libsanitizer/lsan/lsan_common_linux.cc

   1 //=-- lsan_common_linux.cc ------------------------------------------------===//
   2 //
   3 // This file is distributed under the University of Illinois Open Source
   4 // License. See LICENSE.TXT for details.
   5 //
   6 //===----------------------------------------------------------------------===//
   7 //
   8 // This file is a part of LeakSanitizer.
   9 // Implementation of common leak checking functionality. Linux-specific code.
  10 //
  11 //===----------------------------------------------------------------------===//
  12
  13 #include "sanitizer_common/sanitizer_platform.h"
  14 #include "lsan_common.h"
  15
  16 #if CAN_SANITIZE_LEAKS && SANITIZER_LINUX
  17 #include <link.h>
  18
  19 #include "sanitizer_common/sanitizer_common.h"
  20 #include "sanitizer_common/sanitizer_flags.h"
  21 #include "sanitizer_common/sanitizer_linux.h"
  22 #include "sanitizer_common/sanitizer_stackdepot.h"
  23
  24 namespace __lsan {
  25
  26 static const char kLinkerName[] = "ld";
  27 // We request 2 modules matching "ld", so we can print a warning if there's more
  28 // than one match. But only the first one is actually used.
  29 static char linker_placeholder[2 * sizeof(LoadedModule)] ALIGNED(64);
  30 static LoadedModule *linker = nullptr;
  31
  32 static bool IsLinker(const char* full_name) {
  33   return LibraryNameIs(full_name, kLinkerName);
  34 }
  35
  36 void InitializePlatformSpecificModules() {
  37   internal_memset(linker_placeholder, 0, sizeof(linker_placeholder));
  38   uptr num_matches = GetListOfModules(
  39       reinterpret_cast<LoadedModule *>(linker_placeholder), 2, IsLinker);
  40   if (num_matches == 1) {
  41     linker = reinterpret_cast<LoadedModule *>(linker_placeholder);
  42     return;
  43   }
  44   if (num_matches == 0)
  45     VReport(1, "LeakSanitizer: Dynamic linker not found. "
  46             "TLS will not be handled correctly.\n");
  47   else if (num_matches > 1)
  48     VReport(1, "LeakSanitizer: Multiple modules match \"%s\". "
  49             "TLS will not be handled correctly.\n", kLinkerName);
  50   linker = nullptr;
  51 }
  52
  53 static int ProcessGlobalRegionsCallback(struct dl_phdr_info *info, size_t size,
  54                                         void *data) {
  55   Frontier *frontier = reinterpret_cast<Frontier *>(data);
  56   for (uptr j = 0; j < info->dlpi_phnum; j++) {
  57     const ElfW(Phdr) *phdr = &(info->dlpi_phdr[j]);
  58     // We're looking for .data and .bss sections, which reside in writeable,
  59     // loadable segments.
  60     if (!(phdr->p_flags & PF_W) || (phdr->p_type != PT_LOAD) ||
  61         (phdr->p_memsz == 0))
  62       continue;
  63     uptr begin = info->dlpi_addr + phdr->p_vaddr;
  64     uptr end = begin + phdr->p_memsz;
  65     uptr allocator_begin = 0, allocator_end = 0;
  66     GetAllocatorGlobalRange(&allocator_begin, &allocator_end);
  67     if (begin <= allocator_begin && allocator_begin < end) {
  68       CHECK_LE(allocator_begin, allocator_end);
  69       CHECK_LT(allocator_end, end);
  70       if (begin < allocator_begin)
  71         ScanRangeForPointers(begin, allocator_begin, frontier, "GLOBAL",
  72                              kReachable);
  73       if (allocator_end < end)
  74         ScanRangeForPointers(allocator_end, end, frontier, "GLOBAL",
  75                              kReachable);
  76     } else {
  77       ScanRangeForPointers(begin, end, frontier, "GLOBAL", kReachable);
  78     }
  79   }
  80   return 0;
  81 }
  82
  83 // Scans global variables for heap pointers.
  84 void ProcessGlobalRegions(Frontier *frontier) {
  85   if (!flags()->use_globals) return;
  86   dl_iterate_phdr(ProcessGlobalRegionsCallback, frontier);
  87 }
  88
  89 static uptr GetCallerPC(u32 stack_id, StackDepotReverseMap *map) {
  90   CHECK(stack_id);
  91   StackTrace stack = map->Get(stack_id);
  92   // The top frame is our malloc/calloc/etc. The next frame is the caller.
  93   if (stack.size >= 2)
  94     return stack.trace[1];
  95   return 0;
  96 }
  97
  98 struct ProcessPlatformAllocParam {
  99   Frontier *frontier;
 100   StackDepotReverseMap *stack_depot_reverse_map;
 101 };
 102
 103 // ForEachChunk callback. Identifies unreachable chunks which must be treated as
 104 // reachable. Marks them as reachable and adds them to the frontier.
 105 static void ProcessPlatformSpecificAllocationsCb(uptr chunk, void *arg) {
 106   CHECK(arg);
 107   ProcessPlatformAllocParam *param =
 108       reinterpret_cast<ProcessPlatformAllocParam *>(arg);
 109   chunk = GetUserBegin(chunk);
 110   LsanMetadata m(chunk);
 111   if (m.allocated() && m.tag() != kReachable && m.tag() != kIgnored) {
 112     u32 stack_id = m.stack_trace_id();
 113     uptr caller_pc = 0;
 114     if (stack_id > 0)
 115       caller_pc = GetCallerPC(stack_id, param->stack_depot_reverse_map);
 116     // If caller_pc is unknown, this chunk may be allocated in a coroutine. Mark
 117     // it as reachable, as we can't properly report its allocation stack anyway.
 118     if (caller_pc == 0 || linker->containsAddress(caller_pc)) {
 119       m.set_tag(kReachable);
 120       param->frontier->push_back(chunk);
 121     }
 122   }
 123 }
 124
 125 // Handles dynamically allocated TLS blocks by treating all chunks allocated
 126 // from ld-linux.so as reachable.
 127 // Dynamic TLS blocks contain the TLS variables of dynamically loaded modules.
 128 // They are allocated with a __libc_memalign() call in allocate_and_init()
 129 // (elf/dl-tls.c). Glibc won't tell us the address ranges occupied by those
 130 // blocks, but we can make sure they come from our own allocator by intercepting
 131 // __libc_memalign(). On top of that, there is no easy way to reach them. Their
 132 // addresses are stored in a dynamically allocated array (the DTV) which is
 133 // referenced from the static TLS. Unfortunately, we can't just rely on the DTV
 134 // being reachable from the static TLS, and the dynamic TLS being reachable from
 135 // the DTV. This is because the initial DTV is allocated before our interception
 136 // mechanism kicks in, and thus we don't recognize it as allocated memory. We
 137 // can't special-case it either, since we don't know its size.
 138 // Our solution is to include in the root set all allocations made from
 139 // ld-linux.so (which is where allocate_and_init() is implemented). This is
 140 // guaranteed to include all dynamic TLS blocks (and possibly other allocations
 141 // which we don't care about).
 142 void ProcessPlatformSpecificAllocations(Frontier *frontier) {
 143   if (!flags()->use_tls) return;
 144   if (!linker) return;
 145   StackDepotReverseMap stack_depot_reverse_map;
 146   ProcessPlatformAllocParam arg = {frontier, &stack_depot_reverse_map};
 147   ForEachChunk(ProcessPlatformSpecificAllocationsCb, &arg);
 148 }
 149
 150 struct DoStopTheWorldParam {
 151   StopTheWorldCallback callback;
 152   void *argument;
 153 };
 154
 155 static int DoStopTheWorldCallback(struct dl_phdr_info *info, size_t size,
 156                                   void *data) {
 157   DoStopTheWorldParam *param = reinterpret_cast<DoStopTheWorldParam *>(data);
 158   StopTheWorld(param->callback, param->argument);
 159   return 1;
 160 }
 161
 162 // LSan calls dl_iterate_phdr() from the tracer task. This may deadlock: if one
 163 // of the threads is frozen while holding the libdl lock, the tracer will hang
 164 // in dl_iterate_phdr() forever.
 165 // Luckily, (a) the lock is reentrant and (b) libc can't distinguish between the
 166 // tracer task and the thread that spawned it. Thus, if we run the tracer task
 167 // while holding the libdl lock in the parent thread, we can safely reenter it
 168 // in the tracer. The solution is to run stoptheworld from a dl_iterate_phdr()
 169 // callback in the parent thread.
 170 void DoStopTheWorld(StopTheWorldCallback callback, void *argument) {
 171   DoStopTheWorldParam param = {callback, argument};
 172   dl_iterate_phdr(DoStopTheWorldCallback, &param);
 173 }
 174
 175 } // namespace __lsan
 176
 177 #endif // CAN_SANITIZE_LEAKS && SANITIZER_LINUX