1 //===-- asan_malloc_mac.cc ------------------------------------------------===//
3 // This file is distributed under the University of Illinois Open Source
4 // License. See LICENSE.TXT for details.
6 //===----------------------------------------------------------------------===//
8 // This file is a part of AddressSanitizer, an address sanity checker.
10 // Mac-specific malloc interception.
11 //===----------------------------------------------------------------------===//
15 #include <AvailabilityMacros.h>
16 #include <CoreFoundation/CFBase.h>
18 #include <malloc/malloc.h>
20 #include "asan_allocator.h"
21 #include "asan_interceptors.h"
22 #include "asan_internal.h"
24 #include "asan_report.h"
25 #include "asan_stack.h"
26 #include "asan_stats.h"
27 #include "asan_thread_registry.h"
29 // Similar code is used in Google Perftools,
30 // http://code.google.com/p/google-perftools.
32 // ---------------------- Replacement functions ---------------- {{{1
33 using namespace __asan
; // NOLINT
35 // TODO(glider): do we need both zones?
36 static malloc_zone_t
*system_malloc_zone
= 0;
37 static malloc_zone_t
*system_purgeable_zone
= 0;
38 static malloc_zone_t asan_zone
;
39 CFAllocatorRef cf_asan
= 0;
41 // _CFRuntimeCreateInstance() checks whether the supplied allocator is
42 // kCFAllocatorSystemDefault and, if it is not, stores the allocator reference
43 // at the beginning of the allocated memory and returns the pointer to the
44 // allocated memory plus sizeof(CFAllocatorRef). See
45 // http://www.opensource.apple.com/source/CF/CF-635.21/CFRuntime.c
46 // Pointers returned by _CFRuntimeCreateInstance() can then be passed directly
47 // to free() or CFAllocatorDeallocate(), which leads to false invalid free
49 // The corresponding rdar bug is http://openradar.appspot.com/radar?id=1796404.
50 void* ALWAYS_INLINE
get_saved_cfallocator_ref(void *ptr
) {
51 if (flags()->replace_cfallocator
) {
52 // Make sure we're not hitting the previous page. This may be incorrect
53 // if ASan's malloc returns an address ending with 0xFF8, which will be
54 // then padded to a page boundary with a CFAllocatorRef.
55 uptr arith_ptr
= (uptr
)ptr
;
56 if ((arith_ptr
& 0xFFF) > sizeof(CFAllocatorRef
)) {
57 CFAllocatorRef
*saved
=
58 (CFAllocatorRef
*)(arith_ptr
- sizeof(CFAllocatorRef
));
59 if ((*saved
== cf_asan
) && asan_mz_size(saved
)) ptr
= (void*)saved
;
65 // The free() implementation provided by OS X calls malloc_zone_from_ptr()
66 // to find the owner of |ptr|. If the result is 0, an invalid free() is
67 // reported. Our implementation falls back to asan_free() in this case
68 // in order to print an ASan-style report.
70 // For the objects created by _CFRuntimeCreateInstance a CFAllocatorRef is
71 // placed at the beginning of the allocated chunk and the pointer returned by
72 // our allocator is off by sizeof(CFAllocatorRef). This pointer can be then
73 // passed directly to free(), which will lead to errors.
74 // To overcome this we're checking whether |ptr-sizeof(CFAllocatorRef)|
75 // contains a pointer to our CFAllocator (assuming no other allocator is used).
76 // See http://code.google.com/p/address-sanitizer/issues/detail?id=70 for more
78 INTERCEPTOR(void, free
, void *ptr
) {
79 malloc_zone_t
*zone
= malloc_zone_from_ptr(ptr
);
81 #if defined(MAC_OS_X_VERSION_10_6) && \
82 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
83 if ((zone
->version
>= 6) && (zone
->free_definite_size
)) {
84 zone
->free_definite_size(zone
, ptr
, malloc_size(ptr
));
86 malloc_zone_free(zone
, ptr
);
89 malloc_zone_free(zone
, ptr
);
92 if (!asan_mz_size(ptr
)) ptr
= get_saved_cfallocator_ref(ptr
);
93 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
94 asan_free(ptr
, &stack
);
99 void ReplaceCFAllocator();
102 // We can't always replace the default CFAllocator with cf_asan right in
103 // ReplaceSystemMalloc(), because it is sometimes called before
104 // __CFInitialize(), when the default allocator is invalid and replacing it may
105 // crash the program. Instead we wait for the allocator to initialize and jump
106 // in just after __CFInitialize(). Nobody is going to allocate memory using
107 // CFAllocators before that, so we won't miss anything.
109 // See http://code.google.com/p/address-sanitizer/issues/detail?id=87
110 // and http://opensource.apple.com/source/CF/CF-550.43/CFRuntime.c
111 INTERCEPTOR(void, __CFInitialize
, void) {
112 // If the runtime is built as dynamic library, __CFInitialize wrapper may be
113 // called before __asan_init.
114 #if !MAC_INTERPOSE_FUNCTIONS
115 CHECK(flags()->replace_cfallocator
);
118 REAL(__CFInitialize
)();
119 if (!cf_asan
&& asan_inited
) ReplaceCFAllocator();
124 // TODO(glider): the mz_* functions should be united with the Linux wrappers,
125 // as they are basically copied from there.
126 size_t mz_size(malloc_zone_t
* zone
, const void* ptr
) {
127 return asan_mz_size(ptr
);
130 void *mz_malloc(malloc_zone_t
*zone
, size_t size
) {
132 CHECK(system_malloc_zone
);
133 return malloc_zone_malloc(system_malloc_zone
, size
);
135 GET_STACK_TRACE_HERE_FOR_MALLOC
;
136 return asan_malloc(size
, &stack
);
139 void *cf_malloc(CFIndex size
, CFOptionFlags hint
, void *info
) {
141 CHECK(system_malloc_zone
);
142 return malloc_zone_malloc(system_malloc_zone
, size
);
144 GET_STACK_TRACE_HERE_FOR_MALLOC
;
145 return asan_malloc(size
, &stack
);
148 void *mz_calloc(malloc_zone_t
*zone
, size_t nmemb
, size_t size
) {
150 // Hack: dlsym calls calloc before REAL(calloc) is retrieved from dlsym.
151 const size_t kCallocPoolSize
= 1024;
152 static uptr calloc_memory_for_dlsym
[kCallocPoolSize
];
153 static size_t allocated
;
154 size_t size_in_words
= ((nmemb
* size
) + kWordSize
- 1) / kWordSize
;
155 void *mem
= (void*)&calloc_memory_for_dlsym
[allocated
];
156 allocated
+= size_in_words
;
157 CHECK(allocated
< kCallocPoolSize
);
160 GET_STACK_TRACE_HERE_FOR_MALLOC
;
161 return asan_calloc(nmemb
, size
, &stack
);
164 void *mz_valloc(malloc_zone_t
*zone
, size_t size
) {
166 CHECK(system_malloc_zone
);
167 return malloc_zone_valloc(system_malloc_zone
, size
);
169 GET_STACK_TRACE_HERE_FOR_MALLOC
;
170 return asan_memalign(kPageSize
, size
, &stack
);
173 #define GET_ZONE_FOR_PTR(ptr) \
174 malloc_zone_t *zone_ptr = malloc_zone_from_ptr(ptr); \
175 const char *zone_name = (zone_ptr == 0) ? 0 : zone_ptr->zone_name
177 void ALWAYS_INLINE
free_common(void *context
, void *ptr
) {
179 if (asan_mz_size(ptr
)) {
180 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
181 asan_free(ptr
, &stack
);
183 // If the pointer does not belong to any of the zones, use one of the
184 // fallback methods to free memory.
185 malloc_zone_t
*zone_ptr
= malloc_zone_from_ptr(ptr
);
186 if (zone_ptr
== system_purgeable_zone
) {
187 // allocations from malloc_default_purgeable_zone() done before
188 // __asan_init() may be occasionally freed via free_common().
189 // see http://code.google.com/p/address-sanitizer/issues/detail?id=99.
190 malloc_zone_free(zone_ptr
, ptr
);
192 // If the memory chunk pointer was moved to store additional
193 // CFAllocatorRef, fix it back.
194 ptr
= get_saved_cfallocator_ref(ptr
);
195 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
196 if (!flags()->mac_ignore_invalid_free
) {
197 asan_free(ptr
, &stack
);
199 GET_ZONE_FOR_PTR(ptr
);
200 WarnMacFreeUnallocated((uptr
)ptr
, (uptr
)zone_ptr
, zone_name
, &stack
);
207 // TODO(glider): the allocation callbacks need to be refactored.
208 void mz_free(malloc_zone_t
*zone
, void *ptr
) {
209 free_common(zone
, ptr
);
212 void cf_free(void *ptr
, void *info
) {
213 free_common(info
, ptr
);
216 void *mz_realloc(malloc_zone_t
*zone
, void *ptr
, size_t size
) {
218 GET_STACK_TRACE_HERE_FOR_MALLOC
;
219 return asan_malloc(size
, &stack
);
221 if (asan_mz_size(ptr
)) {
222 GET_STACK_TRACE_HERE_FOR_MALLOC
;
223 return asan_realloc(ptr
, size
, &stack
);
225 // We can't recover from reallocating an unknown address, because
226 // this would require reading at most |size| bytes from
227 // potentially unaccessible memory.
228 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
229 GET_ZONE_FOR_PTR(ptr
);
230 ReportMacMzReallocUnknown((uptr
)ptr
, (uptr
)zone_ptr
, zone_name
, &stack
);
235 void *cf_realloc(void *ptr
, CFIndex size
, CFOptionFlags hint
, void *info
) {
237 GET_STACK_TRACE_HERE_FOR_MALLOC
;
238 return asan_malloc(size
, &stack
);
240 if (asan_mz_size(ptr
)) {
241 GET_STACK_TRACE_HERE_FOR_MALLOC
;
242 return asan_realloc(ptr
, size
, &stack
);
244 // We can't recover from reallocating an unknown address, because
245 // this would require reading at most |size| bytes from
246 // potentially unaccessible memory.
247 GET_STACK_TRACE_HERE_FOR_FREE(ptr
);
248 GET_ZONE_FOR_PTR(ptr
);
249 ReportMacCfReallocUnknown((uptr
)ptr
, (uptr
)zone_ptr
, zone_name
, &stack
);
254 void mz_destroy(malloc_zone_t
* zone
) {
255 // A no-op -- we will not be destroyed!
256 Printf("mz_destroy() called -- ignoring\n");
258 // from AvailabilityMacros.h
259 #if defined(MAC_OS_X_VERSION_10_6) && \
260 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
261 void *mz_memalign(malloc_zone_t
*zone
, size_t align
, size_t size
) {
263 CHECK(system_malloc_zone
);
264 return malloc_zone_memalign(system_malloc_zone
, align
, size
);
266 GET_STACK_TRACE_HERE_FOR_MALLOC
;
267 return asan_memalign(align
, size
, &stack
);
270 // This function is currently unused, and we build with -Werror.
272 void mz_free_definite_size(malloc_zone_t
* zone
, void *ptr
, size_t size
) {
273 // TODO(glider): check that |size| is valid.
279 kern_return_t
mi_enumerator(task_t task
, void *,
280 unsigned type_mask
, vm_address_t zone_address
,
281 memory_reader_t reader
,
282 vm_range_recorder_t recorder
) {
283 // Should enumerate all the pointers we have. Seems like a lot of work.
287 size_t mi_good_size(malloc_zone_t
*zone
, size_t size
) {
288 // I think it's always safe to return size, but we maybe could do better.
292 boolean_t
mi_check(malloc_zone_t
*zone
) {
297 void mi_print(malloc_zone_t
*zone
, boolean_t verbose
) {
302 void mi_log(malloc_zone_t
*zone
, void *address
) {
303 // I don't think we support anything like this
306 void mi_force_lock(malloc_zone_t
*zone
) {
307 asan_mz_force_lock();
310 void mi_force_unlock(malloc_zone_t
*zone
) {
311 asan_mz_force_unlock();
314 void mi_statistics(malloc_zone_t
*zone
, malloc_statistics_t
*stats
) {
315 AsanMallocStats malloc_stats
;
316 asanThreadRegistry().FillMallocStatistics(&malloc_stats
);
317 CHECK(sizeof(malloc_statistics_t
) == sizeof(AsanMallocStats
));
318 internal_memcpy(stats
, &malloc_stats
, sizeof(malloc_statistics_t
));
321 #if defined(MAC_OS_X_VERSION_10_6) && \
322 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
323 boolean_t
mi_zone_locked(malloc_zone_t
*zone
) {
329 } // unnamed namespace
331 extern int __CFRuntimeClassTableSize
;
334 void ReplaceCFAllocator() {
335 static CFAllocatorContext asan_context
= {
336 /*version*/ 0, /*info*/ &asan_zone
,
337 /*retain*/ 0, /*release*/ 0,
338 /*copyDescription*/0,
339 /*allocate*/ &cf_malloc
,
340 /*reallocate*/ &cf_realloc
,
341 /*deallocate*/ &cf_free
,
342 /*preferredSize*/ 0 };
344 cf_asan
= CFAllocatorCreate(kCFAllocatorUseContext
, &asan_context
);
345 if (CFAllocatorGetDefault() != cf_asan
)
346 CFAllocatorSetDefault(cf_asan
);
349 void ReplaceSystemMalloc() {
350 static malloc_introspection_t asan_introspection
;
351 // Ok to use internal_memset, these places are not performance-critical.
352 internal_memset(&asan_introspection
, 0, sizeof(asan_introspection
));
354 asan_introspection
.enumerator
= &mi_enumerator
;
355 asan_introspection
.good_size
= &mi_good_size
;
356 asan_introspection
.check
= &mi_check
;
357 asan_introspection
.print
= &mi_print
;
358 asan_introspection
.log
= &mi_log
;
359 asan_introspection
.force_lock
= &mi_force_lock
;
360 asan_introspection
.force_unlock
= &mi_force_unlock
;
361 asan_introspection
.statistics
= &mi_statistics
;
363 internal_memset(&asan_zone
, 0, sizeof(malloc_zone_t
));
365 // Start with a version 4 zone which is used for OS X 10.4 and 10.5.
366 asan_zone
.version
= 4;
367 asan_zone
.zone_name
= "asan";
368 asan_zone
.size
= &mz_size
;
369 asan_zone
.malloc
= &mz_malloc
;
370 asan_zone
.calloc
= &mz_calloc
;
371 asan_zone
.valloc
= &mz_valloc
;
372 asan_zone
.free
= &mz_free
;
373 asan_zone
.realloc
= &mz_realloc
;
374 asan_zone
.destroy
= &mz_destroy
;
375 asan_zone
.batch_malloc
= 0;
376 asan_zone
.batch_free
= 0;
377 asan_zone
.introspect
= &asan_introspection
;
379 // from AvailabilityMacros.h
380 #if defined(MAC_OS_X_VERSION_10_6) && \
381 MAC_OS_X_VERSION_MAX_ALLOWED >= MAC_OS_X_VERSION_10_6
382 // Switch to version 6 on OSX 10.6 to support memalign.
383 asan_zone
.version
= 6;
384 asan_zone
.free_definite_size
= 0;
385 asan_zone
.memalign
= &mz_memalign
;
386 asan_introspection
.zone_locked
= &mi_zone_locked
;
388 // Request the default purgable zone to force its creation. The
389 // current default zone is registered with the purgable zone for
390 // doing tiny and small allocs. Sadly, it assumes that the default
391 // zone is the szone implementation from OS X and will crash if it
392 // isn't. By creating the zone now, this will be true and changing
393 // the default zone won't cause a problem. (OS X 10.6 and higher.)
394 system_purgeable_zone
= malloc_default_purgeable_zone();
397 // Register the ASan zone. At this point, it will not be the
399 malloc_zone_register(&asan_zone
);
401 // Unregister and reregister the default zone. Unregistering swaps
402 // the specified zone with the last one registered which for the
403 // default zone makes the more recently registered zone the default
404 // zone. The default zone is then re-registered to ensure that
405 // allocations made from it earlier will be handled correctly.
406 // Things are not guaranteed to work that way, but it's how they work now.
407 system_malloc_zone
= malloc_default_zone();
408 malloc_zone_unregister(system_malloc_zone
);
409 malloc_zone_register(system_malloc_zone
);
410 // Make sure the default allocator was replaced.
411 CHECK(malloc_default_zone() == &asan_zone
);
413 if (flags()->replace_cfallocator
) {
414 // If __CFInitialize() hasn't been called yet, cf_asan will be created and
415 // installed as the default allocator after __CFInitialize() finishes (see
416 // the interceptor for __CFInitialize() above). Otherwise install cf_asan
417 // right now. On both Snow Leopard and Lion __CFInitialize() calls
418 // __CFAllocatorInitialize(), which initializes the _base._cfisa field of
419 // the default allocators we check here.
420 if (((CFRuntimeBase
*)kCFAllocatorSystemDefault
)->_cfisa
) {
421 ReplaceCFAllocator();
425 } // namespace __asan