new(allocator_for_globals) ListOfGlobals; 166 l->g = g; 167 l->next = list_of_all_globals; 168 list_of_all_globals = l; 169 if (g->has_dynamic_init) { 170 if (dynamic_init_globals == 0) { 171 dynamic_init_globals = new(allocator_for_globals) 172 VectorOfGlobals(kDynamicInitGlobalsInitialCapacity); 173 } 174 DynInitGlobal dyn_global = { *g, false }; 175 dynamic_init_globals->push_back(dyn_global); 176 } 177} 178 179static void UnregisterGlobal(const Global *g) { 180 CHECK(asan_inited); 181 if (flags()->report_globals >= 2) 182 ReportGlobal(*g, "Removed"); 183 CHECK(flags()->report_globals); 184 CHECK(AddrIsInMem(g->beg)); 185 CHECK(AddrIsAlignedByGranularity(g->beg)); 186 CHECK(AddrIsAlignedByGranularity(g->size_with_redzone)); 187 if (CanPoisonMemory()) 188 PoisonShadowForGlobal(g, 0); 189 // We unpoison the shadow memory for the global but we do not remove it from 190 // the list because that would require O(n^2) time with the current list 191 // implementation. It might not be worth doing anyway. 192} 193 194void StopInitOrderChecking() { 195 BlockingMutexLock lock(&mu_for_globals); 196 if (!flags()->check_initialization_order || !dynamic_init_globals) 197 return; 198 flags()->check_initialization_order = false; 199 for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) { 200 DynInitGlobal &dyn_g = (*dynamic_init_globals)[i]; 201 const Global *g = &dyn_g.g; 202 // Unpoison the whole global. 203 PoisonShadowForGlobal(g, 0); 204 // Poison redzones back. 205 PoisonRedZones(*g); 206 } 207} 208 209} // namespace __asan 210 211// ---------------------- Interface ---------------- {{{1 212using namespace __asan; // NOLINT 213 214// Register an array of globals. 215void __asan_register_globals(__asan_global *globals, uptr n) { 216 if (!flags()->report_globals) return; 217 GET_STACK_TRACE_MALLOC; 218 u32 stack_id = StackDepotPut(stack); 219 BlockingMutexLock lock(&mu_for_globals); 220 if (!global_registration_site_vector) 221 global_registration_site_vector = 222 new(allocator_for_globals) GlobalRegistrationSiteVector(128); 223 GlobalRegistrationSite site = {stack_id, &globals[0], &globals[n - 1]}; 224 global_registration_site_vector->push_back(site); 225 if (flags()->report_globals >= 2) { 226 PRINT_CURRENT_STACK(); 227 Printf("=== ID %d; %p %p\n", stack_id, &globals[0], &globals[n - 1]); 228 } 229 for (uptr i = 0; i < n; i++) { 230 RegisterGlobal(&globals[i]); 231 } 232} 233 234// Unregister an array of globals. 235// We must do this when a shared objects gets dlclosed. 236void __asan_unregister_globals(__asan_global *globals, uptr n) { 237 if (!flags()->report_globals) return; 238 BlockingMutexLock lock(&mu_for_globals); 239 for (uptr i = 0; i < n; i++) { 240 UnregisterGlobal(&globals[i]); 241 } 242} 243 244// This method runs immediately prior to dynamic initialization in each TU, 245// when all dynamically initialized globals are unpoisoned. This method 246// poisons all global variables not defined in this TU, so that a dynamic 247// initializer can only touch global variables in the same TU. 248void __asan_before_dynamic_init(const char *module_name) { 249 if (!flags()->check_initialization_order || 250 !CanPoisonMemory()) 251 return; 252 bool strict_init_order = flags()->strict_init_order; 253 CHECK(dynamic_init_globals); 254 CHECK(module_name); 255 CHECK(asan_inited); 256 BlockingMutexLock lock(&mu_for_globals); 257 if (flags()->report_globals >= 3) 258 Printf("DynInitPoison module: %s\n", module_name); 259 for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) { 260 DynInitGlobal &dyn_g = (*dynamic_init_globals)[i]; 261 const Global *g = &dyn_g.g; 262 if (dyn_g.initialized) 263 continue; 264 if (g->module_name != module_name) 265 PoisonShadowForGlobal(g, kAsanInitializationOrderMagic); 266 else if (!strict_init_order) 267 dyn_g.initialized = true; 268 } 269} 270 271// This method runs immediately after dynamic initialization in each TU, when 272// all dynamically initialized globals except for those defined in the current 273// TU are poisoned. It simply unpoisons all dynamically initialized globals. 274void __asan_after_dynamic_init() { 275 if (!flags()->check_initialization_order || 276 !CanPoisonMemory()) 277 return; 278 CHECK(asan_inited); 279 BlockingMutexLock lock(&mu_for_globals); 280 // FIXME: Optionally report that we're unpoisoning globals from a module. 281 for (uptr i = 0, n = dynamic_init_globals->size(); i < n; ++i) { 282 DynInitGlobal &dyn_g = (*dynamic_init_globals)[i]; 283 const Global *g = &dyn_g.g; 284 if (!dyn_g.initialized) { 285 // Unpoison the whole global. 286 PoisonShadowForGlobal(g, 0); 287 // Poison redzones back. 288 PoisonRedZones(*g); 289 } 290 } 291} 292